CGMP Third Party Audit

A cGMP third‑party audit is an independent assessment of a dietary‑supplement manufacturer’s adherence to U.S. current Good Manufacturing Practice requirements under 21 CFR Part 111. Unlike FDA inspections, which are regulatory and enforcement‑driven, these audits are voluntary certifications that deliver a standardized report and a time‑bounded certificate recognized by many brands and retailers.

The model emerged to address timing gaps between FDA inspection cycles and the day‑to‑day commercial needs of brand owners who must qualify suppliers and demonstrate control to their retail channels. The certificate and detailed audit report provide assurance that the site has adequate systems for quality, materials control, production, packaging, labeling, and holding.

Four long‑standing programs dominate the category: NSF/ANSI 173 (historically the ANSI‑accredited dietary‑supplement standard), the updated NSF/ANSI 455‑2 for supplement GMP, the Natural Products Association (NPA) cGMP certification, UL Solutions cGMP auditing, and the USP Verified Quality programs. Retailers such as Whole Foods Market, Costco, and Sprouts frequently condition shelf placement on evidence of such third‑party GMP certification.

These audits should not be confused with banned‑substance schemes like NSF Certified for Sport or Informed Sport, which focus on substances prohibited in sport and add analytical testing layers to the GMP foundation rather than replacing it.

The legal foundation for dietary‑supplement manufacturing in the United States is 21 CFR Part 111, which defines cGMP requirements for personnel, facilities, equipment, production and process controls, quality control, packaging and labeling, holding and distribution, records, product complaints, and returns. Third‑party auditors benchmark a site’s procedures and records against these subparts to determine conformance and maturity.

Critical technical anchors include identity testing of dietary ingredients under 21 CFR 111.75, the use of scientifically valid test methods consistent with 21 CFR 111.320, validated or verified methods aligned with compendial expectations, and reserves retained under 21 CFR 111.83 to support investigations and stability. Auditors typically look for traceability, data integrity, and decision‑making by an appropriately independent quality control unit.

Because many manufacturers rely on electronic systems, auditors often expect controls aligned to Part 11 expectations when electronic records and signatures are used, along with robust change control and audit trails. Where firms use compendial specifications, USP monographs and general chapters can demonstrate method suitability, performance verification, and acceptance criteria.

In practice, the standard used by the audit program harmonizes the above statutory requirements into a single audit checklist and scoring rubric. NSF/ANSI 455‑2 formalizes this for supplements by consolidating GMP control expectations and auditor competency criteria into an ANSI‑approved standard.

Several programs are widely recognized by brand owners and retailers. Historically, NSF/ANSI 173 included a GMP section for dietary supplements, but the industry has transitioned toward NSF/ANSI 455‑2, which provides a more detailed and harmonized GMP framework. NPA’s cGMP program and UL Solutions’ cGMP audits are also accepted by many buyers. USP offers the USP Verified Mark for dietary supplements, which encompasses GMP assessment and product testing.

Recognition varies by retailer and customer contract. Some programs emphasize facility‑level controls, while others combine facility GMP with product‑specific verification. Your selection should consider customer requirements, geographic markets, analytical expectations, and the maturity of your quality management system.

Beyond the certificate, the deliverables matter. Robust programs provide a detailed audit report with nonconformities categorized by risk, timelines for corrective action, and evidence requirements for closure. Surveillance audits and unannounced visits may be required to maintain status.

Third‑party GMP certification primarily targets facilities performing manufacturing steps covered by 21 CFR Part 111, including blending, encapsulation or tableting, packaging, labeling, and holding. Contract manufacturers often seek certification to satisfy multiple brand customers with one audit cycle. Private‑label brand owners may also certify owned plants to expedite retailer onboarding.

Applicability extends to contract packagers and warehouses if they control activities that can impact quality or labeling accuracy. Holding and distribution operations are especially relevant where environmental controls, segregation, and FIFO lot management are critical to maintaining product quality and preventing mix‑ups.

From a commercial perspective, certification streamlines supplier approval for brands with formalized qualification schemes. Many purchasing and quality agreements now specify acceptable audit programs, surveillance cadence, and how significant changes trigger re‑evaluation. Clearly defined service‑level and change‑notification terms help both parties avoid gaps.

When using third‑party logistics providers or contract service labs, the certified manufacturer remains responsible for oversight. Evidence of qualification, performance monitoring, and documented communication pathways should be included in the certification scope and customer packets.

Audits typically begin with an application and document submission describing the site, products, and processes. The auditor conducts a Stage 1 review to assess readiness and plan sampling, then performs an on‑site Stage 2 evaluation that triangulates interviews, facility tours, and record review. Remote or hybrid models are sometimes used, but high‑confidence programs maintain a strong on‑site component.

Record review centers on master manufacturing records and executed batch production records, training files, equipment logs, sanitation schedules, laboratory data, material release decisions, complaint investigations, and CAPA. Sampling often includes identity tests for incoming components, in‑process controls, and label reconciliation. The quality control unit’s independence and authority are assessed alongside management commitment.

Nonconformities are graded by risk, and the site submits corrective and preventive actions with root cause, containment, correction, verification of effectiveness, and timelines. Certification is issued when major items are closed or effectively controlled, with surveillance audits to confirm sustained performance.

1. Application and readiness document review
2. On‑site evaluation against the selected standard
3. Issue of nonconformities and CAPA plan
4. Technical review and certification decision
5. Surveillance audits and change management

Regardless of the program, auditors map evidence to 21 CFR Part 111 subparts. They look for trained personnel, adequate facilities, controlled equipment, validated or verified methods, scientifically justified specifications, and a quality control unit with authority to approve or reject materials, in‑process steps, labels, and finished lots. Identity testing of dietary ingredients is a cornerstone, and the site must demonstrate material traceability from receiving through distribution.

Production and process controls are evaluated for reproducibility and preventive risk management. Master and batch records should be complete, contemporaneous, and legible, with clear component measures, equipment settings, yields, deviations, rework, and reconciliations. Laboratory controls must show method suitability, instrument calibration, quality of reference standards when used, and defensible decision criteria.

Post‑market controls round out the system. Product complaint handling, reserve samples, returns processing, and investigations are assessed for timeliness, depth, and effectiveness. Auditors also review distribution records to confirm traceability and recall readiness.

• Identity testing for each dietary ingredient using scientifically valid methods
• Documented in‑process specifications and acceptance criteria controlling critical quality attributes
• Complete MMRs and executed BPRs demonstrating line clearance, reconciliation, and yield checks
• Independent quality control unit with final disposition authority and change control
• Sanitation, equipment cleaning, and maintenance programs suited to product and process risk
• Material receipt, status control, and supplier verification aligned to risk
• Complaint, investigation, reserve sample, and return handling with timely CAPA
• Distribution records enabling rapid traceability and recall execution

Over‑reliance on supplier certificates of analysis for identity without site‑performed testing remains a primary deficiency. Auditors expect identity testing per 21 CFR 111.75 using scientifically valid methods, not only vendor documentation. Insufficient method suitability or lack of verification when adopting compendial methods can also trigger significant findings.

Data integrity lapses, including uncontrolled spreadsheets, shared passwords, or incomplete audit trails, undermine confidence in batch review and release. Where electronic records and signatures are used, programs anticipate controls consistent with Part 11 expectations, including unique user credentials, secure time‑stamped audit trails, and validated workflows.

Training and qualification records frequently lack role‑based curricula, periodic effectiveness checks, or documented assessments tied to specific unit operations. Calibration and maintenance documentation may omit as‑found/as‑left results or fail to document impact assessments when equipment is found out of tolerance.

Inadequate cleaning and sanitation programs, especially around allergen control and cross‑contamination prevention, lead to recurring observations. Gaps in hold‑and‑release status, quarantine practices, or complaint investigation depth also surface where procedures exist but are not consistently followed.

Third‑party supplement GMP audits anchor to 21 CFR 111 but operate within a broader ecosystem of standards. NSF/ANSI 455‑2 was developed to modernize and harmonize GMP expectations for supplements, succeeding the legacy GMP clause within NSF/ANSI 173. Many buyers now specifically call out 455‑2 in qualification criteria and contracts.

Product‑focused labels such as USP Verified include GMP assessment and independent testing against USP references; they can complement a facility GMP certificate where customers demand both process control and product verification. In contrast, sports certifications like NSF Certified for Sport or Informed Sport address banned‑substance risk management and analytical testing on top of GMP, serving different stakeholders.

Outside the supplement rule set, related GMP frameworks include 21 CFR Part 117 for conventional foods, 21 CFR Part 211 for drugs, and 21 CFR 820 for medical devices. Animal food is addressed under 21 CFR Part 507. While not interchangeable, these frameworks share principles around documented controls, validation or verification, and traceability, which can inform multi‑regulated sites.

Retailer policies vary in which certificates they accept, surveillance frequency, and requirements for corrective action closure before authorization to ship. Always confirm the specific program names, issuance bodies, and expiration windows written into listing or vendor manuals.

Auditors expect master manufacturing records that reflect the current process, including component lists, theoretical yields, equipment, and detailed steps that minimize variability. Executed batch records should be contemporaneous, with initialed times and dates, accurate yields, deviations documented, and reconciled labels and components accounted for. Review and approval steps by quality must be traceable and complete.

Laboratory evidence should show identity testing of each dietary ingredient, method suitability or verification, calibration standards traceability, and appropriate controls. Where scientifically valid methods are developed in‑house, justification of selectivity, accuracy, precision, and robustness is expected, with change control when methods are revised. Retained samples should be stored under defined conditions and used to support investigations.

On the shop floor, sanitation and equipment cleaning records, line clearance verifications, and status labeling should make it obvious what can move and what is on hold. Material receiving, sampling, and disposition must connect lot identifiers across warehouse and production systems so that traceability queries can be answered within hours, not days.

Finally, complaint handling, returned goods evaluations, and CAPA documentation should demonstrate root‑cause rigor and effectiveness checks. Auditors are increasingly attentive to trend analysis and the feedback loop that improves specifications, methods, and training.

Begin with a candid gap assessment against your chosen program, mapping findings to 21 CFR Part 111 subparts and prioritizing risks that affect identity, strength, composition, and contamination. Consolidate procedures where duplication and contradictions exist. Establish a readiness plan that pairs document remediation with practical floor changes and training.

Upgrade record design before the audit. Ensure MMRs and BPRs can be followed without tribal knowledge. Build evidence packages for identity testing, method suitability, and calibration. Tighten hold‑and‑release and material status controls. Validate electronic workflows that control revisions and enforce sign‑offs. Prepare a clean, current site master file and equipment lists.

Conduct an internal mock audit with subject‑matter experts unfamiliar with your site’s daily routines. Timebound CAPA with root‑cause analysis and verification‑of‑effectiveness. Confirm your change notification process captures formula, label, supplier, and equipment changes that may affect risk or certificate scope. Align surveillance schedules to retailer and customer renewal windows to avoid shipment holds.

After certification, sustain performance with management review, trending of complaints and deviations, and periodic retraining on error‑prone steps. Keep customer packets updated with current certificates, summaries of significant changes, and closure evidence for major observations. Treat the audit cycle as an opportunity to demonstrate continuous improvement.

Third‑party GMP audits reward organizations that make control visible and repeatable. V5 Ultimate provides the spine for disciplined execution, from controlled documents and structured batch records to supplier oversight and audit‑ready evidence. Teams move faster because procedures, training, and records live in one system with enforced sequencing and electronic signatures.

On the production side, enforced step sequences, weigh and dispense controls, and material status safeguards reduce error opportunities that drive observations. In the lab, validated method workflows, instrument calibration logs, and specification management consolidate the scientific justification auditors expect to see for identity and in‑process decisions.

For commercial stakeholders, shareable audit reports, current certificates, and supplier performance dashboards make it straightforward to satisfy brand and retailer documentation requests. Surveillance cycles are easier to navigate when changes, deviations, and CAPA link back to the affected batches, components, and procedures without manual reconciliation.