V5 Ultimate
Guide

Supplement Contract Manufacturer Audit Checklist: 21 CFR 111 + NSF 173 / USP <2750> + the 12 Walk-Away Red Flags

Brand-owners contract out 80%+ of US dietary supplement manufacturing — and inherit every cGMP gap their CMO leaves behind. The FDA does not distinguish 'brand-owner' from 'manufacturer' when it issues a 483 or a recall: both names go on the warning letter. A pre-contract audit is the single highest-ROI quality activity a supplement brand runs. This guide is the auditor's working checklist — 21 CFR 111 walked Subpart by Subpart, NSF/ANSI 455-2 and USP <2750> bolt-ons mapped, the documents to demand on day one, the in-plant walk in the order an FDA investigator does it, and the 12 red flags that mean walk away from the contract.

Start free trial Free trial, no credit card, onboard in days, not months.

Day one document request — the 17 documents that tell you everything

Send the document request 10 business days before the on-site. The 17: (1) FDA establishment FEI and last 483/EIR, (2) NSF 173 or USP <2750> certificate with current scope, (3) site master file or facility overview, (4) organisation chart with QA reporting line (QA must NOT report into operations), (5) master sanitation schedule, (6) cleaning validation summary report, (7) qualification status of any contact utility (water USP <643>/<645>, compressed air ISO 8573-1), (8) sample MMR (21 CFR 111.205) and BPR (111.255) for a representative product, (9) component identity SOP and an executed identity record (111.75), (10) supplier qualification list with tier classification, (11) stability programme overview, (12) deviation/OOS log summary last 12 months, (13) complaint/AER log summary last 12 months, (14) recall procedure and last mock recall result, (15) training matrix, (16) change-control log, (17) data integrity / 21 CFR Part 11 posture statement. A CMO that cannot produce 12 of these in 10 days is already disqualified — they don't have a quality system, they have a filing cabinet.

The Subpart-by-Subpart walk (21 CFR 111)

Subpart A (general) — written cGMP procedures, recordkeeping. Subpart B (personnel) — 111.10 hygiene, 111.13/14 training matrix, gowning gate. Subpart C (physical plant) — 111.15 sanitation, pest control log, MSS. Subpart D (equipment) — 111.27 cleaning validation per shared equipment per allergen, calibration NIST-traceable. Subpart E (production & process control) — 111.55–111.75 component identity, specifications, MMR. Subpart F (production & process control records) — 111.100 written procedures, 111.103 batch-record review by QA before release, 111.110 in-process specs and reconciliation. Subpart G (quality control) — 111.123 QA independence. Subpart H (components) — 111.155 spec, 111.160 ID, 111.165 supplier qualification. Subpart I (master mfg record) — 111.205/210. Subpart J (batch production record) — 111.255/260. Subpart K (lab operations) — 111.303 method-suitability, reference standards. Subpart L (mfg ops) — 111.355 written procedures. Subpart M (packaging & labelling) — 111.410 label reconciliation. Subpart N (holding & distribution) — 111.453. Subpart O (returned supplements) — 111.503. Subpart P (complaints) — 111.553. Walk all 16 Subparts with one question per: 'show me the SOP, show me the record, show me yesterday'.

NSF 173 / USP <2750> — the retailer-mandatory bolt-ons

21 CFR 111 is the federal floor. NSF/ANSI 455-2 (supplements) and USP <2750> are the retailer-mandatory bolt-ons that Amazon, Costco, Whole Foods, Walmart and Target increasingly require for SKU placement. A CMO without one of them locks the brand out of the largest US retail channels. The bolt-on adds: (a) supplier qualification tiering with on-site Tier-1 audits at defined frequency, (b) validated cleaning per equipment per allergen with HBEL/PDE-derived MACO limits, (c) full traceability bottle-to-component-lot, (d) routine third-party testing of finished product including heavy metals (ICP-MS per USP <2232>), microbial (<2021>/<2022>), identity (HPTLC for botanicals, FTIR for synthetics), and (e) a quality agreement template that places stability, change control and complaint ownership in writing. Demand the current certificate and the scope statement — a 455-2 certificate that excludes the dose form you're buying is worthless.

The in-plant walk — in the order an FDA investigator does it

10 minutes: receiving dock. Watch one container of an active arrive — is it sampled, labelled 'quarantine', logged into the system before storage? 10 minutes: warehouse. Open three random pallets — does the label match the system, are the expiry/retest dates current, is the temperature mapped? 30 minutes: dispensing booth. Is gowning enforced, is the booth qualified, are weight prints attached to the BPR in real time? 20 minutes: blending. Does the operator follow the MMR, is the blend-uniformity sample taken per the SOP, is the result reviewed before next-step release? 20 minutes: compression/encapsulation. Are in-process weight, hardness, friability records continuous and reviewed, are deviations open in the system? 15 minutes: packaging. Label reconciliation per 111.410, is the print proof signed by QA against the MMR? 30 minutes: QC lab. Show me yesterday's HPLC chromatogram, the system suitability print, the reference-standard qualification record. 20 minutes: QA. Show me the batch records on QA desk pending review, the deviation log, the supplier change notifications open. End in the boardroom: show me the last management review.

The 12 red flags — when to walk away

(1) QA reports into operations. (2) Last 483 has any Subpart E (identity) or Subpart F (records) observation that is not closed with verified evidence. (3) No NSF 173 or USP <2750> certificate, or scope excludes your dose form. (4) Cleaning validation predates the last allergen change. (5) Component identity SOP allows release on supplier CoA without periodic re-test. (6) Stability programme has no committed batches in the last 12 months. (7) Master sanitation schedule has overdue items >30 days. (8) Deviation log shows >20% open >90 days. (9) Complaint file has no AER decision-tree, or the 15-business-day MedWatch 3500A clock is unmeasured. (10) Mock recall has not been run in 12 months, or the last traceback exceeded 4 hours. (11) Suppliers above Tier-1 are paper-qualified only. (12) The boardroom management review is more than 6 months stale or has no actions tracked. Any one of the 12 is a contract-stopper unless there is an executed, verified remediation plan with a deadline inside 60 days.

The quality agreement — what to insist on before signing

21 CFR 111 does not require a quality agreement, but every brand-CMO relationship that survives 5 years has one. The minimum: (a) batch disposition authority unambiguously with the CMO's QA — but with brand QA review-and-acknowledge before release of any deviation or OOS batch, (b) supplier change notification to brand inside 5 business days of CMO's awareness, (c) annual on-site brand audit, (d) stability programme ownership and access to raw data, (e) recall responsibility and 24-hour notification clock, (f) AER intake routing (CMO or brand) with the 15-business-day MedWatch 3500A clock named, (g) ownership of master and batch records and access on demand, (h) sub-contracting requires brand pre-approval, (i) data integrity / Part 11 posture, (j) termination triggers and exit assistance.

Standards covered in this guide

Each standard, retailer code or assurance scheme referenced above has its own deep-dive page with scope, audit detail and common pitfalls.

Supplier qualification audit (supplements)

Supplier qualification under 21 CFR 111.75(a)(2) and NSF/ANSI 455-2 requires an initial on-site or documented audit, a quality agreement, a risk classification (Tier 1 active/botanical, Tier 2 functional excipient, Tier 3 commodity), and a re-qualification cycle (typically Tie...

Supplier CoA verification programme

The Certificate of Analysis (CoA) verification programme is the recurring in-house re-test that establishes — then maintains — supplier qualification under 21 CFR 111.75(a)(2). A defensible programme tests every incoming lot for identity (always) and, on a documented sampling ...

Component identity confirmation (21 CFR 111.75)

21 CFR 111.75(a)(1)(i) requires at least one appropriate test or examination to verify the identity of any dietary ingredient used as a component, before use. Supplier CoA alone is not sufficient unless the supplier is qualified under 111.75(a)(2) and the qualification is peri...

MMR elements per 21 CFR 111.205

The Master Manufacturing Record (MMR) under 21 CFR 111.205 must be prepared for each unique formulation and each batch size of a dietary supplement, and must contain: name & strength; complete list of components by established name; accurate statement of weight or measure of e...

BPR elements per 21 CFR 111.255

The Batch Production Record (BPR) under 21 CFR 111.255 is the executed record for one batch, prepared from and matching the MMR. It must capture identity & weight/measure of each component used, in-process and finished-product specifications, equipment used, date and time of e...

Annual Product Review (supplements)

An Annual Product Review (APR) — adapted from 21 CFR 211.180(e) but a best-practice expectation for any commercially mature dietary supplement SKU — is the once-a-year statistical review of every batch produced, covering yields, OOS/OOT events, complaints, deviations, change c...

Where this lives in V5 Ultimate

The clauses above aren't theoretical — every one maps to a shipped module and an industry profile. Jump to the parts of the product that turn this guide into evidence on a Monday morning.

Industries this hits hardest

Frequently asked

Is NSF 173 or USP <2750> legally required?
Neither is federally required — both are voluntary third-party certifications. But major US retailers (Amazon, Costco, Whole Foods, Walmart) require one of them for many supplement categories as a condition of placement. For a brand selling through national retail they are effectively mandatory, so any CMO without current certification with the right scope is a non-starter.
How often should I audit my CMO after the initial qualification?
Annually on site, plus any time there is a Class I/II recall, a serious 483, a change of CMO QA leadership, or a change of ownership. Some brands run a desktop quarterly review of the deviation/complaint/change-control log between annual on-sites. Skipping the annual is the most common reason a long-running CMO relationship ends in a surprise recall.
What is the single most common FDA 483 in supplement plants?
Component identity under 21 CFR 111.75 — releasing botanical or vitamin lots on supplier CoA without an in-house identity test, or with an identity test that is not validated for the matrix. Subpart F records gaps (missing or incomplete master and batch manufacturing records) are second. Both are paperwork problems, not chemistry problems.
How long does a defensible CMO audit take on site?
One auditor, one full day for a single dose-form plant. Two auditors, two full days for a multi-dose-form plant (e.g., tablets + capsules + gummies + softgels). Half-day audits exist but are marketing visits, not quality audits — they cannot cover 16 Subparts plus a meaningful in-plant walk plus a closing meeting in 4 hours.

See it on your shop floor.

Free trial, no credit card, onboard in days, not months.

Spot something off? .