Audit of the Cannabis Control Commission (September 26, 2023)
September 26, 2023 · Cannabis Control Commission · Read the full official report on mass.gov ↗
Published September 26, 2023 Audit covers January 1, 2019 – December 31, 2020 Under Diana DiZoglio · 2023–present
source
“Does CCC ensure that recreational marijuana products sold meet the safety standards required by Section 15(a)(1) through (3) of Chapter 94G of the General Laws; Section 500.160(1) through (4) and (10) of Title 935 of the Code of Massachusetts Regulations, which was in effect during the audit period; and CCC’s “Protocol for Sampling and Analysis of Finished Medical Marijuana Products and Marijuana-Infused Products for Massachusetts Registered Medical Marijuana Dispensaries”?”
Read the plain-English breakdown
This is a performance audit by the Massachusetts State Auditor of the Cannabis Control Commission, covering January 1, 2019 through December 31, 2020.
“In accordance with Section 12 of Chapter 11 of the Massachusetts General Laws, the Office of the State Auditor has conducted a performance audit of the Cannabis Control Commission (CCC) for the period January 1, 2019 through December 31, 2020.”
Auditors checked whether the commission made sure recreational marijuana products sold in Massachusetts followed required safety standards.
“The purpose of our audit was to determine whether CCC ensured that recreational marijuana products sold met the safety standards required by the following:”
If cannabis products are sold after required testing has gone stale, there may be public health risks and people may lose trust in the state’s marijuana market.
“The sale and consumption of marijuana products that contain materials that were last tested for contaminants more than one year before could result in a potential public health risk and loss of consumer confidence in the Massachusetts marijuana industry.”
For an ordinary consumer, the report is about whether the state’s cannabis regulator had strong enough checks to keep unsafe, expired-test, or improperly reported products from reaching buyers.
“If CCC does not ensure that positive pesticide tests are reported on time, CCC’s ability to investigate possible pesticide violations, and protect consumers, could be impaired.”
The auditors found three main problems: some products with outdated testing were sold, pesticide-test reporting was not always timely or complete, and cybersecurity training was missing early on.
“Below is a summary of our findings and recommendations, with links to each page listed.”
The auditor recommended stronger monitoring, better pesticide-test reporting procedures, and regular cybersecurity training; the commission said it has taken or is taking steps to address these issues.
“Based on its response, CCC has taken measures to address our concerns in this area.”
The audit found more than $10 million in sales of products that included marijuana material last tested more than a year earlier, which shows the issue affected real products sold to consumers.
“Sales of these products totaled $10,192,986 and consisted of 130,875 individual products in various forms and another 737 pounds of flower or buds.”
Metrc is the tracking system used to follow marijuana from growing through testing and sale, so regulators can monitor inventory and compliance.
“CCC selected Metrc, a third-party electronic tracking and reporting database, to meet this requirement.”
1 figure(s) pending source verification - not shown
What the Auditor checked
- Did not comply Does CCC ensure that recreational marijuana products sold meet the safety standards required by Section 15(a)(1) through (3) of Chapter 94G of the General Laws; Section 500.160(1) through (4) and (10) of Title 935 of the Code of Massachusetts Regulations, which was in effect during the audit period; and CCC’s “Protocol for Sampling and Analysis of Finished Medical Marijuana Products and Marijuana-Infused Products for Massachusetts Registered Medical Marijuana Dispensaries”?
What the Auditor found
Why it matters: The sale and consumption of marijuana products last tested for contaminants more than one year before could create a public health risk and reduce consumer confidence.
Standard: Section 500.160(4) of Title 935 of the Code of Massachusetts Regulations required marijuana or marijuana products with testing dates over one year old to be deemed expired and not sold or transferred until retested. ( Section 500.160(4) of Title 935 of the Code of Massachusetts Regulations )
1 recommendation
- CCC should develop and implement monitoring controls to identify all products with materials that were last tested more than one year ago and prevent the sale of those products to consumers.agency: agreed
Agency response & Auditor reply
Agency: "The Commission agrees with the recommendations and has taken actions to implement it."
Auditor: "We believe this indicates that the process in place during the audit period needed improvement, and based on its response, CCC is taking appropriate measures to address our concerns in this area."
Why it matters: Late or missing pesticide-test reporting could impair CCC’s ability to investigate pesticide violations and protect consumers.
Standard: Section 15(a)(3) of Chapter 94G of the Massachusetts General Laws and 935 CMR 500.160(3) required independent testing laboratories and marijuana establishments to report contamination results to CCC within 72 hours. ( Section 15(a)(3) of Chapter 94G of the Massachusetts General Laws; 935 CMR 500.160(3) )
2 recommendations
- CCC should use existing Metrc capabilities to create a report that identifies all positive pesticide tests for CCC’s Investigations and Enforcement Unit to monitor MEs’ and ITLs’ compliance with reporting requirements.agency: agreed
- CCC should develop adequate policies and procedures to ensure that ITLs’ standard operating procedures include instructions for responding to laboratory results that indicate that contaminant levels are above acceptable limits.agency: agreed
Agency response & Auditor reply
Agency: "The Commission agrees with the recommendations in this finding."
Auditor: "We believe that CCC needs to strengthen its existing process by implementing additional preventative controls, which should be designed to prevent the event from occurring in the first place."
Why it matters: A lack of cybersecurity awareness training may lead to user error or compromise the integrity and security of protected information in CCC’s information technology systems.
Standard: Executive Office of Technology Services and Security Information Security Risk Management Standard IS.010 and state Executive Order 504 required initial and annual cybersecurity awareness training. ( Information Security Risk Management Standard IS.010; Section 6 of state Executive Order 504 )
1 recommendation
- CCC should ensure that all new employees receive initial cybersecurity awareness training and that all employees complete annual cybersecurity awareness training thereafter.agency: already implemented
Agency response & Auditor reply
Agency: "The Commission acknowledges this finding."
Auditor: "Based on its response, CCC has taken measures to address our concerns in this area."
More audits of this entity
Other Office of the State Auditor reports on Cannabis Control Commission .
- Audit of the Cannabis Control Commission (August 14, 2025)Authority / Commission · August 14, 2025