RN Collins has written a series of 20 new articles for cannabis law report on 2026 Psychedelics & Legal Issues.

This is the 11th in a series of 20

Risk-Based Auditing for New Drug Regulatory Bodies

Cannabis Law Report Audit-Style Reports Series — Report 5

Abstract

Risk-based auditing is the dominant methodology in mature pharmaceutical and drug regulatory programs worldwide: it allocates limited inspection and audit resources to the highest-risk actors, activities, and compliance domains rather than distributing them uniformly across all regulated parties. State-licensed psychedelic programs, which are small relative to cannabis markets but operate in a novel, politically contested, and client-safety-sensitive domain, require audit frameworks proportionate to their size but rigorous in their methodology. This report examines the principles of risk-based auditing as applied in established drug regulatory contexts — including the FDA’s risk-based inspection approach, Health Canada’s cannabis inspection program, and the U.S. Government Accountability Office’s 2024 Yellow Book — and develops a tailored risk-based audit framework for state psychedelic regulatory agencies. The framework identifies the primary risk factors applicable to psychedelic service programs, proposes risk-scoring methodologies for prioritizing inspection activity, and recommends minimum audit program standards for programs at different stages of development.

I. Introduction: Why Risk-Based Auditing Is Necessary for Psychedelic Programs

New drug regulatory bodies face a fundamental audit resource challenge: their populations of regulated parties are small enough to make universal inspection conceivable in theory but are too diverse in risk profile to make undifferentiated universal inspection a productive use of limited staff capacity. A state psilocybin program with approximately 24 operational service centers,²² 367 licensed facilitators,¹⁵ 12 active manufacturers, 1 testing laboratory, and 18 training programs contains regulatory subjects whose risk profiles differ dramatically — from a small solo facilitator conducting occasional group sessions to a multi-facilitator service center with high client volume, complex dosing protocols, and multiple supply chain relationships.

Risk-based auditing — the allocation of inspection and audit resources based on an assessment of the probability and magnitude of potential harms — is the systematic response to this challenge. Rather than inspecting every licensee with equal frequency, or inspecting only in response to complaints, risk-based programs construct risk profiles for individual licensees and direct inspection resources toward the highest-risk subjects.

The U.S. Government Accountability Office issued its 2024 revision of Government Auditing Standards (the “Yellow Book”) with a new emphasis on risk-based quality management. The revision transitions audit organizations from a system of quality control to a more proactive system of quality management, requiring organizations to establish quality objectives, identify and assess quality risks, and design and implement responsive policies.¹ The FDA similarly operates its drug facility inspection program on risk-based principles, directing inspection resources toward facilities manufacturing high-risk products, facilities with adverse compliance histories, and facilities that have not been previously inspected — treating prior compliance history as a key risk-scoring input.²

For state psychedelic regulatory agencies, these frameworks provide the methodological foundation for audit programs that are simultaneously more efficient (concentrating resources where risk is highest) and more effective (detecting violations that complaint-driven enforcement misses).

II. Risk-Based Auditing Principles in Drug Regulation

A. The FDA’s Risk-Based Inspection Approach

The FDA has articulated the factors it considers when prioritizing drug facility inspections on its public website.³ For pharmaceutical manufacturing facilities, risk factors include:

• Product risk factors: Inherent risks of the product, including dosage form, route of administration, whether the product is intended to be sterile, concentration of active pharmaceutical ingredients, and whether the product is designated for emergency use
• Facility risk factors: Whether the facility has been previously inspected; the outcomes of prior inspections and any adverse compliance history; whether the facility has been inspected by a foreign regulatory partner
• Operational risk factors: The volume of production, the number of different products manufactured, the complexity of manufacturing processes, and whether the facility has undergone significant process changes since the last inspection

The FDA offers an illustrative example: “a sterile drug manufacturing site that has not been previously inspected and is making narrow therapeutic index drugs would likely be deemed a higher risk than a site that had a well-known inspectional and compliance history that is making over-the-counter solid oral dosage form drugs.”⁴

This principle — that risk scores are the product of product risk, facility/operator risk, and compliance history — is directly applicable to psychedelic service programs, with appropriate adaptation to the supervised service center and individual facilitator context.

B. Health Canada’s Cannabis Risk-Based Inspection Program

Health Canada’s cannabis inspection program explicitly characterizes itself as “risk-based,” focusing “on activities that represented the highest risk to public health and public safety.”⁵ In fiscal year 2024–25, the program conducted 889 total inspection activities under the Cannabis Act, including regular inspections, targeted inspections, compliance verifications, registered personal and designated production inspections, and promotions inspections.⁶

Health Canada’s classification of inspection observations by severity provides a model for how risk-based audit programs categorize findings:

• Critical observations: Situations likely to result in a risk to public health or public safety, or involving fraud, including a clear risk of diversion — “the most serious deviation or deficiency”
• Major observations: Situations that may result in a risk to public health or public safety, or may involve fraud, including a potential risk of diversion
• Minor observations: Deviations that are neither critical nor major⁷

This tiered severity classification enables inspectors to prioritize follow-up activity based on the seriousness of findings — a critical observation requires immediate escalated response, while a minor observation may warrant a compliance letter and re-inspection on a standard schedule.

Health Canada also conducts proactive “compliance monitoring projects” focused on specific program areas that use inspections, compliance promotion, and sampling to gather risk intelligence before violations occur.⁸ The fiscal year 2024–25 report identified 26 targeted inspections of promotion activities — a specific compliance area Health Canada identified as carrying elevated risk — in addition to routine planned inspections.⁹

C. GAO Government Auditing Standards: Risk-Based Quality Management

The 2024 revision of the GAO’s Government Auditing Standards (Yellow Book), effective for performance audits beginning December 15, 2025, establishes that audit organizations must implement a system of quality management using a proactive, risk-based approach.¹⁰ The core requirement — that organizations (1) establish quality objectives, (2) identify and assess quality risks with a reasonable possibility of occurring and impacting those objectives, and (3) design and implement responsive policies and procedures — provides the foundational methodology for internal audit programs within government regulatory agencies.¹¹

The Yellow Book’s transition from “quality control” to “quality management” is significant for emerging drug regulatory agencies: it shifts the posture from detecting and correcting problems after they occur to proactively managing conditions that give rise to problems. Applied to psilocybin regulatory programs, this means building risk assessment frameworks that anticipate where compliance failures are likely to emerge — rather than relying on complaint-driven reactive enforcement.

D. Council of the Inspectors General on Integrity and Efficiency Financial Audit Manual

The CIGIE Financial Audit Manual (FAM), updated in coordination with GAO through June 2024 (Volume 2) and June/August 2025 (Volumes 1 and 3), provides detailed methodology for financial statement audits of government entities.¹² The FAM’s emphasis on audit risk — specifically, the risk that an auditor will fail to detect a material misstatement — translates to the psilocybin regulatory context as the risk that a compliance inspector will fail to detect a significant violation. Both types of risk are managed through risk assessment, appropriate resource allocation, documentation standards, and quality review.¹³

III. Risk Factors Specific to Psychedelic Service Programs

Applying the FDA and Health Canada frameworks to the distinctive characteristics of state-licensed psilocybin programs, the following risk factor categories are most salient:

A. Service Center / Healing Center Risk Factors

Client population complexity: Service centers serving clients with complex mental health histories, recent psychiatric hospitalizations, or active suicidal ideation represent elevated risk, given that Oregon’s exclusionary criteria are limited to lithium use in the last 30 days, active self-harm thoughts, and active psychosis — a relatively permissive client screening standard.¹⁴ Service centers that have not developed systematic pre-session screening protocols are at higher risk of adverse events.

Session volume and group session size: Higher-volume service centers conducting large group sessions present greater aggregate risk exposure. Oregon allows group sessions with up to 25 clients simultaneously,¹⁵ and Q1 2025 data show 197 group sessions with an average of 3.17 clients per group. High-volume operators with thin staffing or inconsistent facilitator assignments merit elevated inspection priority.

Adverse event history: Service centers with prior adverse event reports, including behavioral reactions, medical interventions, or post-session hospitalizations, should receive priority inspection. Health Canada’s inclusion of adverse compliance history as a risk-scoring input is directly applicable here.

Banking and financial profile: Service centers operating exclusively in cash — as many do,²³ due to the federal banking exclusion — face higher financial mismanagement risk and merit targeted financial compliance auditing to ensure that fee payments, product purchases, and internal financial controls meet basic standards.

Geographic isolation: Service centers in geographic areas with limited oversight capacity, including small towns or rural locations with limited proximity to OPS compliance staff, may warrant elevated inspection frequency to compensate for reduced incidental observation.

New licensee status: Facilities and facilitators in their first year of operation have higher compliance uncertainty, consistent with the FDA’s elevated risk designation for previously uninspected facilities. Initial license year inspections are a standard practice in mature drug regulatory programs.

B. Facilitator Risk Factors

Training program origin: As documented in Document 7 (Compliance Review of Oregon’s Psilocybin Licensing System), 5 of 30 approved training program curricula have been revoked and 7 voluntarily withdrawn — a 40% non-continuation rate that raises questions about curriculum quality variation.¹⁶ Facilitators trained at programs that subsequently had their curricula revoked or voluntarily withdrawn may lack adequate preparation for adverse event management and ethical compliance.

Practice scope and dual-role conflicts: Facilitators who are also licensed healthcare professionals — particularly in Colorado, which offers a “clinical facilitator” pathway requiring a current valid Colorado professional license — face elevated risk of scope-of-practice violations if they blur the line between psilocybin facilitation and medical practice.¹⁷

Solo vs. center-embedded practice: Facilitators operating at multiple service centers, or conducting sessions outside their primary service center, face more complex compliance requirements and merit elevated monitoring.²⁴

Complaint history: Any prior complaint, violation, or client concern documented in OPS or DORA compliance records is a primary risk-elevating factor.

C. Manufacturer / Cultivation Facility Risk Factors

Single testing laboratory dependency: Oregon’s reliance on one testing laboratory creates a systemic supply chain integrity risk that cannot be fully mitigated by individual manufacturer audits.¹⁸ Manufacturers’ compliance with testing submission requirements — particularly speciation testing of every harvest lot and monthly batch testing — requires priority auditing.

New product types: Oregon permits multiple product forms under OAR 333-333, including whole dried mushrooms, ground homogenized fungi, psilocybin extracts, and edible psilocybin products.¹⁹ Edible and extract products present more complex dosing and potency verification challenges than whole dried mushrooms and merit elevated product testing scrutiny.

Good production practices: Manufacturers must maintain food-grade facilities to minimize contamination risk. Facilities that have not received on-site inspection since licensing are high-risk given the absence of a proactive inspection program baseline.

D. Training Program Risk Factors

Financial conflict of interest: As Psychedelic Alpha’s analysis noted, training programs have a financial incentive to approve all students who complete the program, since training costs can reach $12,000 per student regardless of whether the student is competent.²⁰ Programs with high enrollment but inconsistent licensing examination pass rates, or programs that have not conducted their own ongoing assessments of graduate competence, merit targeted audit.

Curriculum completeness and accuracy: Training program curricula must meet OPS standards, but OPS oversight is limited to curriculum review and approval — it does not include ongoing audit of how curricula are actually delivered. Unannounced attendance at training sessions is the most direct audit mechanism for this risk category.

E. New Mexico: Distinct Risk Profile Under a Medical Model

New Mexico’s Medical Psilocybin Act presents a materially different audit risk profile from Oregon and Colorado. Because access is limited to patients with qualifying conditions under clinician supervision, the “facilitator” risk factors identified above apply instead to licensed healthcare professionals whose primary regulatory oversight comes from New Mexico’s medical and nursing licensing boards, not from a dedicated psilocybin oversight authority. The Department of Health’s audit function must therefore coordinate with professional licensing boards — a coordination challenge analogous to Colorado’s DORA/DOR bifurcation. Additionally, New Mexico’s natural-psilocybin-only requirement (excluding synthetic psilocybin) creates distinct product integrity audit questions, since all supply must be cultivated rather than synthesized. The Department of Health’s required annual assessment under SB 219 § 10 provides a built-in audit transparency mechanism not present in Oregon’s original enabling statute.²⁵

IV. Risk-Scoring Methodology for Psychedelic Regulatory Programs

A quantitative risk-scoring approach enables compliance staff to prioritize inspection resources systematically and document the rationale for inspection priorities — consistent with the Yellow Book’s emphasis on documented risk assessment.

The following illustrative scoring model is proposed for state psychedelic regulatory programs. Each factor is assigned a weight reflecting its relative contribution to audit risk. Scores are summed to produce an overall risk tier for each licensee.

Illustrative Risk Factor Scoring Matrix

Risk Factor	Weight	Low Risk (1)	Medium Risk (2)	High Risk (3)
Time since last inspection	20%	< 6 months	6–18 months	> 18 months or never inspected
Prior violation or adverse event history	25%	None	1 violation (resolved)	2+ violations or unresolved violation
Client volume (service centers)	10%	< 50 sessions/quarter	50–150 sessions/quarter	> 150 sessions/quarter
Training program of record (facilitators)	10%	Active program in good standing	Program voluntarily withdrawn	Program revoked
Product type complexity (manufacturers)	10%	Whole dried mushrooms only	Multiple product types	Extracts or edibles
Banking/financial profile	10%	Electronic payments available	Partial cash operations	Fully cash-based
Complaint history	15%	No complaints	1 complaint (resolved)	2+ complaints or open complaint

Tier 1 (High Priority): Score ≥ 2.4 — Inspect within 90 days; unannounced inspection; comprehensive multi-domain inspection checklist

Tier 2 (Medium Priority): Score 1.6–2.3 — Inspect within 180 days; announced inspection; standard inspection checklist

Tier 3 (Low Priority): Score < 1.6 — Inspect within 365 days; documentary review; abbreviated checklist; unannounced option available

This model is illustrative and should be calibrated to actual program data once a sufficient inspection history exists. Risk factors and weights should be reviewed annually by the regulatory agency and adjusted based on observed compliance patterns.

V. Minimum Audit Program Standards by Program Stage

Stage 1: Program Launch (Years 1–2)

Programs in their first two years of operation — which describes both Oregon OPS (launch June 2023) and Colorado NMD (launch June 2025) — lack the compliance baseline data needed to risk-score individual licensees. The primary audit objective at this stage is establishing a compliance baseline.

Minimum standards for Stage 1:

• 100% initial inspections within 12 months of first license issuance, for service centers and healing centers. This is consistent with FDA practice of treating first-time-inspected facilities as elevated risk.
• Initial financial compliance review for all licensed businesses, verifying fee payment, product transaction documentation, and financial record maintenance.
• Training program site visit for all active training programs within 18 months of curriculum approval.
• Post-adverse-event investigation protocol: Any emergency service report triggers mandatory on-site inspection within 30 days.

Stage 2: Established Operations (Years 2–5)

Programs with two or more years of operating data — which describes Oregon OPS — can implement risk-tiered inspection based on compliance history.

Minimum standards for Stage 2:

• Annual risk-scoring update for all licensees based on prior year compliance data, complaint history, and adverse event reports.
• Unannounced inspection rate: Minimum 30% of all inspections should be unannounced, consistent with best practices in pharmaceutical manufacturing oversight.
• Testing laboratory audit: Given the critical single-point-of-failure risk in Oregon’s single-laboratory model, the testing laboratory should receive two inspections per year, including one unannounced, with product sampling for independent verification of potency and contaminant testing.
• Complaint investigation standard: All formal complaints investigated within 30 days; Tier 1 (high-priority) complaints investigated within 15 days.

Stage 3: Mature Program (Years 5+)

Mature programs with rich compliance history data can implement sophisticated risk-predictive models and reduce inspection frequency for consistently low-risk licensees.

Minimum standards for Stage 3:

• Formal compliance risk model updated semi-annually, with published methodology.
• Compliance monitoring projects targeting specific high-risk domains — analogous to Health Canada’s targeted promotions inspections — conducted each year, addressing at least one emerging compliance concern identified from adverse event data, complaint trends, or legislative or regulatory changes.
• Performance audit cycle: A formal performance audit of the regulatory program itself, conducted by the state auditor’s office or an independent reviewer, at least every three years.

VI. Domain-Specific Audit Protocols

A. Client Safety and Informed Consent Audit Protocol

Psilocybin sessions involve a period of several hours during which clients consume a Schedule I substance under the supervision of a facilitator. Client safety during this period depends on: adequate pre-session screening; informed consent documentation; facilitator competence in recognizing and responding to adverse reactions; and post-session integration planning.

An audit of client safety and informed consent should review: (1) whether client screening documentation meets OPS/DORA requirements; (2) whether exclusionary criteria (lithium use in the last 30 days, self-harm ideation, active psychosis) are applied consistently and documented; (3) whether informed consent forms are complete, current, and executed prior to sessions; (4) whether adverse event reporting forms exist and are accurate; and (5) whether emergency services procedures are documented and staff-trained.

B. Product Integrity and Chain-of-Custody Audit Protocol

Product integrity depends on: approved cultivation of only authorized mushroom species (Psilocybe cubensis in Oregon); compliant testing of every harvest lot and monthly batch; accurate labeling including psilocin potency (required by HB 2387 in Oregon); and documented chain-of-custody from manufacturer to service center to client session.

An audit of product integrity should review: (1) speciation testing records for all harvest lots; (2) contaminant and potency testing records for all batches; (3) chain-of-custody documentation from manufacturer to service center; (4) product labeling compliance including psilocin content disclosure; and (5) product storage compliance (temperature, security, access controls).

C. Financial Compliance Audit Protocol

Financial compliance in cash-intensive psychedelic businesses is a persistent risk area. An audit of financial compliance should review: (1) fee payment records confirming all required license fees have been paid; (2) revenue documentation for all sessions conducted; (3) product purchase records confirming all products were acquired from licensed manufacturers; (4) wage and worker permit documentation for all permitted workers; and (5) social equity plan documentation, which Oregon requires of all licensees.

D. Training Program Quality Audit Protocol

Training program quality directly affects the competence of the facilitator population, but OPS oversight of training programs is currently limited to curriculum review. A training program quality audit should include: (1) review of student completion and examination pass rate data; (2) unannounced observation of at least one training session; (3) review of practicum documentation confirming that all 40 required practicum hours were completed at licensed service centers; and (4) review of instructor qualifications and continuing education records.

E. Inter-Agency Coordination Audit Protocol (Colorado)

Colorado’s bifurcated regulatory structure — in which DORA licenses facilitators and DOR licenses healing center businesses — creates a coordination gap that standard single-agency audit protocols do not address. An inter-agency coordination audit should examine: (1) whether DORA enforcement actions against facilitators are communicated to DOR in a timely manner and vice versa; (2) whether violations identified during a healing center inspection that implicate facilitator conduct are properly referred to DORA for investigation; (3) whether the two agencies maintain consistent data records for individual licensees operating across both regulatory domains; and (4) whether joint inspection protocols have been established for complaints involving both a healing center and a licensed facilitator.²⁶

VII. Resource Implications and Staffing Standards

A risk-based audit program cannot be implemented without adequate staff. The absence of published staffing data for OPS and DORA makes precise benchmarking difficult, but comparative industry standards provide guidance.

Health Canada’s cannabis inspection program conducted 889 inspections across a national program in fiscal year 2024–25.²¹ At Health Canada’s ratio of approximately one non-compliant report per 24 inspections — derived from 889 total inspections yielding 37 non-compliant reports in FY2024–25²¹ — Oregon would need to conduct at minimum 20–30 inspections annually to detect the same proportion of compliance failures, assuming comparable violation rates. At a more intensive inspection rate reflecting Stage 2 minimum standards (annual inspections for all service centers plus biannual testing lab inspections), Oregon would need to conduct approximately 50–75 inspections annually. This estimate assumes average inspector productivity of approximately 50–75 field inspections per FTE per year — a range consistent with pharmaceutical and cannabis compliance program benchmarks that account for travel time, documentation, and supervisor review — meaning Stage 2 minimum standards for Oregon’s program would require at minimum one dedicated compliance FTE and likely one and a half to two FTEs when complaint investigations and special compliance projects are factored in.

Industry benchmark for cannabis compliance programs generally suggests a minimum of one FTE compliance officer per 50–100 licensed businesses for routine monitoring, with additional capacity for complaint investigations and special compliance projects.²⁷ For Oregon’s 35 service centers, this suggests a minimum of 1 dedicated compliance FTE for service center oversight, with additional capacity shared with manufacturer, facilitator, and training program oversight.

Publishing OPS’s actual compliance staffing levels — including the number of FTEs dedicated to compliance investigation vs. licensing — would be a straightforward transparency step that would enable public assessment of whether the program has adequate oversight capacity.

VIII. Conclusion

Risk-based auditing is not merely a theoretical best practice — it is the documented operational standard in the most effective drug regulatory programs in the world. The FDA’s risk-based inspection approach, Health Canada’s tiered inspection methodology with critical-major-minor observation classifications, and the GAO’s 2024 Yellow Book all converge on the same institutional design principle: that audit resources must be allocated according to assessed risk, not random distribution or reactive complaint response.

State psychedelic regulatory programs currently lack risk-based audit frameworks. Oregon’s OPS has no published risk-scoring methodology, no published inspection frequency targets, and no documented minimum audit standards. Colorado’s Natural Medicine Division is too new to have developed these frameworks, but it has the institutional advantage of being able to learn from the Marijuana Enforcement Division’s decade-plus experience with risk-based compliance in a legal drug market.

The frameworks proposed in this report — risk factor scoring, stage-specific minimum standards, domain-specific audit protocols, and staffing benchmarks — are designed to be operationally practical for programs of the size and maturity of current state psilocybin programs. They can be implemented incrementally: starting with 100% initial inspections within the first program year, progressing to risk-tiered annual inspection cycles, and ultimately incorporating data-driven compliance monitoring projects as program data matures.

The investment required is modest relative to the stakes. A single serious adverse event at a psilocybin service center — particularly one that proves attributable to foreseeable compliance failures that an adequate audit program would have detected — could destabilize public support for an entire state program. Risk-based auditing is the institutional infrastructure that makes such events detectable and preventable before they occur.

Endnotes

¹ U.S. Government Accountability Office, Government Auditing Standards 2024 Revision (GAO-24-106786), https://www.gao.gov/products/gao-24-106786; see also GAO Press Release, GAO Issues 2024 Yellow Book, Updating the Standards for Government Auditing (Feb. 1, 2024), https://www.gao.gov/press-release/gao-issues-2024-yellow-book-updating-standards-government-auditing.

² U.S. Food and Drug Administration, FDA’s Risk-Based Approach to Inspections, https://www.fda.gov/inspections-compliance-enforcement-and-criminal-investigations/inspection-basics/fdas-risk-based-approach-inspections.

³ Id.

⁴ Id. (example comparing high-risk sterile drug site to lower-risk OTC solid oral dosage site).

⁵ Health Canada, Compliance and Enforcement Report: Cannabis Inspection Data Summary 2024-2025, https://www.canada.ca/en/health-canada/services/drugs-medication/cannabis/research-data/compliance-enforcement-report-cannabis-inspection-data-summary/2024-2025.html.

⁶ Id. (889 total inspections in FY2024-25, comprising 437 regular, 101 targeted, 128 compliance verifications, 197 personal/designated production, and 26 promotions inspections).

⁷ Health Canada, Compliance and Enforcement Report: Cannabis Inspection Data Summary 2023-2024, https://www.canada.ca/en/health-canada/services/drugs-medication/cannabis/research-data/compliance-enforcement-report-cannabis-inspection-data-summary/2023-2024.html (defining critical, major, and minor observation categories).

⁸ Health Canada, FY2024-25 Report, supra note 5.

⁹ Id. (26 targeted inspections of promotions activities conducted in FY2024-25).

¹⁰ U.S. Government Accountability Office, Government Auditing Standards 2024 Revision, supra note 1 (effective for performance audits beginning December 15, 2025).

¹¹ U.S. Government Accountability Office, Government Auditing Standards: Frequently Asked Questions: Establishing and Maintaining a System of Quality Management (GAO-26-108710), https://www.gao.gov/assets/gao-26-108710.pdf (describing three-step risk-based quality management framework: establish quality objectives; identify and assess quality risks; design and implement responsive policies and procedures).

¹² U.S. Government Accountability Office and CIGIE, Financial Audit Manual (Vol. 1 updated June 2025; Vol. 2 updated June 2024; Vol. 3 updated August 2025), https://www.gao.gov/financial-audit-manual.

¹³ Id. (FAM Volume 1 methodology incorporating audit risk assessment).

¹⁴ Brian Holoyda, The Perilous Policy of Oregon’s Psilocybin Services, 51 J. Am. Acad. Psychiatry & L. 160, 162 (2023), https://jaapl.org/content/51/2/160 (identifying Oregon’s three exclusionary criteria: lithium use in the last 30 days, active self-harm thoughts, and active psychosis diagnosis or treatment).

¹⁵ Psychedelic Alpha, Oregon Psilocybin Services Tracker: Q1 2025 (Oct. 2025), https://psychedelicalpha.com/news/oregon-psilocybin-services-tracker-q1-2025 (197 group sessions averaging 3.17 clients per group in Q1 2025; 367 licensed facilitators; 23 operational service centers); see also Or. Admin. R. 333-333-4110 (2025), https://secure.sos.state.or.us/oard/displayDivisionRules.action?selectedDivision=7102 (setting the 25-client participant cap for group sessions).

¹⁶ Id. (30 curricula approved; 18 active; 5 revoked; 7 voluntarily withdrawn as of Q1 2025).

¹⁷ Colorado Dep’t of Regulatory Agencies, Division of Professions and Occupations, Natural Medicine Frequently Asked Questions, https://dpo.colorado.gov/NaturalMedicine/FAQ (describing Clinical Facilitator pathway requiring a current valid Colorado professional license, and standard Facilitator pathway).

¹⁸ Psychedelic Alpha, Q1 2025 Tracker, supra note 15 (“Currently, a single testing lab handles supply testing for the entire state.”).

¹⁹ Oregon Health Authority, Oregon Psilocybin Services — Manufacturer License, https://www.oregon.gov/oha/ph/preventionwellness/pages/psilocybin-license-manufacturer.aspx (licensed manufacturer endorsements include Fungi Cultivation, Psilocybin Extraction, and Psilocybin Edible Production; approved product forms include whole dried mushrooms, ground homogenized fungi, extracts, and edible psilocybin products); see also Or. Admin. R. 333-333 (2025), https://secure.sos.state.or.us/oard/displayDivisionRules.action?selectedDivision=7102.

²⁰ Psychedelic Alpha, Q1 2025 Tracker, supra note 15 (noting that “$12,000 may represent a significant enough investment to discourage [training programs] from rejecting a facilitator who has completed their program”).

²¹ Health Canada, FY2024-25 Report, supra note 5 (889 total inspections; 37 classified as non-compliant, yielding a ratio of approximately one non-compliant report per 24 inspections).

²² See Psychedelic Alpha, Oregon Psilocybin Services Tracker: Q1 2025, supra note 15 (reporting active service center count as of Q1 2025); see also Oregon Health Authority, Oregon Psilocybin Services Data Dashboard (Q1 2025), https://www.oregon.gov/oha/ph/preventionwellness/pages/psilocybin-data-dashboard.aspx (OHA dashboard reporting active service center counts by quarter).

²³ Harris Sliwoski LLP, Oregon Psilocybin: State of the State (2024), https://harris-sliwoski.com/psychlawblog/oregon-psilocybin-state-of-the-state-2024/ (discussing the practical effect of the federal banking exclusion on Oregon psilocybin service centers, including cash-intensive operations arising from the inability to access federally insured financial institutions).

²⁴ Or. Admin. R. 333-333-5100 et seq. (2025) (governing facilitator conduct requirements at service centers, including obligations applicable to facilitators working across multiple locations), https://secure.sos.state.or.us/oard/displayDivisionRules.action?selectedDivision=7102.

²⁵ New Mexico SB 219, Medical Psilocybin Act (2025), §§ 3(G), 4, 10, https://www.nmlegis.gov/Sessions/25%20Regular/bills/senate/SB0219.HTML (§ 3(G) limiting program to naturally occurring psilocybin; § 4 exempting FDA-approved products; § 10 requiring annual program assessment by NMDOH).

²⁶ Colorado Department of Natural Medicine, About, https://dnm.colorado.gov/; Colorado Dep’t of Regulatory Agencies, Colorado Natural Medicine Homepage, https://dpo.colorado.gov/NaturalMedicine (describing the bifurcated jurisdictional structure in which DORA and DOR hold separate licensing and enforcement authority over the same natural medicine transactions).

²⁷ Cannabis Regulators Association (CANNRA), Resources, https://www.cannra.org/resources (agency staffing and resource benchmarking publications); see also Marijuana Policy Project, Cannabis Policy Reform: Regulatory Framework Best Practices, https://www.mpp.org (identifying staffing ratios for cannabis compliance programs as a secondary reference; a primary CANNRA publication on agency staffing should be substituted if identified before publication).