CGMP Third Party Audit

Third-party cGMP audit is a private-sector inspection programme operated by an accredited certification body that verifies a supplement facility's compliance with 21 CFR Part 111. The audit consists of document review (SOPs, master records, batch records, supplier-qualification programme, complaint files, deviation files), on-site facility walkthrough, and personnel interviews. A passing audit results in a certification mark and listing on the certification body's public registry that brand customers and retailers consult during supplier qualification.

NSF/ANSI 173 is the dominant single programme by market share, primarily because it is the only ANSI-accredited dietary-supplement standard and is broadly recognised by major retailers. USP Verified has the most rigorous depth (it goes beyond facility audit to per-lot product testing against USP monographs) but covers a smaller product portfolio. NPA is the historical natural-products specialty programme. UL is a more recent entrant leveraging UL's broader product-safety reputation.

A third-party Part 111 audit follows the regulation subpart-by-subpart, mirroring what an FDA inspection would cover:

• Subpart A — Definitions and general (org chart, scope coverage).
• Subpart B — Personnel (qualification, training records, hygiene programmes).
• Subpart C — Physical plant + sanitation (facility walkthrough, sanitation SOPs, environmental monitoring).
• Subpart D — Equipment (calibration records, maintenance, qualification).
• Subpart E — Quality control of components (incoming testing, identity, specifications, supplier qualification).
• Subpart F — Quality control unit operations (disposition authority, independence, complaint handling).
• Subpart G — Production and process controls (raw materials, weigh-up, blending).
• Subpart H — Master and batch records (MMR, BPR, change control).
• Subpart I — Laboratory (methods, validation, instrument qualification, OOS handling).
• Subpart J — Records (retention, electronic-record controls, signatures).
• Subpart K — Laboratory operations (overlap with I, focused on lab-specific operations).
• Subpart L — Manufacturing operations (line clearance, weight check, in-process testing).
• Subpart M — Holding and distribution (FEFO, environmental conditions, distribution records).
• Subpart N — Returned products (quarantine, disposition).
• Subpart O — Complaints (receipt, investigation, trending).
• Subpart P — Records.

Third-party certification serves multiple stakeholders:

• Brand-owner supplier qualification — meets §111.12(a) own-label-distributor due-diligence obligation; reduces audit-fatigue when brand has many CM relationships.
• Retailer shelf-placement requirement — Whole Foods, Costco, Sprouts, Vitamin Shoppe, GNC all maintain supplier-qualification standards that effectively require one of the major certifications.
• Insurance underwriting — product-liability insurance premiums are typically discounted for facilities with current third-party certification.
• Investment / acquisition due diligence — supplement-industry M&A diligence routinely checks certification status as a quality indicator.
• FDA inspection preparation — facilities that pass annual third-party audit are statistically much less likely to receive a serious 483 observation when FDA arrives.
• Marketing differentiation — certification marks on product packaging are recognisable to informed consumers.

A typical annual cGMP certification cycle runs:

• Pre-audit: facility submits application + scope of operations + Quality Manual + prior-audit findings status. Certification body assigns audit team and date.
• On-site audit: 3–5 days depending on facility complexity. Day 1 opening meeting + document review. Days 2–3 facility walkthrough + personnel interview + sampling. Day 4 record review + finding deliberation. Day 5 closing meeting + draft findings.
• Post-audit: facility receives Audit Report with findings categorised (Major / Minor / Observation). Corrective Action Plan (CAP) required within 30 days, with implementation evidence within 60–90 days.
• Certification decision: certification body reviews CAP and evidence; decides certification status (certified / certified-with-conditions / withheld / withdrawn).
• Surveillance: annual full audit cycle repeats; some programmes conduct unannounced interim surveillance audits between annual audits.

Mature brand-owner supplier-qualification programmes treat third-party certification as one input — not the only input. Best-practice approach:

• Initial qualification — certification + brand-side on-site audit (not waived). The brand audits the audit, sampling areas of brand-specific concern.
• Periodic re-qualification — annual brand-side audit cycle even when certification is current; brand looks at things the third-party audit may not (formula-specific change control, brand-portal record access, communication SLA performance).
• Certification-body selection — brand stipulates which certifications are acceptable (typically NSF/ANSI 173 is broadly acceptable; brand-specific contracts may require additional or different certifications).
• Audit-finding review — brand reviews most recent third-party audit findings + CAP closure evidence as part of annual qualification.
• FDA history check — brand cross-references certification status against FDA inspection history (Form 483, Warning Letters, recalls) on the FDA public databases.

• Facility certification register: programme, body, scope, certificate number, issue / expiry, current status.
• Annual audit workflow: pre-audit document pack, on-site agenda, finding + CAP register, evidence-of-completion linkage, closing-meeting record.
• Per-subpart compliance evidence pack generator: SOPs, MMRs, BPRs, supplier-qualification register, training records, calibration register, deviation log, complaint log — generated as a single PDF binder per Part 111 subpart on demand.
• Brand-portal supplier-qualification view: certification status surfaced to each brand customer with download links to current certificate + scope letter.
• Pre-expiration alert workflow: 120 / 90 / 60 / 30-day reminders to facility QA before certificate lapses.
• Major-finding alert: workflow trigger when audit returns a Major / Critical finding; locks affected SKU release until remediation evidence accepted.
• FDA inspection mode (separate): generates the same evidence pack but tuned to FDA Form 483 response timing (15 business days).