A tale of missed details: How easy is it for compliance to fall through the cracks even in a regulated system?
On October 25, Matt Ochenkoski, the manager on duty at The Flower Shop in Ahwatukee, offered to change the batch number on a bag of weed.
Why? My receipts from two trips three weeks apart showed the same strain–Zeclair Candy–same SKU, and same batch number (250909-004). The label from the first trip on October 3 read 21.14% THC. The second from October 6 read 17.13%.
On October 6, general manager Travis Frazier claimed two pounds of product with that batch number were destroyed because of an invalid Certificate of Authentication (COA). Three weeks later, Ochenkoski told me the same over the phone–that the store had destroyed the batch. By the end of October 25, however, Frazier put a contradicting statement in writing: "The batch was not destroyed."
The issue started with a single gram I bought for review, from a batch carrying two separate lab reports before reaching shelves.
After I bought the first gram, I scanned the QR code on the label. It sent me to The Flower Shop's portal, which hosted no publicly available COAs for the batch. I tried calling the shop directly, but they were initially unable to produce a COA for the correct batch, and then when they did eventually find one, it did not actually have all of the tests required to be cleared for sale.
The flower passed its safety tests in June. The trouble is in the paperwork. The lab report The Flower Shop provided and the THC percentage printed on my first bag both derived from a second test that SC Labs says "should not count as a compliance test." That label overstated the true THC potency by four percentage points.
The lab's duplicate check missed the second sample due to a single-digit typo in the producer's paperwork.
Who's Who
There’s a lot of moving parts through this, so before I go into details here’s a rundown of all of the parties involved:
Cannabish LLC: The licensed producer behind Zeclair Candy. Its license is on the bag and on both lab reports.
Jason Horn: His brand, Smackers, under his SirHIGH name, is on the bag.
The Flower Shop: The Ahwatukee dispensary that sold me both bags. Travis Frazier is the general manager. Matt Ochenkoski is a manager on duty.
SC Labs: The lab that tested both samples. Kareem Kassem is its quality and regulatory director.
Flow Distribution: Arizona distributor for several brands including Glorious Extracts and 22red, two additional brands where the same COA problem turned up.
Chasing the Paperwork
Smackers is Jason Horn's line, and the label on the bag reads "SMACKERS X CANNABISH". The vendor license printed on it, 00000126ESDQ50929013, matches the license SC Labs lists for Cannabish LLC on both reports.
I started with trying to reach out to Horn. I messaged him on Instagram to see if he had a copy of the batch’s COA on hand since The Flower Shop portal did not have it. He suggested I call the store, who put me on hold repeatedly. In the meantime, I sent him the COA from The Flower Shop’s portal, which he confirmed was incorrect. I also sent the COA from SC Labs’ portal, which he confirmed was the right one. Except, it only had THC and terpenes results. Nothing for Microbial Contaminants, Heavy Metals, Pesticides or Potency.
By the end of that first round of exchanges, the store’s portal only listed a legacy COA for a different batch of the same strain, and the manager was only able to produce a COA listing potency and terpenes alongside NT (not tested) on every safety metric.
Arizona's adult-use rules (R9-18-311) bar a licensed business from selling or transferring a batch until a licensed lab tests it and the results come back compliant. The rule points to Table 3.1. For flower, that means microbial contaminants like E. coli, Salmonella and four species of Aspergillus, plus heavy metals, pesticides and potency. The table adds mycotoxin testing for marijuana products such as concentrates.
Under Arizona regulations (R9-18-309), adult-use retailers must make test results available upon request, while medical patients receive them immediately per A.R.S. 36-2803.
One Batch, Two Reports
During my October 6 visit back to The Flower Shop in Ahwatukee, general manager Frazier told me the store destroyed two pounds of the batch after full testing went unfinished.
That night, I searched SC Labs' public portal and found batch 250909-004 listed twice, under two distinct sample IDs:
Zeclair Candy Batch 250909-004 | Full panel | Second sample(THC & Terpenes ONLY) | Label on my Oct 3 bag |
Sample ID | 260528M032 | 260616R002 | n/a |
Logged at lab | 05/28/2026 | 06/16/2026 | n/a |
Report issued | 06/30/2026 | 06/25/2026 | printed 10/03/2026 |
Pesticides | PASS | NT | n/a |
Heavy metals | PASS | NT | n/a |
Microbiology | PASS | NT | n/a |
Overall batch result | PASS | none listed | n/a |
THCa | 18.44% | 23.13% | n/a |
Total THC | 17.13% | 21.14% | 21.14% |
Total cannabinoids | 20.18% | 25.15% | 25.15% |
The product label matches the second report to the hundredth of a percent. That second report, lacking safety results, measured 4.01 percentage points higher in THC than the full compliance panel. THC numbers drive sales and pricing, though cannabis educators emphasize terpenes and the entourage effect for consumer evaluation.
When asked which report governs product labeling in a scenario like this, SC Labs Quality and Regulatory Director Kareem Kassem stated: "The potency on the label should come from the batch's compliance potency test, whichever licensed lab performed it. A later potency-only test is informational and doesn't replace it."
Once I sent him the full panel, Kassem answered for this batch: "260528M032-002 is the compliance report for batch 250909-004 and covers the full required testing panel. The potency values on the retail label should come from this report." Under state rules, the October 3 label required revision.
Cannabish's Side
When I discovered more issues with the COAs, I also reached out to Cannabish. On October 6, I explained what had happened with The Flower Shop’s portal, that I was told the batch was destroyed by the store because of the incorrect COA, but that I found the correct COA in SC Labs’ portal. According to Cannabish, the reason for the second COA was because they “had to retest the strains because there [sic] (SC Labs) reading was not right.” They continued explaining that SC Labs “retested the same batch , that [sic] was there. Just different days.”
But that’s how retesting and amending reports works in Arizona. The only way a product can be retested and cleared for sale with that retest is through a completely different laboratory, and the only way a report can be amended by the same laboratory is with Arizona Department of Health Services approval.
SC Labs described how it handles that complaint from a client: It reviews the sample's handling and preparation, instrument calibration, quality control data and calculations, and it reanalyzes only when that review turns up a valid scientific reason. "If we find an error, we amend the report," Kassem wrote. "If we don't, the original result stands." Fixing an error means amending the original report. A new sample gets its own separate report and doesn’t replace the original.
In our conversation, Cannabish also claimed that “the only way for them (dispensaries) to accept the product" is alongside an authentic, verifiable COA, while also suggesting the store should have searched the public portal. If delivery is mandatory prior to acceptance, public portal availability is secondary.
SC Labs' process points the same direction: "To protect client confidentiality, we send COAs only to the client who submitted the sample. Clients can add other recipients, such as their retailers, through our online portal." A report reaches the public side of that portal only when the client chooses.
On October 13, I sent Horn, Cannabish, and Frazier the same follow-up asking about any updates and for confirmation that the batch was, in fact, destroyed.
Cannabish replied saying “nothing was ever destroyed. It was a retest” and that the dispensary should be selling the product, because the correct COA was found. I pressed about whether or not they delivered the correct paperwork, and they left me on read.
Horn agreed that the situation was alarming.
For any SirHIGH SMACKERS fans, Horn also offered a unique opportunity to continue this discussion with him to better understand how he and his brand are investigating how this mistake happened and how to prevent it from reoccuring.
Frazier responded via email on October 14, letting me know that they received the full COA and he will send it over to me. I asked for clarification about the alleged destroyed batch, but he never responded. I didn’t receive the COA until October 25 after multiple follow ups.
Back on the Shelf
By October 25, Zeclair Candy reappeared on The Flower Shop's online menu. During a phone call that morning, on-duty manager Ochenkoski claimed that he previously had a two pound bag in the back, and the Zelclair Candy they currently have was “from the first generation…that we received from Cannabish.” He continued: “So the one that had the lack of COAs, or insufficient COAs, I know for a fact that that was destroyed.”
He added that the Zeclair currently on shelves was "the only one that has current and updated and full panels."
At the time, the dispensary's compliance page listed nothing for batch 250909-004, still showing only batch 250923-007 which matched the description of a legacy batch with a listed harvest date of 10/20/2025.
I bought a deli gram that afternoon. At the counter, Ochenkoski repeated that the package came from the original (first generation) batch, which had been “with us (The Flower Shop) for quite some time now.”
In my car, I compared the new package with my October 3 package:
October 3 bag | October 25 bag | |
Purchased | 10/03/2026 10:45 AM | 10/25/2026 1:27 PM |
SKU | 50399637 | 50399637 |
Batch | 250909-004 | 250909-004 |
MFG date | 07/09/2026 | 07/09/2026 |
Harvest date | 04/06/2026 | 04/04/2026 |
Label THC | 21.14% | 17.13% |
Label total cannabinoids | 25.15% | 20.18% |
Numbers match | Second sample, 260616R002 | Full panel, |
Same SKU, same batch number, same manufacture date.
The potency figures differed: the October 3 label reflected the secondary test, and the October 25 label reflected the full panel. The harvest dates conflicted, too (April 6 vs. April 4), despite both bags carrying batch 250909-004. I went back into the store before leaving the property.
Upon further inquiry, Ochenkoski consulted Frazier over the phone. "He said that it would have been destroyed had we not gotten the new COAs, but we got new COAs", adding a claim that website COAs had been updated.
I pointed out the discrepancy about his earlier statement that I was buying older inventory and Ochenkoski cited inventory volume stating "I have 46 strains on that wall, brother, it’s hard to keep track of” noting that the store had just passed their state walkthrough.
My on-site search of the store's testing portal for batch 250909-004 in front of him returned zero results, showing only batch 250923-007. Ochenkoski then offered to alter the label on the bag with the reasoning that: "The testing results I have should be 007. This is just a misprint if you will."
When I asked for an investigation instead of a changed batch number without confirmation it was actually that batch, Ochenkoski said to take it to "whatever powers that be."
Just minutes after offering to relabel my bag as 250923-007 to match the store’s portal, Ochenkoski emailed me SC Labs’ report for 250909-004, a file The Flower Shop didn’t host. His own emailed link pointed to the batch the store said it destroyed.
I then pressed him on the earlier destruction claims. Ochenkoski attributed miscommunications to shift rotations "It's all a game of telephone" and denied stating the batch had been destroyed, despite recorded statements proving otherwise.
I asked for the batch he'd told me I was buying, the one that “had been with them for quite some time”. He said he doesn't write batch numbers down. "I have them in my system so I can check out which batch is available." The older batch, he said, was "probably in the back." I said I'd be happy to wait if it meant getting the bag he told me I was buying. "Wait here all day," he said and returned to his back office. I never got confirmation if batch 250923-007 still exists in their back room or if it was long gone throughout this whole process.
"In Quarantine"
Frazier emailed me shortly after that interaction. He explained that the Zeclair Candy batch from October 3 was quarantined while corporate and the vendor worked to resolve the paperwork issue. He then stated that the batch was not destroyed, citing “batches only get destroyed if non-compliant or contaminated.”
He then claimed that the testing results were online and that I could access them through SC Labs and through The Flower Shop’s Testing & Results section of their website.
But by the morning of October 26, the portal still lacked data for batch 250909-004. After I sent Frazier screenshots, a PDF of the full panel appeared on the store's site by day's end.
In a phone call later that afternoon, Frazier criticized Cannabish: "That brand is either miscommunicating or they're misinformed." Near the end of the call, he said he "cannot understand why Cannabish would lie to you” [about the COA being disputed as incorrect] and promised to address the matter with his vendor.
On the destroyed batch, he said:
"I will tell you right outright, I never said that we destroyed that batch. I said it would be if it got out of quarantine and did not have a correct COA."
Explaining dispensary protocol, Frazier noted: "If we have a COA or compliance issue, we do not immediately destroy product. We reach out to the vendor, they reach out to the brand," with corporate handling it from there. Addressing the initial report sent over, he added: "It had THC and terpenoids. It just did not have the microbiology."
Except, the microbiology panels are what is required to pass for proper compliance.
So, I put it to him this way: "Your compliance manager received a COA that only had THC and terpenes, had no compliance panels, and you guys at multiple stores didn't see a problem with that and put it up for sale. The only reason it was caught is because I got involved in this."
Frazier answered: "No, that could not be further from the truth." I asked whether that response meant that Cannabish delivered both reports and the wrong one was just attributed to the product, he gave no delivery dates or records: "I would feel comfortable if you just took this complaint to the state and we could have an audit."
Frazier also said he had "no idea until this entire conversation" that I was a reporter. I'd introduced myself as one on October 6, and my October 13 and 20 emails to him asked for comment for the article. After running through the timeline from my perspective, Frazier said that he cannot continue the conversation.
That evening I emailed formal questions about compliance protocols to an email group at The Flower Shop I was told contained district managers, compliance managers, and corporate contacts. I followed up on October 28 and October 30. Nobody at The Flower Shop answered.
I also asked Cannabish on October 26 and 27 about its claim that the first reading was wrong. They continued to read the messages and not reply.
The Lab's Answers
SC Labs answered every question I sent. On October 30, I sent Kassem the full-panel PDF from The Flower Shop’s site and asked about Zeclair itself. He confirmed the PDF is “an authentic, unaltered SC Labs report” and that revision 002 is the current version.
On the presence of two reports: Kaseem said Cannabish submitted a new sample on June 16, “not on leftover material from the 5-28 sample,” and it arrived in different packaging. “It should not count as a compliance test,” he wrote. “We consider it R&D [sic] only.” SC Labs is relabeling the report in its portal.
Potency-only testing has a normal use. Speaking generally, Kassem said, “Clients often order potency and terpene testing alone while developing a product, to confirm levels are on target before submitting the finished product for full compliance testing.” A report like that “can’t clear a batch for sale.” Zeclair’s potency-only sample arrived June 16, two weeks after the batch had already passed its safety tests.
SC Labs’ tracking software–its Laboratory Information Management System (LIMS)–flags a new sample when its batch number matches one already on file. Cannabish’s paperwork for the May 28 sample read 25909-004, one digit short, so the June 16 sample under the correct number had nothing to match. “This error got through our system because of the batch number typo,” Kassem wrote. “The typo was on the client’s paperwork; SC Labs did not introduce it.” That check carries a lot of weight: “Without a statewide track-and-trace system, our LIMS check is the main safeguard against duplicate submissions, and it depends on correct batch numbers when samples are logged.”
SC Labs corrected the May 28 record on June 30. The amendment note on the report says the change was made “per client request,” and Kassem said that’s when the duplicate became visible in the lab’s system. Revision 002 replaced the original before the July 9 manufacture date on both of my bags. “No samples were re-analyzed, and none of the individual cannabinoid results changed.” The 17.13% stood.
None of this follows Arizona’s path for a second sample. Under R9-18-311, a business can submit a second sample after it gets notice that its original report may be inaccurate, and a different independent lab has to test it. In Kassem’s words, the rules “allow a second sample of the same batch only in one situation.” Even then, a new sample “produces a separate report for that sample and doesn’t change the original, which stands unless the lab amends it.”
On the gap itself, Kassem spoke in general terms: “In general, two potency tests on samples from the same batch should agree within normal method variability. A large difference usually means the samples themselves were different.” And nobody outside the producer picks those samples: “Arizona doesn’t require independent third-party sampling, so a lab can’t verify that the sample represents the batch, or that product on a shelf is the batch named on the report.”
The same pattern shows up for five other Cannabish strains on SC Labs’ portal. Lemon Gas, Halo OG, LA Kush Cake, Hash Burger and Purple Cake each have a May 28 entry and a June 16 entry, with every June 16 entry tagged “Compliance.”
Cannabish isn't having all the fun
At Sol Flower's Scottsdale Airpark location, my purchase of Glorious Extracts Citrus Breath Cured Budder (batch TOL260210-001) ran into similar paperwork gaps.
Under A.R.S. 36-2854.01, concentrate packaging must feature QR codes linking to safety COAs. Scanning the jar's code led to an unpopulated portal page, while a partial batch search returned an unrelated COA from 2022. No searches yielded the proper COA results.
At the store, a budtender asked me, "What's a COA? Sorry I just started working here a couple weeks ago." Getting the paperwork took a call to the district manager, because the staff on site couldn't open the digital folder holding the store's own copy due to internal permissions.
After I contacted Flow Distribution, they updated their portal, citing a new Database manager being recently hired, but didn't answer any additional questions.
A friend also sent me photos of two 22red concentrate jars (batches TOL260901-001 and TOL260901-002) from a confirmed purchase at a Curaleaf in Phoenix. 22red also routes through Flow Distribution's portal. I searched the portal for the batch number, and none of the 54 results matched.
The COAs appeared after Flow Distribution fixed their portal following my email.
Glorious and 22red share a distributor and a portal. In both cases, the batch number on the package didn't lead to a COA.
Three brands. Three dispensaries. Not one batch number that led to the right COA at the time of purchase.
For Zeclair Candy, the proper paperwork existed. It didn’t reach The Flower Shop’s portal until October 26, more than three weeks after I bought my first gram, and only after I kept asking.
It’s a tough spot for the people at the store level. At Sol Flower, staff couldn’t open the folder holding their own store’s COA, and it took a district manager to pull it. Even Frazier called the whole matter “out of my hands and pushed to corporate.” Over my last several dispensary visits, multiple budtenders told me they aren’t paid enough to care, requirement or not. They also told me so few shoppers know what a COA is, let alone ask for one at the counter, that it rarely comes up.
Still, the dispensary is the licensed point of sale. Arizona puts the duty to produce test results on the business that sells the product. The Flower Shop’s own product sheet names it as the business that prepared this flower for sale. That makes it the party responsible when the paperwork isn’t there, and for the two different harvest dates printed on its labels.
That doesn’t clear Cannabish. They submitted both samples from batch 250909-004, two separate samples for two separate tests. They told me SC Labs’ reading was wrong. SC Labs didn’t change that result, and says the report Cannabish called wrong is the compliance report for this batch. Cannabish’s own typo on the first sample’s paperwork is what allowed this scenario to happen.
Glorious and 22red sit in a different spot. Both route their COAs through Flow Distribution, a third party, and Flow’s portal is where those COAs went missing. The fix came from Flow, after my email to them.
In the end, a customer buying one gram to review found the full panel before the store selling that gram did. Instead of taking accountability, fingers were pointed. When challenged for transparency, brick walls ended conversations.
It’s clear the industry needs a significant amount of fixing. But it won’t come from “the powers that be” until brands and companies can’t push back against consumers who know better.
How to check a COA yourself:
Ask for it. The store has to show you the lab report if you ask. Even if the package has a QR code to it.
Match the batch number. The number on your package should match the report exactly.
Check the safety tests. Pesticides, heavy metals and microbials should say “Pass.” “NT” means not tested, and a report like that can’t clear the product for sale. Note: Required panels vary by product type.
Check the THC. Your label has to be within 20% of the report’s number. Quick check: multiply the report’s THC by 1.2. If your label is higher than that, it’s over the limit.
Check the harvest date. If the report lists one, it should match your label, and it should be relatively recent.
Make sure it’s real. Scan the QR code on the report, or contact the lab listed on it directly.
Something doesn’t match? File a complaint with the Arizona Department of Health Services (ADHS).
Comments