Massachusetts just told 13 licensees to destroy, recall or relabel flower that tested at least 25 percent weaker than the label, after re-testing 63 retail products against a 75 to 125 percent window. Oregon filed rules that let you retest when a result lands more than 10 percent off your declared target, but only after a documented investigation, and that fail a batch when a single sample is over the maximum no matter what the average says. Maryland is running the same flower through five labs this month and publishing the agreement statistics in December. New Jersey is paying a statistician $50,000 twice a year to find lab shopping in the data. Colorado’s auditor found products on shelves for up to three years before a warning. The cross-test audit is now the normal way a regulator checks a label, and it checks one unit at a time, not your batch average.
This is the processor-side playbook: how the reference-lab comparison is built, what the outlier statistics see, the sampling plans that survive a single-sample-fail rule, the homogeneity math for infused products, the investigation SOP that earns a retest, and what to do when your lab is the one flagged. The lab-side fraud story lives in the testing fraud post; this one is about keeping your own product inside the window.
What a cross-test audit actually does
A reference-lab cross test takes product the regulator bought or pulled, not product you submitted, and tests it at one or more labs that are not the lab on your COA. Three comparisons come out of it. The first is the retail result against your label, scored as a ratio: measured total THC divided by labeled total THC. Massachusetts accepts 0.75 to 1.25. The second is the retail result against your original COA, which separates a lab problem from a label problem: if the state’s number matches your COA but not your label, you rounded up; if it matches neither, something changed between the lab sample and the shelf, or the lab was wrong. The third, in a multi-lab design like Maryland’s, is each lab against the consensus of the other labs on the same homogenized material, which is how a biased lab is found without anyone accusing anyone.
The statistics are not exotic. Multi-lab comparisons use the proficiency-testing convention: each lab’s result is converted to a z-score against the consensus mean and standard deviation, and the conventional lines are a z inside plus or minus 2 as satisfactory, 2 to 3 as questionable, and 3 or beyond as unsatisfactory. A lab that is consistently at plus 1.8 never trips the line and still inflates every COA it issues by several points; that is why Maryland is also measuring repeatability, because a lab that is both high and tight is the lab-shopping lab. Market-level audits like New Jersey’s look at distributions instead: where a lab’s reported values cluster, how often it detects contaminants compared with its peers, and whether clients move to it after a fail somewhere else.
| State / program | Design | Trigger or threshold | What happens | Dates |
|---|---|---|---|---|
| Massachusetts CCC labeled-potency audit | 63 flower products from 62 producers bought at adult-use and medical retail, re-tested by independent labs | Accurate label = 75 to 125 percent of the labeled total THC (a 15 percent label passes between 11.25 and 18.75 percent) | 13 of 63 out of range; 13 companies ordered to destroy, recall and reformulate, or relabel product at least 25 percent weaker than claimed; two labels inflated by 45 percent, one pre-roll by 55 percent | Bulletin May 22, 2026; notices Aug 13 to 14, 2026 |
| Oregon OHA testing rule amendments (OAR 333 Div. 7 and 64) | Licensee declares a target potency before sampling; retest or reanalysis allowed when the result is more than 10 percent above or below target and the product is still within legal limits, after a documented investigation | One sample over the maximum concentration fails the batch regardless of the average; concentrates, extracts and inhalables at 10 to 50 mg total CBD fail homogeneity when RPD or RSD exceeds 50 percent | Data-integrity prohibitions on labs (fabricated data, manipulated samples or conditions, forced calibrations); flower homogenized to 1 mm maximum particle size from March 1, 2027 | Filed Sep 30, 2026; hearing Oct 19; comments to 5 p.m. Oct 21 |
| Maryland CSQ CLEAR pilot | Retail flower tested across five labs: four MCA-registered independent labs plus the MCA Office of Laboratory Services reference lab | Inter-lab agreement, within-lab repeatability, and new results vs the label and the original COA; statistics built to flag manipulation patterns | Anonymized, informational, no penalties in the pilot; CSQ cites prior markets inflated by up to 25 percent | Testing from early October 2026; results December 2026 |
| New Jersey CRC biannual testing-program assessment | Outside statistician analyzes the state’s lab data twice a year: potency and terpene accuracy plus pesticide, heavy-metal, microbial and residual-solvent detection rates | Statistical signal detection and market-integrity indicators by lab and by market; reproducible code delivered to the CRC | Executive summary, technical report, regulatory recommendations; the stated purpose is to confirm lab shopping is not happening | RFP Sep 24, 2026; $50,000 cap; proposals due 3 p.m. ET Oct 22, 2026 |
| Colorado Office of the State Auditor | Performance audit of the MED’s testing, inspection and public-warning oversight | Businesses choose their own private labs; most 2023 to 2025 products were not consistently tested for contaminants or potency | 14 recommendations; unsafe products stayed on shelves up to three years, more than seven months on average, before a warning; MED agreed to partial implementation by December 2027 | Hearing Oct 19, 2026 |
The common thread: the regulator tests the unit a consumer buys, after packaging and distribution, and compares it to the number you printed. Your batch composite, your lab’s replicate mean, and your rounding all collapse into one jar, one gummy or one cartridge.
The statistics regulators use, in processor terms
Three numbers do most of the work. The label ratio is the retail result divided by the labeled value; a window of 75 to 125 percent means a 20 percent flower labeled at 20.0 passes between 15.0 and 25.0, so a label inflated by 30 percent is caught by any competent re-test. Relative percent difference, RPD, compares two results: the absolute difference divided by their mean, times 100. Relative standard deviation, RSD, compares three or more: the standard deviation divided by the mean, times 100. Oregon’s proposed rule uses either RPD or RSD against a 50 percent line for homogeneity on 10 to 50 mg CBD inhalables and concentrates, and a 10 percent line between the primary sample, the duplicate and any replicates as a lab-side failure criterion. If your own release testing runs three units and the RSD is already 15 percent, the state’s single-unit draw has a real chance of landing outside your window even when your mean is perfect.
The single-sample rule is the one that changes behavior. Under Oregon’s language, one unit over the maximum concentration fails the batch regardless of the average. Averaging has been the processor’s friend for a decade: three units at 9, 10 and 13 mg report as 10.7 and pass a 10 mg label with a 20 percent cap. Under a single-sample rule the 13 mg unit fails the batch on its own. The only defense is dose uniformity at the depositor, not a better average at the lab.
RPD worked example: a 10 mg gummy
| Unit | Measured total THC (mg) | Deviation from the 10 mg label | Note |
|---|---|---|---|
| Gummy 1 | 8.6 | −14 percent | inside a 75 to 125 percent window |
| Gummy 2 | 10.4 | +4 percent | inside |
| Gummy 3 | 11.3 | +13 percent | inside |
| Mean of three | 10.1 | +1 percent | the number you labeled from |
| SD / RSD | 1.37 mg / 13.6 percent | passes a 10 percent-of-target rule on the mean, but the spread is the warning | |
| RPD, gummies 1 vs 3 | 2.7 mg / 10.0 mg = 27 percent | under Oregon’s 50 percent line for 10 to 50 mg CBD products; a 7 mg vs 13 mg pair would be 60 percent and fail |
Read the last two rows together. The batch mean is fine. The spread between units is what the state’s single-unit draw samples, and the spread is a depositor and mixing problem, not a lab problem. A processor who only tracks the mean never sees this coming.
Sampling plans that survive a single-sample-fail rule
The sample you send to the lab is a claim about the whole lot. If the lot is not homogeneous, the claim is false before the lab opens the bag. Increment sampling is the fix: pull many small portions from different places in the lot, combine them, homogenize the composite, then split it into the test sample, a sealed retain, and a reserve. A single scoop from the top of one tote is a sample of that scoop.
| Product form | Lot definition | Increments and composite | Homogenization before the split | Units to test for homogeneity | What the regulator’s sample looks like |
|---|---|---|---|---|---|
| Dried flower | One harvest batch, one cultivar, one dry and cure, up to the state’s batch cap | 10 or more increments pulled from different containers, depths and positions; never the top of one bag | Grind and blend the composite to a uniform particle size (Oregon: 1 mm maximum from March 2027); split into test, retain and reserve | Three subsamples from the homogenized composite; RSD under 10 percent before you trust the number | One retail unit of 3.5 g, ground whole, tested as sold: your label has to survive a single jar, not the batch average |
| Pre-rolls | One fill run from one ground lot | Pre-rolls pulled from the start, middle and end of the run | The ground lot is homogenized before filling; the pre-roll itself is the unit | Five units tested individually; RSD under 10 percent, no unit outside the label window | One pre-roll, the paper removed: shake-heavy fill or kief dusting shows up here, not in your lot composite |
| Concentrates and vape oil | One purge or one formulation vessel | Three positions in the slab or vessel (edges and center) or three fills from the batch | Stir the formulation vessel to a stable temperature before any draw; slabs are tested after the purge, not before | Three units or draws; RSD under 10 percent; Oregon’s 50 percent RPD rule applies to 10 to 50 mg CBD inhalables | One cartridge, emptied and extracted; viscosity stratification and terpene settling are your enemies |
| Edibles and infused units | One deposit or one mold run from one batch of infused base | Units from the first, middle and last deposit | Infused base homogenized and in-process tested before depositing; the depositor is the dose-uniformity control | Five to ten units individually (Oregon’s RPD or RSD rule on 10 to 50 mg CBD products); every unit inside the label window | One package, units tested individually: the regulator sees the worst gummy in the bag, you reported the average |
| Tinctures and beverages | One compounding or one fill run | Top, middle and bottom of the vessel before filling; first and last filled unit | Mix to a stable emulsion or solution and verify no phase separation at fill temperature | Three units; RSD under 10 percent; beverages add a settling check at 24 and 72 hours | One bottle or can after transport and shelf time; separation during distribution reads as potency failure |
Flower deserves a specific warning. Grinding and blending the composite is what makes the test sample represent the lot, and Oregon is writing a 1 mm maximum particle size into rule for March 2027 because whole-bud sub-sampling is where most of the variance comes from. Kief, trim, and shake fractions in the same lot shift total THC by a third or more between increments. If your lab tests whole nugs, your COA is a lottery ticket.
Moisture is the second flower trap. Potency is reported as a mass fraction. Flower that leaves the lab at 0.62 water activity and sits in a sealed package drying toward 0.50 loses water mass, so the same cannabinoid mass reads as a higher percentage; flower that was tested dry and rehydrates in a humid room reads lower. A state re-test months after your COA is testing a different moisture state. Label from the number you expect at the shelf, not the number on the day you dried it, and keep your water activity inside the range the moisture and water activity guide sets for storage.
The dose-uniformity side of this, infusion mass balance, depositor control and the in-process potency check that catches a 30 percent spread before anything is packaged, is a full module in the extraction training course, including the batch records that make the investigation below a ten-minute job instead of a two-week scramble.
Homogeneity for infused products: where the failures live
Infused products fail cross-tests on spread, not on mean. Three mechanisms account for most of it. Incomplete mixing of the infused base: an oil-in-sugar or oil-in-fat system that was stirred, not homogenized, deposits the first units rich and the last units lean as the cannabinoid-bearing phase separates. Temperature drift at the depositor: viscosity falls as the mass warms, deposit volume changes, and dose follows volume. Decarboxylation during cooking: the base was dosed on THCA and part of it converted, or did not, between the in-process test and the finished unit, so total THC moved. The arithmetic matters here. Total THC is delta-9 THC plus 0.877 times THCA; a formulation that does not convert all of its THCA tests differently depending on whether the lab reports total THC by that formula or reports delta-9 alone, and labels are written against total THC in most states.
The control is an in-process potency test on the homogenized base before depositing, a depositor weight check every N units, and a release test on individual units from the start, middle and end of the run with an RSD limit you set below the state’s. Under a 50 percent RPD or RSD rule, an internal limit of 10 to 15 percent on units gives you room for the state’s draw and for shelf life.
The off-target investigation SOP
Oregon’s proposed retest is conditional: the business must investigate the discrepancy, document the investigation and any corrective action, and produce that documentation to OHA or OLCC on request before it can ask for a reanalysis or retest. Other states ask for the same documents after the fact, when a shelf audit flags you. Write the SOP now, so that the investigation is a checklist and not a scramble.
| Step | What you do | Record that proves it |
|---|---|---|
| 1. Freeze the batch | Hold the lot; no sales, no relabel, no re-submission to any lab | Hold notice with batch ID, date, time, person |
| 2. Pull the retained sample | Sealed retain from the same homogenized composite, stored cold and dark since the original split | Retain log: seal number, storage temperature, chain of custody |
| 3. Reconcile the arithmetic | Recompute total THC from the COA’s THCA and delta-9 lines (delta-9 plus 0.877 times THCA); check moisture basis, unit weight, serving count, and the label’s rounding | Worked calculation attached to the COA |
| 4. Interrogate the process | Compare the batch to its own history: extraction yield, infusion mass balance, depositor weights, fill temperature, drying endpoint and water activity | Batch record with control-chart position (this batch vs the last 20) |
| 5. Interrogate the sample | Was the composite built from enough increments? Was it ground? Did the lab receive one jar from the top of a tote? | Sampling record with increment count and locations |
| 6. Second lab, blind | Split the retain and send one half to a second accredited lab without the first result on the paperwork | Both COAs, same retain seal number |
| 7. Root cause and CAPA | Name the cause (sampling, homogenization, lab, process drift, moisture change) and the corrective action | CAPA form signed; SOP revision number if the SOP changed |
| 8. Request the retest or relabel | Oregon-style retest only after steps 1 to 7 are documented; otherwise relabel inside the window or reformulate | Retest request with the investigation attached; relabel approval |
Two of these steps decide most cases. Step 3 finds the arithmetic errors, which are more common than lab errors: a label written from a THCA-only line, a moisture basis mismatch, a serving count that does not match the deposit count. Step 6 settles the lab question without an argument, because two accredited labs within a few percent of each other and both away from the first COA is a lab finding, and two labs that agree with the first COA is a product or sampling finding. Everything in the table feeds the SOP structure covered in the SOP templates post; the investigation record is the document an inspector asks for first.
When your lab is the one flagged
A lab-shopping audit does not name your batch; it names a lab, and every COA from that lab inherits the doubt. You will not be told in advance. The processor-side signals are in the data you already have.
| Signal in the state’s data | What it suggests | What it looks like from the processor side |
|---|---|---|
| A lab’s mean reported THC sits well above the market mean for the same product class | Systematic high bias or selective reporting | Your COAs from that lab run 3 to 8 points above a second lab’s on split samples |
| Results cluster just above a commercial threshold (20 percent flower, 80 percent oil) with thin tails below | Rounding up or dropping low replicates | Every batch lands in the same two-point band regardless of cultivar or season |
| Contaminant detection rate near zero while peer labs detect at normal rates | Method sensitivity or data manipulation | Pesticide and microbial panels that never fail, ever |
| Client migration after a failed result at lab A to lab B, followed by a pass | Lab shopping | Your own history shows a lab switch inside a week of a fail |
| Retail re-test ratios (measured divided by label) centered below 1.0 for one producer | Label inflation or moisture drift after packaging | Shelf audits read your flower 15 to 25 percent under label |
| Replicate agreement that is too good (RSD under 1 percent on heterogeneous flower) | Reported replicates that were never run | Ask the lab for raw replicate data and the instrument sequence file |
If the signals point at your lab, act before the regulator does. Split the last three retains and send them blind to a second accredited lab. If the second lab reads lower by more than your label window allows, relabel voluntarily inside the window and document the decision; a voluntary relabel is a line in a file, a state-ordered recall is a press release. Then move release testing to the second lab and keep the first lab for nothing. Ask any lab you keep for its ISO 17025 scope, its last two proficiency-test z-scores for cannabinoids, and its intra-run duplicate data; a lab that will not show replicates is telling you what the replicates look like.
Labeling strategy inside the window
The window is symmetric, the risk is not. Nobody is penalized for a product that reads 10 percent stronger than the label; the orders in Massachusetts went to products at least 25 percent weaker than claimed, with 45 and 55 percent inflation at the top. Label at the lower end of what your replicates support, not at the single highest number a lab ever produced. A flower lot with three composite replicates at 21.8, 22.6 and 23.1 percent is a 22 percent label with margin for moisture loss and a single-jar draw; it is not a 23.1 percent label. For infused units, label the target dose and keep the unit RSD under your internal limit, because the state samples the unit. The GMP logic behind this, release specifications set below the regulatory limit, is laid out in the GMP certification guide.
Frequently Asked Questions
What is a cannabis potency audit?
A regulator buys or pulls finished product from retail, has it tested by a reference lab or independent labs that are not the lab on the producer’s COA, and compares the result to the label and the original COA. Massachusetts scored 63 flower products against a 75 to 125 percent window and found 13 outside it; Maryland is running flower through five labs at once to score inter-lab agreement.
What tolerance do states allow between labeled and measured THC?
Massachusetts treats a label as accurate between 75 and 125 percent of the labeled total THC. Oregon’s proposed rule works from a producer-declared target and allows a retest when the result is more than 10 percent off that target; many states use a plus or minus 10 to 20 percent label tolerance. The single-unit the regulator tests has to sit inside the window on its own.
How is RPD calculated for cannabis homogeneity?
Relative percent difference is the absolute difference between two results divided by their mean, times 100. Two gummies at 8.6 and 11.3 mg give an RPD of 27 percent. Oregon’s proposal fails 10 to 50 mg CBD concentrates, extracts and inhalables when RPD or RSD exceeds 50 percent, and uses a 10 percent line between a lab’s primary, duplicate and replicate samples.
Can I retest a batch that comes back off target?
Under Oregon’s proposed rule, yes, if the result is more than 10 percent above or below the target potency you declared before sampling, the product is still within legal limits, and you have investigated and documented the discrepancy and any corrective action first. Most other states allow a retest only through a formal appeal and a retained sample, which is why the sealed retain and the investigation record matter everywhere.
Why does the state’s result differ from my COA?
Four causes cover most cases: the lab tested a sample that did not represent the lot, the lot was not homogenized before sampling, moisture changed between the test date and the shelf, or the lab’s result was biased. A blind split of the retained sample to a second accredited lab separates the last cause from the first three.
How many units should I test for infused products?
Five to ten individual units from the start, middle and end of the run, reported individually with the RSD, with your own limit set at 10 to 15 percent so that the state’s single-unit draw and shelf life both fit inside the label window. The batch mean alone will not protect you under a single-sample-fail rule.
Bottom Line
The audit tests one unit against your label. Build the lot so any unit passes: increment sampling, a ground and blended composite, a sealed retain, unit-level release testing with your own RSD limit, labels written from the low end of your replicates, and an investigation SOP that is already written when the letter arrives. If you want the sampling plan, the investigation SOP and the release specifications written for your products and your state, that is what we do.
