Colorado's Auditor Put a Number on the Delay: 223 Days on Shelves Before the State Said Anything.

On Monday morning, October 20, an audit supervisor named Catherine Friday sat down in front of Colorado's Legislative Audit Committee and explained, in the flat vocabulary of her profession, that the state cannot reliably tell whether the cannabis on its shelves is safe. "It's really a combination of factors that impacts MED's ability to identify public safety risks and to ensure that businesses comply with safety requirements," she said. "As a result, there's an increased risk that marijuana products sold in Colorado may have contaminants or may inaccurately list potency." (S1, S2)

The Office of the State Auditor's report, numbered 2553P and titled Marijuana Consumer Safety, is the first formal accounting of a problem the industry has been arguing about for two years. It contains one figure that does more work than the rest of the document combined.

From January 1, 2023 through December 31, 2025, the auditors found, potentially harmful marijuana products were available to consumers for between a week and a little more than three years before the Marijuana Enforcement Division issued a Health and Safety Advisory. On average, affected product sat on the market for 223 days, just under 7.5 months. (S6)

Not 223 hours. 223 days, the span between a regulator knowing and a consumer being told. The figure improved to an average of 5.7 months across calendar 2025 after the division revised its advisory best-practice guidelines, which the auditors noted as real progress. They recommended it keep going. The division agreed with all of the audit's recommendations. (S2, S6)

The audit's five findings describe a framework with holes at every layer. Colorado has no fully functional reference laboratory, so it cannot independently verify what private labs report. The division's monitoring of testing standards is, in the auditors' words, limited and inconsistent. Safety advisories go out too slowly. The state-licensed testing laboratories themselves need better oversight from the Department of Public Health and Environment. And companies still choose which samples go out for testing. (S1, S2)

The reference-lab finding is the one with a price tag. Colorado does operate a lab through the Department of Public Health and Environment, but it cannot test for pesticides, residual solvents or mycotoxins, which is to say, it cannot test for the three categories of contaminant that have produced every Colorado recall worth reporting. Lab officials estimate they would need to almost double their resources, at a cost of just over $13 million, to take on an enhanced role. The audit's single legislative recommendation is to strengthen the lab's role, and the audit committee could vote to introduce a bill next session. (S2)

On inspections, the division concedes it lacks the resources to visit every licensed business every year; its own internal goal is once every two years. The auditors found it missing that goal for a large share of the industry. Among businesses active for the full three-year period, 93 cultivators, 38 percent, were inspected once or not at all. So were 97 manufacturers, or 52 percent. (S6)

The most useful moment in Monday's hearing was not in the report. Businesses in Colorado select their own samples and send them to private labs of their choosing, the structural flaw this publication has written about twice this year. Twenty-four other states with legal markets do not permit self-selected samples and use a third party instead. State Senator Rod Pelton, a Republican from Cheyenne Wells, asked whether that was going to be addressed. (S2)

“Because if I'm a shady character, I know which products I'm going to sample and which ones I'm not.”

— State Sen. Rod Pelton (R-Cheyenne Wells), Colorado Legislative Audit Committee

Kyle Lambert, the division's deputy director, answered that the agency had researched the question extensively and decided against changing the rule this year. His reasons were logistical: the cost and difficulty of getting collectors out to rural businesses across a large state, and the fact that a third-party collector does not guarantee a sample is representative of an entire batch either. (S2)

Both things are true. Sending state-paid collectors to a grow three hours from Denver is genuinely expensive, and a stranger pulling jars at random is not a guarantee of anything. The difficulty is that the alternative on the table is the status quo, in which the party with the strongest financial interest in a passing result picks both the sample and the grader. Colorado regulators floated independent collection in February and backed away after major manufacturers said it would cost too much. The audit has now documented what the status quo produces.

The incentive underneath it is not complicated. A laboratory that fails batches loses the client who chose it, so the strictest labs operate under the heaviest commercial pressure and the most accommodating ones grow. Colorado has heard that complaint from industry watchdogs for years, the specific allegation being that commercial labs have financial reason to inflate THC potency and to clear product carrying pesticides or mold. The auditors did not adjudicate those claims. They documented the structure that makes them plausible. (S1)

The enforcement workload is rising inside that framework, not falling. The division's analysis and resolution team closed 136 enforcement cases carrying 1,209 violations between calendar 2023 and 2025, and the number of violations recorded per year climbed 35 percent over the period, from 311 in 2023 to 420 in 2025. More violations are being found. The question the audit raises is how quickly anyone outside the division hears about the ones that matter. (S6)

The audit landed in the middle of the episode that proves it. In September, the Pueblo County manufacturer StayCon, which trades as Craft, voluntarily recalled 49 vape products after Bona Fides Laboratory in Denver found methylene chloride, a paint-stripping solvent, during a routine screen for something else. Some of the cartridges had been on shelves more than 18 months. The recall has since expanded. (S3)

As of October 9, the Colorado Department of Public Health and Environment had logged 38 reports of adverse health effects connected to StayCon products. The lab found the solvent in mid-August. It took the Marijuana Enforcement Division more than six weeks to issue its own advisory, which is faster than seven months and still long enough for a cartridge to be bought and finished several times over. (S1, S4)

There is early evidence the machine is moving faster since the audit landed. In the week after the hearing, the state issued two more advisories in four days, together reaching 69 dispensaries: an October 23 recall of vaporizer devices from Colorado Medical Processing LLC, doing business as Colorado's Best Dabs, sold at more than 30 stores between August 2 and October 17, and an October 27 recall of cannabis from Nutritional Elements LLC, doing business as The Health Center, after tests found total yeast and mold, Aspergillus and the pesticide pyriproxyfen above limits. Those gaps, days to weeks between the end of the sale window and the public warning, are what the auditors said the system should produce. The 223-day baseline is what it produced before people were watching. (S10, S11)

It is worth being precise about what the auditors did not say. They found no evidence of widespread health and safety problems in regulated Colorado marijuana. That is a real finding and the division is entitled to it. Dominique Mendiola, the division's senior director, leaned on it in her response: "We recognize there are clear opportunities to improve through the audit's recommendations, and we also appreciate the state auditor's acknowledgment that it found no evidence to support claims of widespread health and safety issues with regulated marijuana products." She called the recommendations a constructive roadmap. (S2)

The fair reading of the audit is narrower and more uncomfortable than either side's summary. Nobody has demonstrated that Colorado cannabis is broadly dangerous. What the auditors demonstrated is that the state would be slow to find out if it were, and slow to say so once it knew. Those are different claims, and only the second one is in evidence.

The precedent sits in the same report. A manufacturer of cannabis products marketed as sleep aids began receiving complaints of adverse effects as early as 2020. The state health advisory came in 2023. Colorado later fined the maker and banned the product after a connection to liver damage. Three years, start to finish.

None of this is unique to Colorado, which is both a defense and an indictment. Recalls in state cannabis markets generally arrive well after the product has reached shelves and been consumed, because almost every state built its testing regime the same way: private labs, hired by the licensee, screening samples the licensee selected. California spent two years revoking laboratory licenses and still did not catch a licensed farm running consumer-grade foggers in its hoophouses until a worker died. Colorado's distinction is simply that its auditor went and measured the lag.

1. Next legislative session, whether the audit committee introduces a bill to fund and expand the state reference lab, the audit's one legislative recommendation.
2. The $13 million appropriation question, which determines whether Colorado can ever independently verify a private lab's result.
3. Whether the division revisits self-selected sampling after declining to this year, now that a senator and a state auditor have both put the objection on the record.
4. The StayCon adverse-event count, at 38 as of October 9 and rising, and whether the expanded recall reaches further lots.
5. Advisory timelines going forward. The division agreed to streamline; the 2023-2025 baseline is seven months.

Colorado voters approved recreational marijuana in 2012 and the first stores opened on January 1, 2014. The promise attached to that vote, the one that distinguished a dispensary from a dealer, was that somebody was checking. Fourteen years later the state's own auditor has reported that the checking is done by labs the sellers hire, on samples the sellers choose, verified by a state lab that cannot run the relevant tests, and announced to the public, on the 2023-to-2025 average, seven months after anyone knew.

The division agreed with all of it. That is the part worth holding onto: this is not a contested finding. It is a shared one.

Keep Reading

Supply Chain

Voters Fired the Judges in Texas's Hemp Case. The Dec. 8 Hearing Went With Them

Two days after Democrats swept the 15th Court of Appeals, its clerk cancelled the THCA argument and handed the case to three justices who take office in January. Lt. Gov.-elect Vikki Goodwin says DSHS lacked the authority to write the rules at all.

By Cannabis Inc, Editorial Staff·7 min read

Supply Chain

After 900 DEA Registrations, a Nov. 29 Deadline to Cut Off Unregistered Cannabis Suppliers

A four-page DEA notice says registrants and timely applicants who keep buying from businesses that missed the June 26 window risk denial or revocation. The agency's own list counts 6,983 timely entries, 2,442 of them in Oklahoma.

By Cannabis Inc, Editorial Staff·8 min read