The certificate nobody re-checked.

In late winter, New York’s Office of Cannabis Management recalled 55 lots of cannabis products: flower, edibles, prerolls, beverages. The recall reached nearly two dozen companies, including brands like MFNY, Nanticoke Hemp, and Veterans Holdings.

Here’s the strange part. None of those companies had failed a safety test. Every one of them held a certificate of analysis saying their product passed.

The certificates were the problem. State investigators, working through inspections and a records audit between December 2025 and January 2026, found that Keystone State Testing New York, a state-licensed lab in Vestal, had issued unreliable results. Regulators identified 54 lots reported as passing for Aspergillus, a mold that can cause lung infection, when they didn’t meet the state’s safety standards. One more lot carried an incorrectly reported heavy-metals result.

“When test results are inaccurate or unclear, product safety and in turn, the safety of New York State consumers cannot be guaranteed,” said Stephen Geskey, the agency’s executive deputy director of licensing, compliance and laboratories. “It is not a risk OCM is willing to take.”

Walk through what each of those two dozen companies did. They sent product to a licensed lab, the responsible move, the one the rules require. They paid for the test. The test ran. A pass came back.

And the pass is exactly where their attention ended. That’s what a pass is for. It means the question has been asked and answered, so nobody asks it again. No grower re-tests a lot that just passed; no dispensary re-checks a certificate from a licensed lab. The document that was supposed to close the safety question is the same document that guaranteed nobody would reopen it.

So when the answering layer itself went bad, the failure landed on every company that had relied on that lab, at once, retroactively, across months of production. Two dozen operators believed they each had their own safety verification. They had one, shared, and they found out the day it was withdrawn.

The same shape surfaced this year in a different trade. Reporters in Baton Rouge found that three federally funded home renovations on Central Road had failed inspection in October 2022; the houses lacked running water, electricity, and heat. One day later, a second code enforcement officer approved all three. Officials who went back found 11 deficiencies serious enough to bar a permit, and, on the officer’s phone, evidence of a Cash App payment from a permit applicant on another property. A lab can be sloppy. An inspector can be bought. Either way, the pass is worth exactly what the person issuing it is worth.

Your shop runs on passes like this. The certificate of insurance your sub handed you at the start of the season. The calibration sticker on the scale. The inspection tag on the fire-suppression hood. The engineer’s stamp on the truss drawings. The clean report from the reviewer you’ve used for eleven years. Each one arrived as a document, and the document ended your attention, because that’s the job documents like that do.

You can’t re-run every test yourself. That’s why verifiers exist, and most of them are honest. The useful question is narrower: which of your passes, if wrong, fail everywhere at once? A wrong invoice costs you once and teaches you something. A wrong verifier costs you on every job it ever signed, on the same day, and the bill includes work you finished two years ago.

The countermeasures are cheap and unglamorous. Send a duplicate sample to a second lab once a year and compare. Call the insurance carrier to confirm the certificate instead of filing it. Stand there and watch one inspection actually happen. That re-checks something, occasionally, which is enough to tell you whether the verifier deserves the trust the paperwork assumes.

Worth noticing, too, who pays when a verifier fails. The New York recall was precautionary; the state reported no health incidents. The recall notice still named the brands. The companies that did everything right absorbed the headline, and when a shared verifier goes down, the reputational bill is delivered to the verified.

So the question this structure asks: which certificates, audits, inspections, or sign-offs do you accept as settled truth without ever re-checking, and what fails all at once if the verifier was wrong?

← More observations