A sweeping Colorado state audit has uncovered significant weaknesses in the system responsible for keeping contaminated, mislabeled and improperly tested marijuana products away from consumers. The review found that tens of thousands of cannabis harvest batches moved through a reduced-testing program without undergoing certain routine tests, while potentially unsafe products sometimes remained on dispensary shelves for months before consumers were publicly warned. Auditors also identified gaps in laboratory oversight, inconsistent inspections, short record-retention requirements and a state reference laboratory that has struggled to provide regulators with the independent testing capacity needed to verify private laboratory results.
Released by the Colorado Office of the State Auditor, the Marijuana Consumer Safety performance audit examined the Marijuana Enforcement Division, or MED, within the Department of Revenue and cannabis-related functions of the Colorado Department of Public Health and Environment. Auditors emphasized that they did not find evidence that Colorado’s legal marijuana supply is broadly unsafe. Instead, they concluded that weaknesses in the regulatory framework increase the possibility that contaminated products can reach consumers and remain available longer than they should. The findings are particularly significant because Colorado has operated one of the nation’s oldest recreational marijuana markets and has often served as a model for cannabis regulation elsewhere.
About 41,000 Harvest Batches Went Without Testing Under Reduced-Testing Rules
One of the audit’s most striking findings involves Colorado’s Reduced Testing Allowance program. The program permits qualifying marijuana businesses with a history of passing tests to submit products for certain contaminant tests less frequently. Among 207 participating cultivators that were active at the end of 2025, auditors found that approximately 41,000 harvest batches were not tested between January 2023 and December 2025. Those batches represented about 26 percent of the nearly 160,000 harvest batches contained in MED’s reduced-testing report.
The number does not mean Colorado discovered 41,000 illegally untested or contaminated batches. Many were exempt from routine testing under rules intentionally designed to reduce testing costs for businesses with established compliance histories. The audit’s concern was that MED relies heavily on business self-attestation and does not always independently verify whether companies continue meeting the requirements necessary to receive reduced-testing privileges. Auditors found that businesses can determine for themselves whether certain exemptions apply, while regulators lack comprehensive information showing exactly which companies are using all available exemptions and how much marijuana moves through the market without direct testing.
Some Cannabis Tests Were Skipped Far More Often Than Others
The broader testing data show how significant those exemptions can become depending on the contaminant being measured. Among marijuana cultivators reviewed by auditors, approximately 69 percent of harvest batches were not tested for elemental impurities, 61 percent were not tested for microbial contamination, 38 percent were not tested for potency, 68 percent were not tested for pesticides and 69 percent were not tested for water activity. These percentages reflect Colorado’s combination of general testing exemptions and reduced-testing programs rather than evidence that businesses simply ignored mandatory testing orders.
Product manufacturers also had high percentages of batches not subjected to particular tests. According to the audit, approximately 68 percent of production batches were not tested for elemental impurities, 71 percent for microbials, 94 percent for mycotoxins, 29 percent for potency, 74 percent for pesticides, 81 percent for residual solvents and 93 percent for water activity. Colorado’s system assumes that previous testing performance, manufacturing controls and other safeguards can allow some testing to be performed less frequently. Auditors questioned whether the state currently has enough independent verification to make that approach reliable.
Businesses Can Collect Their Own Compliance Samples
Another vulnerability appears before a sample ever reaches a testing laboratory. Colorado generally permits licensed marijuana businesses to select the samples that are submitted for compliance testing. Rules govern who may take the sample, how much material must be collected and how the process must be documented, but the regulated business itself remains heavily involved in choosing the material that represents a much larger production batch.
That arrangement matters because laboratory testing is only as representative as the sample provided. A laboratory can perform an accurate chemical or microbiological analysis and still produce a misleading picture of the overall batch if the sample does not properly represent what consumers ultimately buy. Colorado requires sample collection to occur under video surveillance, allowing regulators to review whether the process followed state rules. The audit found, however, that those recordings only have to be retained for 30 days, creating a narrow window in which investigators can verify what occurred.
Short Record-Retention Rules Can Make Later Investigations Difficult
The 30-day video requirement stood out because MED inspections frequently occur much later. The agency has a goal of conducting on-site inspections at marijuana businesses approximately every two years, but auditors found that actual intervals can be considerably longer. Among businesses operating throughout the 2023-2025 period, 93 cultivators—38 percent of the group—were inspected only once or not at all. Ninety-seven manufacturers, representing 52 percent, were likewise inspected only once or not at all. Auditors also found examples of businesses going as long as five years without an on-site inspection.
By the time an investigator visits a facility, video documenting how a particular cannabis sample was selected may therefore have been erased for years. Other sampling records are generally kept for two years, creating a similar mismatch when inspections fall behind that schedule. The audit warned that a regulatory system cannot rely heavily on businesses preserving evidence of proper sampling while simultaneously allowing that evidence to disappear before regulators are likely to examine it.
Unsafe Products Sometimes Stayed on the Market for Months
Testing gaps were only one part of the audit. Investigators also examined how quickly MED issues Health and Safety Advisories after marijuana products are found or suspected to pose a risk. Between 2023 and 2025, products that eventually became the subject of safety advisories were available to consumers for anywhere from approximately one week to a little more than three years before the public notice was issued. The average was 223 days, or just under seven and a half months.
The audit carefully distinguished that figure from the amount of time regulators knowingly allowed a dangerous product to remain on sale. In many cases, MED did not become aware of the potential problem until long after the marijuana had entered the market. The agency cannot investigate a safety issue it does not yet know exists. Even with that distinction, auditors concluded that reducing the amount of time potentially harmful cannabis remains accessible should be a central consumer-safety goal.
2025 Advisories Still Averaged 5.7 Months From First Sale to Warning
Colorado showed improvement in 2025, but delays remained substantial. Eighteen Health and Safety Advisories issued that year involved products that had been available for an average of 171.8 days before the advisory—approximately 5.7 months. Individual cases ranged from 27 days to 402 days between the first recorded sale and the public warning.
When auditors focused more narrowly on 13 typical 2025 investigations, they found MED took an average of 104.9 days, or approximately three and a half months, from opening an investigation to issuing the resulting Health and Safety Advisory. Seven of those 13 investigations lasted more than 90 days. Once an investigator formally decided that an advisory was necessary, another 29.5 days passed on average before the notice was issued, even though MED guidance set an 18-day goal. Some cases involved complicated investigations, retesting rights, staff workload and difficulties determining the full scope of affected inventory, but auditors concluded that parts of the process could be streamlined.
Voluntary Recalls Did Not Always Stop Sales
Colorado often turns first to voluntary recalls when investigators identify a possible safety issue because a voluntary action can happen earlier than a formal embargo or administrative hold. Nine of the 13 Health and Safety Advisory investigations examined in detail involved a business agreeing to recall products voluntarily. In several cases, however, the recall process did not completely prevent potentially affected products from remaining available.
One business had improperly tracked inventory in the state’s METRC seed-to-sale system, preventing both the voluntary recall and a later state embargo from immediately identifying all affected products. In another case, some downstream retailers failed to respond when the manufacturer and investigators attempted to contact them. An MED investigator ultimately had to travel to the stores individually to make sure the recall was carried out. Auditors found that Colorado rules require marijuana businesses to maintain recall plans but do not clearly address what happens when poor records make those plans ineffective or when a retailer receiving a recall notice fails to respond.
The Public Advisory Process Requires Numerous Reviews
Once investigators determine that a public warning is needed, producing the advisory itself can involve an unusually large number of people. Depending on the case, the draft may pass through a testing and research analyst, the investigator’s supervisor, the agent in charge of the office, the Data Analytics team, senior investigative leadership, the MED senior director, Department of Revenue communications staff and public-health officials.
Multiple reviews can improve accuracy, particularly when a notice may affect consumers and businesses across the state. Auditors found, however, that internal guidance was not always consistent about who must review a notice, when they must review it or what each reviewer is expected to contribute. Training also created delays in several cases involving investigators handling their first Health and Safety Advisory. The audit recommended clearer procedures and a more streamlined drafting process capable of maintaining accuracy without delaying urgent warnings.
Store Employees Often Did Not Know How to Report Health Complaints
Early identification of problems depends partly on consumers, dispensaries and cannabis workers telling regulators when something appears wrong. The audit found that awareness of Colorado’s reporting system remains limited. Investigators visited 20 marijuana stores and asked representatives how they would report an adverse health event or safety complaint to the state. Fifteen of the 20—75 percent—said they did not know how.
This matters because direct reports from the public were an important source of information in recent safety investigations. Seven of the 13 Health and Safety Advisory cases examined by auditors began with information submitted through MED’s reporting form. If consumers and cannabis employees do not know that the reporting system exists, regulators may learn about contaminated or mislabeled products much later than they otherwise would.
Colorado’s State Reference Laboratory Remains a Major Weak Point
A fully functional independent state laboratory could address several weaknesses identified throughout the audit. Such a facility could retest products during investigations, verify results produced by commercial laboratories and conduct random surveillance testing on products already sitting on dispensary shelves. Colorado has created a state marijuana reference laboratory, but auditors concluded that its capabilities were not yet sufficient to support the regulatory system fully.
At the time of the audit work, the laboratory had not validated methods for all contaminants required in the state’s planned retail surveillance program. Regulators cited inadequate laboratory space and ventilation, staffing constraints, funding limitations and the technical challenges of developing methods for areas such as pesticide testing. MED estimated that its investigations alone could require hundreds of additional tests, while the state laboratory could sometimes take between three weeks and six months to return results on submitted samples.
Colorado’s Shelf-Testing Program Fell Behind Schedule
MED began developing a shelf-surveillance program to provide an independent end-of-process check on marijuana products actually available to consumers. The plan called for regulators to randomly purchase or obtain products from dispensaries and test them for contaminants and label accuracy. Testing was supposed to progress through edibles, concentrates and infused pre-rolls, followed by flower and traditional pre-rolls.
By mid-May 2026, auditors found the pilot had completed only its first phase involving edibles. Testing capacity at the state reference laboratory prevented the program from expanding as quickly as planned. The state also had not secured long-term funding for a permanent surveillance system. Auditors considered retail-level surveillance particularly important because it can identify problems that earlier compliance testing misses, including failures connected with testing exemptions, sample selection or changes occurring after the original laboratory analysis.
Private Marijuana Laboratory Oversight Also Came Under Scrutiny
Colorado relies on private laboratories for most routine marijuana testing. The Department of Public Health and Environment inspects those facilities and provides technical recommendations used by MED when deciding whether laboratories should receive or retain certification. Auditors found incomplete documentation, inconsistencies in inspection procedures and communication problems between the two state agencies.
A strong state reference laboratory could provide an additional layer of accountability by independently checking whether private laboratories obtain consistent results from the same material. Without that capability, state officials have fewer tools for identifying laboratory-specific problems or determining which result is correct when laboratories disagree. The audit called for clearer inspection standards, improved documentation and a revised agreement defining responsibilities between the Department of Public Health and Environment and MED.
The Audit Did Not Find Evidence of a Widespread Contamination Crisis
The scale of the deficiencies could easily create the impression that Colorado’s entire regulated cannabis market is unsafe. The auditors explicitly rejected that conclusion. Their work did not uncover evidence supporting allegations of widespread health and safety problems across regulated marijuana products. Colorado has extensive testing rules, seed-to-sale tracking, private laboratories, health monitoring, inspections and enforcement tools that provide meaningful consumer protections.
The concern is instead that holes between those protections could allow some unsafe products to pass through undetected or remain available longer than necessary. A testing exemption may be reasonable when a manufacturer has demonstrated consistent performance, for example, but its reliability depends on accurate qualification, representative sampling, effective inspections and independent surveillance. Weakness in several of those controls simultaneously makes the overall system less dependable.
Regulators Have Agreed to Major Changes
MED agreed with the audit’s recommendations to evaluate its testing controls, improve monitoring of reduced-testing programs, strengthen inspections, reconsider record-retention requirements and complete its shelf-surveillance initiative. Some reforms will require rulemaking or possible legislative changes, meaning implementation dates extend into 2027 and, for parts of the inspection strategy, March 2028. MED has also committed to streamlining the Health and Safety Advisory process and improving the way case information is collected and analyzed.
The Department of Public Health and Environment similarly agreed to reforms involving private laboratory inspections and certification. The agencies plan to update their longstanding interagency agreement, standardize inspection and corrective-action procedures and improve documentation. Whether those changes produce measurable reductions in recall delays and testing gaps will become an important test of Colorado’s ability to modernize a marijuana regulatory framework created during the earliest years of recreational legalization.
Colorado’s Audit Offers a Warning for Mature Cannabis Markets
The significance of the audit extends beyond Colorado. Legal marijuana regulation is frequently justified in part by the ability of governments to require testing, trace products and remove contaminated cannabis from commerce—protections that generally do not exist in an illicit market. But testing requirements on paper only protect consumers when sampling is representative, laboratories are reliable, exemptions are closely monitored and regulators can respond quickly when something goes wrong.
Colorado’s experience shows how complicated that system becomes after more than a decade of legal sales. Reduced testing can lower costs but weaken surveillance. Extensive due-process requirements protect businesses but may slow urgent safety actions. Voluntary recalls can remove products quickly when companies cooperate but struggle when inventory records are inaccurate. Private laboratories provide essential capacity but require independent oversight of their own.
The new audit does not conclude that Colorado marijuana is broadly contaminated. It reaches a more important regulatory conclusion: the state cannot assume that having a legal testing system automatically guarantees every product carrying a compliance label has been fully scrutinized. With approximately 41,000 harvest batches going without certain routine testing under reduced-testing rules and safety advisories sometimes arriving months after products first entered stores, Colorado now faces the challenge of strengthening the safeguards that were supposed to distinguish a regulated marijuana market from an uncontrolled one.
