ASTM D8477-22

This international standard was developed in accordance with internationally recognized principles on standardization established in the Decision on Principles for the
Development of International Standards, Guides and Recommendations issued by the World Trade Organization Technical Barriers to Trade (TBT) Committee.
Designation: D8477 − 22
Standard Practice for
Cannabis or Hemp Supplier Lifecycle Management
This standard is issued under the fixed designation D8477; the number immediately following the designation indicates the year of
original adoption or, in the case of revision, the year of last revision. A number in parentheses indicates the year of last reapproval. A
superscript epsilon (´) indicates an editorial change since the last revision or reapproval.
1. Scope 2. Referenced Documents
1.1 This practice provides cannabis or hemp operations, or 2.1 ASTM Standards:
both, with methods, procedures, responsibilities, and criteria D8222 Guide for Establishing a Quality Management Sys-
for supplier management practices to reliably receive supplies tem (QMS) for Consumer Use of Cannabis/Hemp Prod-
that meet specifications. Effective supplier management in- ucts
cludes clear concise communication and comprehension be- D8229 Guide for Corrective Action and Preventive Action
tween departments and business functions, that is, marketing, (CAPA) for the Cannabis Industry
finance, operations, supply requirement analysis, supplier as- D8270 Terminology Relating to Cannabis
sessment or audits, supplier selection, backup suppliers, and D8286 Guide for Processing Cannabis Product Complaints
supply/supplier information management. D8308 Practice for Cannabis/Hemp Operation Compliance
Audits
1.2 In this practice, the term cannabis can be substituted
D8320 Practice for Implementing an Information Security
with the term hemp. This practice applies to industrial hemp
Program in a Cannabis Operation
operations, CBD operations, and as referred to by several
authorities having jurisdiction, licensed marijuana operations.
3. Terminology
1.3 This practice provides a process for supplier manage-
3.1 General—Definitions are in accordance with Terminol-
mentinSection5andcriteriaforsupplierevaluationinSection
ogy D8270 unless otherwise indicated.
6.
3.2 Definitions of Terms Specific to This Standard:
1.4 Nothing in this practice shall preclude observance of
3.2.1 critical supplies, n—supplies and services provided by
federal, state, or local regulations which may be more restric-
other companies that present an unacceptable level of risk if
tive or have different requirements.
not available in the quantity, quality, or time required.
1.5 This standard does not purport to address all of the
3.2.1.1 Discussion—When applicable, the term critical sup-
safety concerns, if any, associated with its use. It is the
plies includes critical services.
responsibility of the user of this standard to establish appro-
3.2.2 operation, n—any entity or individual licensed/
priate safety, health, and environmental practices and deter-
permitted by an authority having jurisdiction to grow, process,
mine the applicability of regulatory limitations prior to use.
handle, package, store, distribute, or sell, or combinations
1.6 This international standard was developed in accor-
thereof,acannabisplant,itsparts,orproducts,orcombinations
dance with internationally recognized principles on standard-
thereof.
ization established in the Decision on Principles for the
3.2.3 operations, n—the active functioning and processing
Development of International Standards, Guides and Recom-
to keep a business running.
mendations issued by the World Trade Organization Technical
Barriers to Trade (TBT) Committee. 3.2.4 operator, n—an individual or individuals with the
responsibility to manage an operation.
3.2.5 supplier audit, n—the process of evaluating a suppli-
er’s quality management system and ability to meet the
operation’s supplier requirements.
3.2.6 supplies, n—tangible goods, equipment, material, or
services that are provided by sources external to the operation.
This practice is under the jurisdiction of ASTM Committee D37 on Cannabis
and is the direct responsibility of Subcommittee D37.02 on Quality Management For referenced ASTM standards, visit the ASTM website, www.astm.org, or
Systems. contact ASTM Customer Service at service@astm.org. For Annual Book of ASTM
Current edition approved Oct. 1, 2022. Published October 2022. DOI: 10.1520/ Standards volume information, refer to the standard’s Document Summary page on
D8477-22. the ASTM website.
Copyright © ASTM International, 100 Barr Harbor Drive, PO Box C700, West Conshohocken, PA 19428-2959. United States
D8477 − 22
3.2.6.1 Discussion—In this practice, the term supply or complex communication needs, and small single facility op-
supplies may refer to services. erationswithasmallstaffwherecommunicationissimple.The
key to applying this practice is documenting the operation’s
3.2.7 surveillance audit, n—a periodic audit performed to
proceduresandspecificmethodsalongwithavalidjustification
ensurethatasuppliercontinuestomeettheoperation’ssupplier
when a step is modified or simplified to meet the intent of a
requirements.
step in Sections 5 and 6 as it applies to a small operation or a
3.3 Acronyms:
non-critical supply.
3.3.1 CAPA—corrective action and preventive action
3.3.2 QMS—quality management system
5. Supplier Management Process
5.1 Supply and Supplier Information Management:
4. Significance and Use
5.1.1 The operator shall establish a system to maintain and
4.1 Thispracticeisintendedtobeusedbycannabisorhemp
readily access supply and supplier information. The key
operators, or both, to establish good supplier lifecycle manage-
elementsofthesystemshallbedocumented.Thedescriptionof
ment practices.
the supply and supplier information management methods
4.1.1 Without proper oversight, the quality and reliability of
should be included in the operator’s quality manual or similar
supplied materials, equipment, parts, software, or services can
documentation. Refer to Guide D8222 for guidance on quality
degrade. This can create issues that directly impact the opera-
manuals.
tion’s performance and remain undetected until customers
5.1.2 The operator shall document policies and procedures
experience a problem.
for the supplier information management system.
4.1.2 Early identification and mitigation of risks within the
5.1.3 The supplier information management system can be
supply chain are crucial to controlling costs and minimizing
manual, partially automated, or fully automated. The details of
potential impacts on operations, customer experience, and
an effective and secure information management system are
business reputation. In general, costs are reduced when issues
not addressed in this guide. Information security is covered in
are prevented early and upstream in the supply chain.
Practice D8320.
4.2 This practice applies to the cannabis or hemp
5.1.4 Theoperatorshallestablishanddocumentafrequency
horticulture, agriculture, processing, manufacturing, testing, for routine review of the supplier management policies,
and distribution operators and the many suppliers that provide
procedures, policy, and training material and update them as
materials, equipment, parts, software, or services to these needed to reflect current practices. Annual reviews are recom-
operations.
mended and shall be performed at least once every three years.
5.1.5 Document the supply and supplier management
4.3 This practice provides operations and consultants sup-
policies, procedures, and the supplier information system.
porting operations with the actions required to implement good
Follow change control procedures as improvements are made
supply and supplier management practices.
to these documents.
4.4 Any supply chain operator can use this practice to
5.2 Supply Identification and Specifications:
conductaninternalgapassessmentandriskanalysistoidentify
5.2.1 The operator shall identify supplies and services
opportunities for improvement.
required for reliable operations, product quality, safety, and to
4.5 Certification bodies can use the standard to develop
meet the operation’s delivery schedules.
supplier audit programs.
5.2.2 The operator shall rate each supply from critical to
4.6 Section 5 provides details on the supplier lifecycle
noncritical based on the risk potential/impact to the operation
management process that includes the following seven activi-
if the supply suddenly does not meet requirements or is
ties:
suddenly unavailable, and is not readily available from mul-
4.6.1 Supply and supplier information management.
tiple suppliers. The operator should consider the potential for
4.6.2 Supply identification and specifications.
various global supply chain failure events and the impact on
4.6.3 Supplier options, evaluation, and selection.
the operation.
4.6.4 Supplier onboarding.
5.2.3 Initially, critical supplies shall have documented de-
4.6.5 Supplier performance and risk management.
scriptions and specifications. The goal should be to document
4.6.6 Supplier relationship management.
all supplies and services used in an operation.The operator can
4.6.7 Supplier offboarding.
reference industry-recognized specification standards. The
specification should include the following:
4.7 To implement supplier management, follow the process
5.2.3.1 Purpose or objective of the supply,
in Sections 5 and 6. Start by applying the principles in this
practicetoafewsuppliesandsuppliersandworkthroughallof 5.2.3.2 Availability and alternative sources,
the steps in the process. Then repeat the process for more 5.2.3.3 List of alternative options,
supplies or refine the details on supplies that are already
5.2.3.4 Quantity typically ordered,
addressed.
5.2.3.5 Anticipated order frequency,
5.2.3.6 Anticipated lead time,
4.8 This practice applies to critical supplies that require
5.2.3.7 Inventory to be held, and
rigorous management and non-critical supplies that don’t. It
applies to large multi-location operations with a large staff and 5.2.3.8 Other supply information useful to the organization.
D8477 − 22
5.2.4 The operator may choose to organize critical supply 5.3.9.1 Provide a questionnaire or perform an assessment
specifications in a table or spreadsheet, by maintaining a that is more in-depth than the initial questionnaire applied in
document for each supply item, or by using a supply resource section 5.3.8 and optionally include an on-site visit, or
management system.
5.3.9.2 Perform a rigorous audit of each shortlist supplier.
5.3.9.3 To perform a rigorous audit, the operator shall
NOTE 1—When identifying supplies, consider specifying the purpose
developoracquirearigoroussupplierauditprogram.Theaudit
and requirements of a supply rather than a specific type or brand.
program could be built upon digital documents, spreadsheets,
Example: For indoor grow operations identifying the specific require-
ments of grow-medium rather than selecting a specific grow-medium will
or a fully-featured online audit platform. Practice D8308
allow for more options that meet the requirements.
provides details on audit protocols and conducting audits.
Appendix X1 provides an audit protocol that can be used as a
5.2.5 The operator shall establish a policy and specify a
template to develop a specific audit.
schedule to review and update supply specifications.
5.3.10 Select a primary and backup supplier by reviewing
5.3 Supplier Options, Evaluation, and Selection:
evaluation results. The selected suppliers should satisfy the
5.3.1 The operator shall document its supplier selection
most important selection criteria.
procedures.
5.3.11 The operator shall verify that the selected supplier
5.3.2 Determine and document the level of supplier due
canmeetthesupplyspecificationsandrequirementsforagiven
diligence appropriate for each supply item based on the risk
duration. For critical supplies, if the initial supplier assessment
assessment for the particular supply as described in 5.2.2.
was not extensive, a complete supplier audit should be con-
5.3.3 Decisions to deviate from the rigor of the following
ducted on the selected supplier to validate the selection. A
steps for supplies that are low risk, are readily available from
supplier audit checklist is provided in Appendix X1. In some
multiple suppliers, or for other reasons shall be documented in
cases evaluating the supplier history, ratings from other cus-
the supplier information system.
tomers and employees, or other evaluation means can be
sufficient.
5.3.4 For each supply, research and identify available op-
tions for the supply and suppliers. 5.3.12 Select a backup supplier in case a day comes when
theselectedsuppliercan’tperformtemporarilyorpermanently.
5.3.5 Determine and rank the criteria that will be used to
Periodically confirm that the backup supplier continues to be a
evaluate suppliers.
viable option.
5.3.5.1 This may include cost, product quality, delivery
capacity, use of QMS methods and procedures, certifications,
5.4 Supplier Onboarding:
availability of alternative suppliers, value, safety, supplier
5.4.1 The operator shall execute a written contract with all
reputation,support,educationandcommunicationskills,social
key suppliers (see Note 2) that:
responsibility, convenience, risk, changing technology, sup-
5.4.1.1 Contain supply specifications as outlined in 5.2.3,as
plieragility,abilitytoprovidemultiplesupplies,andthe ability
well as acceptable delivery times, corrective action
to develop a mutual relationship and trust with the supplier.
expectations, notification requirements if a plan to discontinue
5.3.5.2 Specific regulations and standards related to a sup-
a supply item emerges, and other requirements. Refer to Guide
ply item will vary depending on the authority having jurisdic-
D8229 for guidance on corrective and preventive action.
tion and the standards that a specific supplier chooses or is
5.4.1.2 Contain standard contract language such as name,
required to conform with.
address, and responsibilities for each party; pricing and pay-
5.3.6 Identify and research available options for the supply
ment details including schedule and invoicing process; perfor-
and suppliers. Use internet queries, operator recommendations,
mance criteria and frequency of periodic supplier reviews or
or industry contacts to select supplies and suppliers.
audits; confidentiality clauses, refunds, and compensation
5.3.7 Consider supply needs for all phases of operations.
terms; level of after-sales service required, and other common
For example, different solutions may be required to control the
contractual terms and conditions such as failure to perform,
humidity of cannabis flower during different phases
dispute resolution, renewal or termination of the contract.
(processing, sampling, testing, storing, transporting, bulk
NOTE 2—Key suppliers provide supplies that are critical to the
packages, product packages, etc.).
operation.
5.3.8 Send a supplier questionnaire to help shortlist the
5.4.2 The operator shall maintain an approved supplier list,
suppliers. Ask potential suppliers what unique criteria sets
sometimes referred to as an approved vendor list.
them apart from competitors. Use questions that touch on
5.4.3 The operator shall gather and retain supplier-related
unique risks present in the cannabis or hemp industry. For
information which may include supply specifications, product
example, a supplier that is a grower may talk about the
manuals, selection criteria, supplier audit reports, contracts,
importance of pesticide handling and their post-harvest humid-
confidentiality agreements, safety data sheets, access
ity control or consider an equipment manufacturer’s parts and
permissions, and other pertinent information and records.
service policy and response time. Use a documented consistent
questionnaire and shortlisting process to narrow the list of 5.4.4 To build a good working relationship with suppliers,
potential suppliers, typically two to four suppliers. the operator should:
5.3.9 Depending on the nature of the supply item and the 5.4.4.1 Facilitate introductions with key personnel for both
shortlisted suppliers either: parties such as billing and finance, primary contacts, delivery
D8477 − 22
and receiving personnel, top management. The contact infor- ISO/IEC 17025 accredited by a reputable ILAC-MRA (see
mation should be documented and available to personnel with Note 3) signatory may not require extensive surveillance but
a need-to-know. there are exceptions.
5.4.4.2 Ensure the payment method is established and make
NOTE3—ILAC-MRA,InternationalLaboratoryAccreditationCoopera-
timely payments. tion–MutualRecognitionArrangement.Thismeansthattheaccreditation
body that assessed the test or calibration lab or sampling body to the
5.4.4.3 Discuss and understand lead times for orders and
requirements of ISO/IEC 17025 is also accredited themselves and found
special requests.
that their ISO/ IEC 17025-accredited labs’ results are acceptable across
5.4.4.4 Establish procedures for reporting and resolving economies.
issues.
5.5.3 An audit program with consistent assessment proto-
5.4.4.5 Request feedback from the supplier to identify ways
cols and scoring mechanisms shall be used for surveillance
to improve the mutual relationship.
audits. Section 6 and Practice D8308 provide information on
audits.
5.4.4.6 Onboarding activities often continue throughout the
5.5.4 The operator shall periodically conduct surveillance
life of the supplier relationship. Changes in staff, procedures,
audits as defined in 5.5.2.5. Surveillance audits may require
product details, and other details will require attention.
less time than the initial selection and onboarding audit.
5.4.5 The operator shall maintain records to support future
Surveillance audits are used to:
supplier off-boarding activities. Examples of this type of
5.5.4.1 Review the previous audit results and previously
information are:
collected documentation,
5.4.5.1 Access granted to information and information sys-
5.5.4.2 Identify changes, improvements, or new issues,
tems. Examples: the issuance of user accounts, transmitted
5.5.4.3 Assessnewcustomercomplaints,recalls,andCAPA
proprietary information.
activity,
5.4.5.2 Access granted to the physical property and build-
5.5.4.4 Visit the supplier’s site to verify that the daily
ings. Examples: the sharing of combinations, the issuance of
practices, facility maintenance, and equipment calibration and
badges, access cards, keys, and parking credentials.
maintenance continue to meet expectations.
5.4.5.3 Supplier owned equipment and materials located at
5.5.4.5 Identify ongoing trends of nonconformance using
the operator’s location.
data from previous audits.
5.5.5 When nonconforming conditions or trends are noted
5.4.6 The operator shall document and periodically review
thesuppliershallbenotifiedandprovidedaspecifictimeframe
and update the supplier onboarding procedure to reflect current
tocorrecttheissues.Thecorrectionsshallbeverifiedandnoted
practices.
in the audit report. Ongoing nonconformance trends may lead
5.5 Supplier Performance and
...