How V5 Ultimate runs a cannabis operator, end to end.

There is no federal cannabis cGMP in the US. There are ~38 state programs, each with its own track-and-trace mandate (Metrc, BioTrack, Leaf Data Systems), its own testing panel (potency, pesticides, heavy metals, mycotoxins, microbials, residual solvents, water activity, foreign matter), its own labelling rule, and its own packaging-and-childproofing standard. In Canada, Health Canada's Cannabis Regulations are federal and unified. In the EU, medicinal cannabis is EU-GMP — Annex 7 for the herbal substance, Annex 1 where sterile dosage forms are produced.

The hazards that drive enforcement are unambiguous: inventory variance vs. the state system, failed CoA released to retail, off-label THC content, missing childproofing, distribution into a state where the product isn't licensed.

V5 Ultimate treats every plant tag, every harvest, every CoA, every label print and every state-system push as part of the same immutable ledger. Variance is a query, not a quarterly nightmare.

Every node carries forward plant tag, harvest batch, extraction batch, product batch, operator and equipment from the node before it. Nothing is re-keyed; nothing is reconciled by hand to Metrc / BioTrack.

V5 holds every plant tag with strain, source, mother lineage, room assignment, growth stage, and movement history. Nutrient and IPM applications are kiosk-logged with product (with the state-approved pesticide list as a hard gate), concentration, applicator, REI, and PPE.

Environmental controllers (temperature, humidity, CO2, light schedule, VPD) stream into the room record. Variance from setpoint opens a deviation; sustained variance opens a CAPA.

The harvester scans the plant tag, the harvest batch and the destination drying room. Wet weight is on the scale stream; waste (stem, large fan leaves) is weighed separately and tagged for destruction per state rules. V5 pushes the harvest event to Metrc / BioTrack in real time.

V5 holds drying-room attributes: temperature band, RH band, photoperiod, sanitation status. Trim is kiosk-led with operator scan and bin weight; loss is reconciled against wet weight with a configurable tolerance. Out-of-tolerance opens an inventory deviation.

Each formula holds: input cannabis batches (with current potency CoAs), non-cannabis ingredient BOM, routing with step-by-step instructions, in-process control plan (potency, terpenes, residual solvent, water activity for edibles), packaging routing, child-resistant closure spec, and the locked label artwork per state.

Effectivity is two-signature: a formulator signs the change, a QA lead signs that the change is within the state-approved scope. New work orders pick up the new revision; in-flight work orders keep the snapshot they were released against.

If the formula is revised mid-shift, the work order keeps the snapshot it was released against. The auditor sees exactly the formulation this batch was built to, with the sha256 of the snapshot recorded against release.

Extraction parameters (pressure, temperature, solvent volume, run time) stream into the work order. Distillation passes are recorded with column temperature and yield. Infusion (edibles, beverages) is kiosk-led with operator scan, scale stream and homogenisation verification.

Allergen / dietary changeovers for edibles are explicit, signed gates — gummies move from gluten-containing to gluten-free with a documented changeover and sanitation verification.

State-mandated CoA panel — potency (cannabinoids), terpenes (where required), pesticides per state list, heavy metals (As / Cd / Pb / Hg), mycotoxins (aflatoxins, ochratoxin), microbial (yeast / mould / coliform / E. coli / Salmonella), residual solvents (per state limits), water activity for edibles, foreign matter — runs at the state-mandated point in the workflow. OOS auto-opens a deviation, holds the lot, and notifies QA.

A single register categorises by event type. Inventory variance vs. the state system is a first-class object: the system reconciles V5 movements against Metrc / BioTrack daily and opens a variance deviation on threshold breach.

Each state SKU carries: THC / CBD per package and per serving, ingredients, allergens (for edibles), pesticide / heavy-metals / microbial CoA reference, manufacturer licence #, distributor licence #, child-resistant packaging certification, state-mandated warnings (pregnancy, driving, addiction), QR code to the CoA. V5 prints from the formula and CoA — no manual edits at packaging.

Distribution gates by state: if the SKU isn't licensed in the destination state, the shipment cannot release. Track-and-trace push (manifest) is automatic.

Review-by-exception is only safe if the record is complete and immutable. V5's batch record is built from the ledger as the line runs. The QA reviewer's queue surfaces only items the system can't auto-clear. Release requires two qualified e-signatures, both identity-verified, both bound to the snapshot.

Every unit is shipped against a state-system manifest that carries the lot code. When a recall trigger fires — failed retest, customer adverse event, pesticide false-negative discovery — V5 walks the ledger in both directions in seconds: every unit made from this harvest batch, every dispensary it shipped to.

The state-system recall submission and the press-release draft assemble from the same ledger.

Quality manual, SOPs by licence type (cultivation / extraction / manufacturing / distribution), CAPA, change management, management review — all structured workspaces, not Word documents.

Draft → Review → Approved → Effective → Periodic Review → Superseded / Retired. Two qualified signatures effect every release. Operators see only the effective revision; superseded revisions are retained per state record-retention rules (typically 2–7 years).

V5 maintains a training matrix per role × line × hazard. State employee-badge expiries are bounded; an expired badge locks the operator out of the kiosk.

Every batch's quality signals, every CAPA, every state-system variance, every supplier / cultivator scorecard, every customer complaint — all stream into the management-review workspace as they happen.

V5's audit module schedules internal audits and state inspections. When the regulator arrives, the request list — Metrc / BioTrack reconciliation, last three months of CoAs, pesticide log, training, calibration — is a query, assembled and printable in minutes.

Hazards are identified by category (biological, chemical, physical, regulatory). Each gets a severity × likelihood score, a documented decision on whether a control is required, the monitoring procedure and frequency, the corrective action, and verification.

Approved pesticide list per state, IPM SOPs, applicator training, sprayer-calibration records, REI enforcement, finished-product testing schedule, supplier-control side, response-on-positive plan (hold, vector-survey, intensified testing, disposition) — all assembled into one programme with a calendar and an audit trail.

V5 holds sanitation procedures per zone × equipment × cannabis state, with frequency, agent, concentration, contact time and verification (visual + ATP + microbial swab on a defined cadence). Sanitation events are kiosk-led; results bind to the equipment record.

Extraction pressure / temperature, distillation columns, dispense scales, HPLC, GC, LC-MS/MS for pesticide testing, water-activity meters — each is a tracked asset with calibration interval, certificate, tolerance, and an out-of-tolerance impact assessment that triggers a back-look.

Sample sites, frequency, indicator and pathogen testing, and corrective actions on a positive (intensified cleaning, re-test, hold) are all scheduled and tracked.

Intake captures lot, dispensary, observed issue, severity, consumer info. V5 binds the complaint to the batch, surfaces adjacent batches, and trips a deviation if pattern crosses a threshold.

Every signed event carries the actor's verified identity, signature meaning, time, and a sha256 of the record. The signature row is append-only.

CoAs per lot, potency lookup, recall status, manifest history — all on the portal. Audit-trail of who downloaded what is automatic.

A typical operator onboards in 4–8 weeks: master data import, plant-tag migration, kiosk training, parallel-run validation, cutover. The validation pack (URS → IQ → OQ → PQ) is built in.

Abbreviated mapping. Each link opens the full readiness guide.