Custom Solution

One compliance programme. Multiple standards. One team.

One integrated compliance programme for medical cannabis. Built around your specific situation, managed by a dedicated multi-specialist team, with measurable progress at every stage.

GACPEU-GMPISO 9001 / 17025 / 14001IRCA PR 325 AuditingDigital QMS / Annex 11
See how the programme works

No programme can guarantee the outcome of a regulatory inspection or certification audit. We deliver methodology, transparency, and a measurable state of readiness.

Recognition

Does this describe your operation?

"We have one consultant for GACP and another for GMP. The documentation runs on different logic."

"The Annex 11 requirements for our laboratory system were never mapped to ISO 17025."

"We are entering Germany. The system was built for the home market and the gaps are starting to show."

"We have a buyer audit in 60 days covering GACP, GMP and ISO. Nobody owns the intersection."

"The investor wants a multi-standard compliance review before closing."

"We received findings across three different areas in one inspection. There is no coordinated response."

The intersection problem

The spaces between standards are where findings happen.

When dried plant material moves from a GACP cultivation site to a GMP production facility, both frameworks apply at once. If your GACP and GMP consultants are working from different documentation logic, that transition becomes a finding.

Those gaps surface at inspections, buyer qualifications, and investor due diligence, exactly when they are most costly to fix.

GACP×EU-GMP

Where the risk lives

Plant material receipt and traceability handoff. Two systems, one transition point.

GACP traceability records use a different format from GMP batch records. Both sides look compliant in isolation. The handoff becomes a finding.

EU-GMP×ISO 9001

Where the risk lives

ICH Q10 alignment with ISO 9001 QMS structure. Two quality systems, no shared logic.

GMP QMS and ISO 9001 QMS were built separately. Procedures partially contradict. Neither satisfies an auditor expecting coherence.

EU-GMP Annex 11×ISO 17025

Where the risk lives

Computerised systems validation for laboratory environments. Data integrity at the boundary.

eQMS implemented without Annex 11 validation support. Electronic records fall short of GMP evidence requirements. Lab data integrity remains unverified.

Auditing×All standards

Where the risk lives

Audit scope must cover all applicable frameworks in one programme.

Single-standard internal audits leave intersection risks invisible. The external auditor finds what the internal audit was never structured to see.

Multi-standard compliance in practice

Three engagements. Three integration patterns.

Greenfield integrated operator

GACP, EU-GMP, ISO 9001

A vertically integrated cannabis company building cultivation, extraction and production simultaneously across two sites needed three standards implemented in sequence for market entry in Germany and the UK. The assessment identified 47 gap items across all three standards with priority sequencing. The programme delivered GACP documentation and traceability, EU-GMP QMS with Site Master File, and ISO 9001 integrated within the GMP framework.

Result

German market entry achieved within 14 months of programme start.

Multi-standard chaos remediation

GACP, EU-GMP, Annex 11

A producing company had GACP from one consultant, GMP from another, and no ISO coverage. Three intersection gaps surfaced at assessment: GACP-GMP traceability handoff, deviation management scope split across two systems, and digital records falling short of Annex 11. The consolidated programme resolved all three within 8 months.

Result

First GMP inspection with zero critical findings.

M&A due diligence

GACP, EU-GMP, ISO 9001

An investor required a multi-standard compliance assessment of an acquisition target across three standards before closing. The assessment was conducted over 5 working days on-site. The report identified 12 major items with remediation cost estimates and timeline.

Result

Investor negotiated a price adjustment. Remediation programme initiated post-closing.

Case studies are anonymised. Results reflect the specific situation and operational context of each engagement. No programme can guarantee a regulatory or certification outcome.

What it is

A programme built on your assessment.

The Custom Solution integrates five expertise areas, configured for your operation. The assessment identifies what applies, where the gaps are, the priority sequence, and the realistic timeline.

A dedicated team covering all required expertise areas

Multi-specialist team. Each member has deep vertical expertise plus shared horizontal expertise in medical cannabis.

A shared work plan with phases, milestones and responsibilities

One plan, owned by one team. No coordination overhead between separate consultants.

Measurable KPIs at every stage

Five metrics tracked throughout: gap closure rate, audit readiness score, document completion, training compliance, system validation status.

Knowledge transfer that hands the system back to your team

The programme ends with your internal team in control. Continued advisory access remains available on demand. The programme is designed for independence.

The programme proposal follows.

Expertise areas

Five areas that can be integrated in your programme.

Each area is a vertical expertise. The value is in the horizontal integration across all of them.

GACP

Compliant cultivation support. Agricultural SOPs. Documentation and traceability from plant to dried plant material.

Cannabis-specific relevance

Annex 7 GACP requirements. Traceability handoff to GMP at plant material receipt. Supplier GACP qualification for buyers.

Explore the GACP page

EU-GMP

QMS implementation. Production SOPs. Equipment qualification and validation. Site Master File. Deviation, CAPA, change control. QP support.

Cannabis-specific relevance

GMP Annex 7 for herbal medicinal products. ICH Q10 alignment. Multi-market GMP certification including AIFA, BfArM, MHRA, ANSM.

Explore the EU-GMP page

ISO

ISO 9001, ISO 17025, ISO 14001. Management system implementation, documentation, internal audit, certification readiness.

Cannabis-specific relevance

ISO 9001 to ICH Q10 integration. ISO 17025 for in-house laboratories. ISO 14001 for environmental obligations and ESG.

Explore the ISO page

Independent Auditing

First and second party audits by IRCA PR 325 certified GMP Pharmaceutical Lead Auditors. Gap analysis, mock inspection, supplier qualification, due diligence.

Cannabis-specific relevance

Cannabis-specific audit scope: GACP, GMP and ISO covered in one audit programme.

Explore the Independent Auditing page

Digital QMS

Selection, implementation and validation of eQMS, eDMS, product traceability, environmental monitoring, process data management.

Cannabis-specific relevance

Annex 11 compliant eQMS. ISO 17025 laboratory system validation. Integration of digital traceability from GACP to GMP.

Explore the Digital QMS page

Available as part of a Custom Solution programme or as a standalone service. The assessment determines which combination applies to your situation.

How it works

Five stages from first assessment to independent operation.

The programme is transparent, measurable, and built to hand control back to your team.

01

Initial assessment

5 to 15 working days

Structured evaluation of your current compliance status across all applicable standards. Document review, site visit where applicable, team interviews, intersection-specific checks.

Output

Gap map by standard with severity rating. Intersection risk assessment. Priority matrix. Preliminary timeline.

02

Programme design

1 to 2 weeks

Scope definition. Module selection. Team assignment. Work plan with phases and milestones. KPI framework. Communication and reporting structure.

Output

Programme proposal with investment by phase. Fixed cost per module. Defined deliverables and completion criteria.

03

Modular execution

3 to 14 months depending on scope

Delivery of selected modules in priority sequence. Documentation, implementation, training, system configuration, audit programme, digital deployment.

Output

Each module with defined deliverables, owners and completion criteria. Cross-module integration maintained throughout.

04

Progress monitoring

Monthly throughout execution

Regular KPI reporting. Programme adjusted as priorities evolve. Monthly review with client team.

Output

Gap closure rate per standard. Audit readiness score. Document completion. Training compliance. System validation status.

05

Audit readiness and knowledge transfer

4 to 6 weeks

Pre-certification readiness review across all in-scope standards. Internal audit covering all applicable frameworks. Knowledge transfer to your team.

Output

Procedures, training, SOPs and system documentation fully owned by client. Internal team capable of independent maintenance.

Everything starts with the assessment. The programme proposal follows.

Who it's for

Which situation describes yours?

Building from zero

Constructing a compliant operation from the ground up. Cultivation, production, quality system. Everything needs to be built in the right sequence for the right markets simultaneously.

The assessment defines the build sequence. The programme executes it.

Multiple consultants, disconnected systems

GACP from one consultant, GMP from another, ISO from a third. Documentation runs on three different logics. The intersections are unowned.

The assessment identifies all intersection gaps. The programme consolidates and resolves them.

Scaling beyond current capacity

Entering new European markets, launching new products or opening new sites. The system that served you at one scale needs rebuilding for three times the scale.

The assessment defines the upgrade scope. The programme delivers it.

Pre-investment or M&A

Investor or acquirer needs an independent multi-standard compliance view before capital is deployed.

A multi-standard due diligence audit across GACP, GMP, ISO and digital systems, with a prioritised remediation roadmap and indicative cost estimates per finding.

Digital QMS transformation

You want to digitalise the quality system but every technology decision carries a regulatory dimension. Annex 11, ISO 17025 validation, data integrity, electronic signatures. Technology and compliance are working in parallel silos.

The assessment defines the validated digital architecture. The programme implements it.

Post-inspection remediation

Findings across multiple areas in a single inspection. Documentation, training, process controls, traceability. A coordinated remediation programme replaces parallel CAPA threads.

The assessment maps all open findings to their root causes across standards. The programme closes them in a coordinated CAPA plan that holds at the follow-up audit.

Why this works

Multi-specialist team. Verifiable credentials. Measurable programme KPIs.

Team structure

One specialist per area. Shared sector context.

GACP specialist with direct cultivation and supply chain experience. EU-GMP QMS expert with QP support background. IRCA PR 325 certified GMP Pharmaceutical Lead Auditor. ISO management systems consultant. Digital QMS and eQMS implementation specialist.

Cannabis sector experience

Sector-specific expertise from years inside cannabis operations.

Engagements span cultivation, processing, production and laboratory operations. Market access work covers Germany, UK, Italy, Czechia, Switzerland, Israel and Canada. We know what each authority looks at, and how cannabis-specific requirements modify the standard frameworks.

Programme KPI framework

Progress is measured against five tracked metrics.

  • Gap closure rate per standard

    Percentage of identified gaps resolved against the original gap map.

  • Document completion rate

    Percentage of required SOPs and procedures in approved status.

  • Training compliance rate

    Percentage of required personnel trained with current records.

  • Audit readiness score

    Internal score per standard, based on internal audit findings.

  • Milestone completion rate

    Percentage of programme phases completed on schedule.

Before the call

Understand your multi-standard compliance picture before we talk.

The assessment produces a written gap map by standard, an intersection risk assessment, a priority matrix, and a preliminary programme scope. The deliverable is concrete enough to brief an internal team or compare alternative providers.

Assessment output anatomy

Gap map by standard with severity ratings

Intersection risk assessment

Priority remediation matrix

Preliminary programme scope

Realistic timeline estimate

Indicative cost per phase

Free resource

Multi-standard integration guide

A practical guide to integrating GACP, EU-GMP, and ISO requirements into a single coherent programme. Covers documentation logic, QMS structure, and where the standards intersect.

GACP to EU-GMP handoff: documentation continuity

ISO 9001 and EU-GMP: shared QMS architecture

Annex 11 and ISO 27001: data integrity alignment

Single document control system for multiple standards

Audit preparation when multiple frameworks apply

Get the guide for free

No spam. Just the guide, sent immediately.

Common questions

Questions about the Custom Solution.

Separate engagements cover each standard well within its own boundary. They do not cover the intersections: the GACP-GMP handoff at plant material receipt, the Annex 11 requirements that apply to ISO 17025 laboratory systems, the ICH Q10 elements that should align with ISO 9001 structure. The Custom Solution makes one team accountable for the standards and the intersections between them. This is structural, not commercial.

Start with the assessment. Everything else follows from it.

We will review your situation and propose a 30 to 45 minute strategic call within 24 business hours. The call is an assessment conversation focused on your operation.

Book a strategic call

No consultancy programme can guarantee the outcome of a regulatory inspection, certification audit or investment due diligence. All compliance decisions remain with the client organisation and applicable regulatory or certification bodies.