Fabulous thread. Good to see folks coming to grips with the details of the production problem and you are lucky to have someone like Kron3007 chiming in loudly and clearly; that person has obvious lab experience and knows how to decode the pharmacopeias. For what it is worth, I will give the perspective of one who has dealt with HC, EMEA and USFDA regulators during human clinical trials. This might be overkill and not applicable, of course. Take it with a dose of USP grade NaCl.
From a pharma perspective, the MMPR regs are laden with booby traps for rookies. One of the main ones I have read you folks discussing is the QA role. If HC is headed the direction they usually are, QA will need to know the following about growing cannabis:
1. diddly
2. squat
QA, especially in small operations, should be way too busy to spend time tending plants. Their main role will be running the systems such that quality is assured, hence the name of the role. Most of the QA management folks I have dealt with are ex-lab rats who have transitioned to QA duties. They need to have the science background to be able to know acceptable lab data from the poor stuff. The problem for small operations is that can be an awful lot of science for one person to know; they usually run a team of specialists who cover microbiology, chemistry and engineering controls. The ones I have worked with have been microbiologists or (bio)chemists. Don't tend to see a lot of zoologists or molecular biologists. Could be my sample pool is too small.
Using a contract lab is the norm for small operations but it has its drawbacks. Just because you are contracting the service does not absolve you of responsibility for the data they generate. From HC's perspective, if the contract lab makes a mistake, you have made a mistake. So, QA usually is expected to have visited the lab and audited the procedures relevant to the test you are paying for. Have the technical training to be vigilant. Another advantage of an in-house lab is speed. Contract lab's are always too slow...ALWAYS! It isn't really their fault, that just tends to be the way it goes when samples need to be couriered and you have no control over the amount of samples headed to them from other customers, nor any control over their vacation schedule, etc. I think it is very generous of Kron3007 to be planning to offer up their lab as a contract service, but they could readily find themselves having to do triage between their samples and the contract work. I've seen it before.
QA managers also usually have at least one person helping out with document control duties; it is an enormous amount of typing...and re-typing...and re-re-typing. And that is before you get audited and all those SOP turn out to have been less standard than you thought.
QA folks also need to know enough stats to hack their way through documents like these, which is what Kron3007 put me in mind of when sampling size was mentioned:
http://www.barringer1.com/mil_files/MIL-STD-414.pdf
http://www.halthass.co.nz/wp-content/uploads/standards/mil_std_105e.pdf
Note that the current regs do not require you to set any sort of expiration date. I would suggest you start capturing the stability data to set one because I suspect that when you get your first audit after a year or so, they will tell you that you have been in business long enough and need to start setting expiration dates. I've read little in the way of serious discussion of niggling details like child-proof packaging that locks in the aroma and labelling.