How V5 Ultimate runs a dietary supplement site, end to end.

21 CFR 111 doesn't ask for 'some documentation'. It requires a Master Manufacturing Record for every product (§111.205), a complete Batch Production Record for every lot (§111.255–111.260), 100% identity testing of every component lot received (§111.75(h)(1)), and a Quality Control review-and-approve of each batch before distribution (§111.260). Taken together, those four requirements define a manufacturing operation where the record is as regulated as the product itself.

Most supplement stacks treat records as a post-production paperwork exercise: a templated Word doc, a spreadsheet of COAs, and a signature page assembled at the end of the run. When an investigator requests the BPR for lot 2026-0412, the answer should be immediate and complete. In practice, it takes days — and the holes in the documentation are the finding.

V5 Ultimate inverts the model. Every action on the floor — dispense, weigh, blend, in-process check, cleaning, operator identity — writes one immutable, timestamped record in real time. The BPR isn't assembled after the fact; it is the natural exhaust of doing the work. Identity-test results are required gates before a component can be dispensed. Quality holds are status flags the warehouse system enforces, not stickers on a shelf. The record is the product, built as the line runs.

Read left-to-right. Every node writes to the same immutable ledger, and every node carries forward the lot, batch, operator, and instrument context from the node before it. Identity test results gate the Receive node before any downstream step begins. Nothing is re-keyed; nothing is reconciled at the end. The BPR is complete by the time the last operator signs the last packaging step.

21 CFR 111 Subpart E requires that you establish written specifications for each component and that you only use components from approved suppliers whose specifications are met. V5 holds the supplier master with qualification status, scope (ingredient × site × grade × certificate of analysis format), audit dates, allergen declarations, and approved alternates. New suppliers go through portal-driven onboarding: company info, regulatory licences, GMP certificates (NSF, USP Verified, FSSC 22000, or equivalent), allergen/GMO declarations, identity testing method disclosures, and change-notification commitments. QA reviews, approves, and the supplier moves to 'Approved (scoped)'.

Re-qualification runs on a calendar — V5 chases expiring certificates through the supplier portal and escalates if a document misses its window. The release engine refuses to consume any material whose supplier × ingredient combination isn't currently approved. There is no 'override and dispense' button; there is a quarantine-pending review. For raw materials on the Restricted Ingredients list (21 CFR 119 — stimulants, DMAA, BMPEA, and analogues), V5 carries a categorical block at the ingredient-master level.

21 CFR 111.75(h)(1) is the most frequently cited requirement at supplement facility inspections: you must confirm the identity of every component lot you receive. Not a sampling plan — every lot. V5 makes that requirement operational, not aspirational. A receiving operator scans the delivery; V5 checks the supplier/ingredient combination against the approved master, prints (or e-stamps) a quarantine label per container, and creates lot records linked 1:1 to the COA, the PO, the carrier documents, and the temperature log if cold-chain. Status is Quarantine-Pending-ID until QC dispositions it.

The identity test request is auto-generated from the material class. V5 prints sample labels with traceable IDs, routes the request to the QC kiosk or LIMS bridge, and waits for a signed result before the lot can move. For dietary ingredients, identity testing methods are configured per ingredient: TLC, FTIR, HPLC, organoleptic, or DNA barcoding. Disposition flips the lot to Released, Rejected, or Conditional-Hold, and every workstation in the facility sees the change in real time. A lot in quarantine cannot be dispensed at any kiosk — the pick is physically blocked by status, not by trust.

Every bin, every container, every split lot carries a regulated status: Quarantine, Quarantine-Pending-ID, Released, Conditional-Hold, Rejected, or Expired. Operators see only what is pickable for the current work order — V5 hides everything else. FEFO (first-expired, first-out) is enforced by default in compliance with 21 CFR 111 Subpart J storage and distribution requirements; overrides require a documented reason and a second signature.

Movements — putaway, transfer, decant, split — write to the same ledger as the rest of the platform. A lot split into N child containers inherits parentage; when you trace forward later, every child remembers the parent container and the operator who made the split. Cycle counts, recall sweeps, and stock-take reconciliations are filterable by status, supplier, and dietary ingredient. A recall doesn't start with a spreadsheet; it starts with a query filtered on the implicated ingredient lot.

21 CFR 111.205 lists the required content of every MMR with no ambiguity: the name and version of the dietary supplement; a statement of identity; the components in the batch and their quantities per serving; the master formula; the step-by-step instructions for manufacturing, packaging, labelling, and in-process controls; the type and weight/measure of each packaging component; the sample collection procedures; and the specifications for the finished batch. V5 holds all of that in structured, queryable fields — not a PDF attachment.

MMRs go through a two-signature approval workflow (author + QA approver, identity-verified e-signatures, Part 11). Once Effective, the MMR is locked; any change goes through change control and produces a new version with a controlled effective date. The release engine binds the work order to a specific MMR version; you cannot 'use the latest' by accident. The per-serving nutrient calculation is live inside the MMR — change a component quantity and the Supplement Facts panel preview recalculates immediately, flagging any drift from the registered claims.

When planning releases a work order, V5 binds it to a specific MMR version and copies that version into the BPR shell. Even if the MMR is revised tomorrow, this batch will always reference what was Effective at release time — satisfying the 21 CFR 111.255 requirement that the BPR is an accurate reproduction of the MMR. The snapshot includes the BOM with quantities and tolerances, the routing, the in-process control plan, the packaging instructions, the labelling requirements including Supplement Facts panel version, and the finish-product specification.

Operator training currency, instrument calibration status, equipment sanitation status, and allergen-sequencing rules are all checked at release. A work order cannot be released to a station with an out-of-cal balance or to an operator whose GMPs training expired last week. The checks are automated and logged; the investigator's question 'was this operator qualified to perform this operation?' is answered in three clicks.

An operator scans the work order; V5 walks them through the dispense list step by step per the snapshotted MMR. Scan the ingredient lot, scan the container, place on the validated balance — V5 captures the reading directly from the instrument. The reading must fall inside the tolerance defined in the MMR. If it doesn't, the kiosk holds and forces a documented deviation or a re-weigh before continuing. 21 CFR 111.260(d) requires that a qualified individual reviews the batch record to verify every step was performed correctly — the kiosk makes that review one of clean passes versus flagged exceptions, not a page-by-page read-through.

Identity-verified e-signatures bind every step to the operator who performed it. Operators cannot skip a step, cannot proceed past a hold, and cannot enter a weight by hand for a connected instrument. The BPR fills itself; the operator does the work. Where a step requires a second-person verification per the MMR (for example, a blend verification of a high-potency ingredient), V5 enforces the second signature before the step completes.

21 CFR 111 Subpart F requires written procedures for monitoring in-process materials. V5 implements those procedures as a schedule, not a reminder. In-process checks (blend uniformity, moisture content, hardness, disintegration, fill weight, microbial swab at a fill line) are triggered by the BPR's IPC plan at the configured interval. V5 raises the sample request, prints the sample label with a traceable ID, and accepts the result — either entered at the kiosk by a trained tester or returned from a LIMS bridge. The result is linked to the specific sub-lot, work order step, and instrument.

Finished product testing against the specification defined in the MMR (potency, identity, microbial, heavy metals, pesticide residues for botanical products, and any USP <2750> or NSF/ANSI 173 required tests) is scheduled automatically on the released batch and its result gates the QA release decision. An out-of-specification (OOS) result triggers a sub-lot hold and a deviation record; V5 trends results across batches (CpK, control charts) so a drift toward the spec limit is escalated before the first batch fails.

When the kiosk holds on an out-of-tolerance weigh, an OOS in-process result, or a failed identity test, V5 opens a Deviation linked to the work order, the step, the operator, the instrument, and the affected lot. QA triages and classifies the deviation — planned or unplanned, minor, major, or critical — and runs an impact assessment. 21 CFR 111.140(b) requires that you establish and follow procedures for handling production and process deviations; V5 makes those procedures the only path forward, not a separate binder.

CAPAs are tracked to root cause with effectiveness checks at agreed intervals. Change control governs everything from MMR formula revisions to supplier ingredient substitutions to equipment firmware changes — each with a risk assessment, a validation impact determination, training impact, and a controlled effective date. When a CAPA root cause is 'operator technique', V5 auto-triggers a re-training assignment for the affected operators and blocks their relevant kiosk competency until it's complete.

Packaging and labelling operations for dietary supplements carry their own critical compliance requirements: the Supplement Facts panel per 21 CFR 101.36 must match the formula, the structure-function claim disclaimer ('This statement has not been evaluated by the Food and Drug Administration…') is required by DSHEA §6 for any structure-function claim, the lot code and expiry date must be printed per 21 CFR 111.415, and — for SAE reporting — the product must carry a domestic address and phone number per DSNDCPA.

Packaging routings run the same way as manufacturing: a kiosk-led step list, reconciled label counts (issued / applied / destroyed / reconciled), line-clearance verification before any new batch enters the line, and a verified label artwork check against the MMR-approved artwork version. V5 blocks packaging if the label's Supplement Facts panel version doesn't match the released formula version. Lot codes and expiry dates are printed from V5 data — not hand-stamped — so the link between the physical unit and the BPR is unambiguous.

21 CFR 111.260 requires that a qualified individual reviews the BPR for each batch to ensure that the batch was manufactured according to the MMR and that all in-process and finished product specifications were met before the batch is released for distribution. By the time the last packaging step is signed in V5, the BPR is complete: every dispense, every in-process result, every deviation, every CAPA reference, every cleaning record, every operator e-signature, and every instrument calibration citation. QA reviews by exception — V5 highlights everything that wasn't a clean pass, so the reviewer's time goes to the three deviations and one borderline IPC result, not to 200 pages of clean records.

Release is gated by: all deviations dispositioned with documented QC decision, all OOS investigations closed or formally extended, finished product test results on file, expiry date calculated from the MMR shelf-life model, and a label compliance check cleared. A released batch generates the Certificate of Analysis from the same data — no re-typing, no manual calculation.

Released batches ship with full forward traceability: lot code to customer order to ship date, all linked in the ledger before the truck leaves. Complaints land via a customer portal, a toll-free phone intake, or a CSM ticket; each complaint routes to QA and links forward to an investigation file that can spawn a deviation or CAPA. 21 CFR 111.560 requires that you retain records relating to consumer complaints for one year beyond the shelf life of the product — V5 maintains that retention automatically, attached to the relevant lot.

Serious Adverse Events (SAEs) are the highest-stakes obligation in the supplement space. DSNDCPA (21 CFR 111 Subpart O) requires that the responsible person submit a mandatory SAE report to FDA within 15 business days of receiving a report of a serious adverse event — defined as an adverse event that results in death, life-threatening experience, inpatient hospitalisation, persistent or significant disability, congenital anomaly, or requires medical or surgical intervention to prevent one of those outcomes. V5 flags incoming complaint records as potential SAEs on intake, sets the 15-business-day clock, prompts structured case narrative capture, and exports the MedWatch 3500A (or equivalent structured data) for regulatory submission. The submission audit trail captures every edit, every review, and every transmission date — the evidence you need if FDA asks.

Voluntary recalls are the norm in the supplement industry; mandatory recall authority under FSMA Section 206 is reserved for products that present a reasonable probability of serious adverse health consequences. V5 answers the four recall questions instantly from any node: which lots of which ingredients are implicated, which batches consumed them, which finished lots were produced, and which customers received which lots.

21 CFR 111 Subpart C requires that quality control operations be in the hands of a qualified individual and that those operations cover every phase of manufacturing. V5 implements that requirement as a system state, not a job description. User roles and permissions, training matrix with currency enforcement, instrument calibration with auto-hold on lapsed cal, validated cleaning protocols with verification results, environmental monitoring with trended alert limits, supplier qualification status, deviation and CAPA workflow, change control, internal audit programme, and management review KPI dashboards — each is a first-class object with its own lifecycle and audit trail.

Every action everywhere checks the quality system state. A kiosk won't allow a dispense step if the assigned operator's cGMP training expired. A work order won't release to a station if the balance hasn't been calibrated this month. A lot can't be distributed if the QC review isn't signed. The system doesn't remind people to check these things; it enforces them.

21 CFR 111.14 requires that all written procedures be reviewed and approved by qualified individuals, that the same qualified individuals review and approve any modifications, and that all superseded procedures be retained. V5 ships a full Document Management System: hierarchical taxonomy (Quality Manual → Policy → SOP → Work Instruction → Form), site-configurable numbering rules, draft / in-review / effective / superseded / obsolete statuses, and a configurable workflow (author → SME → QA → site head). Read-acknowledgement assignments push each new or revised SOP to every affected role and block kiosk login until the operator has signed the read-and-understood.

Periodic review is calendar-driven — V5 raises a review task at the configured cadence (typically 12, 24, or 36 months), routes it to the document owner, and escalates if it slips. Change requests link to deviations, CAPAs, audit findings, or change controls so the 'why' is always inside the document history. Redlines are diff-tracked between versions; the audit trail captures who saw which revision, on which device, at what time.

21 CFR 111.12(c) requires that all personnel engaged in manufacturing, packaging, labelling, or holding operations have the education, training, or experience necessary to perform their assigned functions. V5 holds the training matrix as role × competency × currency. New operators get a curriculum auto-assigned on their first day: cGMP basics, gowning, sanitation, allergen awareness, site-specific SOPs, and equipment-specific qualifications. Completion is recorded with quiz scores, observation sign-offs from a qualified trainer, and a re-qualification interval. Competencies are linked to physical actions: weigh-out, blend, fill, IPC, line clearance, BPR review.

The kiosk enforces the matrix at the moment of action. An operator whose 'capsule-filling operation' competency expired yesterday cannot start a fill run today without requalification. Trainer qualifications are themselves competencies — only qualified trainers can sign off another operator's qualification record. Re-training is auto-scheduled when an SOP is revised, when a deviation root cause cites training, or when a metric (operator-attributable deviations, OOS frequency) trends adverse.

21 CFR 111 Subpart D establishes written specifications as the cornerstone of the quality programme: specifications for each component (identity, purity, strength, composition), for in-process materials at critical steps, and for the finished batch. V5 maintains a per-product, per-year Specifications Review workspace that continuously assembles batch disposition outcomes, in-process results with CpK and control charts, OOS investigations, identity test failure rates, component rejections, deviation categories and volumes, and SAE and complaint signals. At the annual review, QA adds narrative, signs off, and the workspace generates a complete review record.

GFSI-benchmarked sites (NSF, FSSC 22000, SQF) require an annual internal audit against the site's GMP programme. V5's audit module schedules and executes those audits — area scope, risk-based frequency, lead auditor assignment, finding classification (critical / major / minor / observation), and a CAPA chain for every finding. Findings stay open in the management dashboard until effectiveness is verified at the configured interval. The combination of the Specifications Review and the Annual Internal Audit gives the site the data and the documented review cycle that any NSF certification body or FDA investigator expects.

V5 holds the audit programme: scope (internal area, dietary ingredient supplier, contract manufacturer / co-man), risk-based frequency, lead auditor assignment, and a checklist library aligned to 21 CFR 111 subparts, NSF/ANSI 173, and applicable GFSI schemes. Audit execution captures findings inline with photographs, evidence references, classification, and immediate corrections. Co-manufacturer audits are a specific requirement when you manufacture under contract: V5's co-man module captures the audit record, the signed quality agreement, and the co-man's batch records — all accessible to the brand-owner and the contract-manufacturer roles with appropriate visibility controls.

Findings auto-route to the affected area, link to the CAPA workflow, and stay open in the management dashboard until effectiveness is verified. Regulatory inspections (FDA ORA investigators, state agencies, NSF certification auditors) use a dedicated Investigator Mode — read-only scoped view, one-click evidence export, and an inspection log capturing every document shown and every question asked. The inspection team can draft, review, and submit written responses from the same workspace.

21 CFR Part 117 (FSMA Preventive Controls for Human Food) applies to most dietary supplement manufacturers — particularly those who are not solely subject to 21 CFR 111. The rule requires a Food Safety Plan prepared or reviewed by a Preventive Controls Qualified Individual (PCQI), covering hazard analysis, preventive controls (process controls, allergen controls, sanitation controls, supply-chain controls), monitoring procedures, corrective actions, and verification. V5 holds the Food Safety Plan as a versioned, signed document: hazards identified by category (biological, chemical, physical, radiological), severity and likelihood scores, the assigned preventive control and CCP/OPRP classification, monitoring procedure and frequency, corrective action procedure, and verification activities.

V5 also holds FMEA-style risk assessments per product routing and supplier risk profiles. Risk scores drive sampling-plan depth, change-control templates, audit frequency, and validation effort. When residual risk crosses a configured threshold, V5 raises a CAPA automatically. The PCQI's annual re-analysis of the Food Safety Plan is scheduled; V5 assembles the prior year's CCP monitoring data, corrective actions, and verification results into the re-analysis workspace.

21 CFR 111.83 requires that dietary supplement manufacturers establish the shelf life of the finished product. That shelf life must be supported by stability data — typically based on potency, organoleptic properties, microbiological quality, and physical characteristics over the product's intended storage conditions. V5 hosts the stability programme per product / strength / packaging configuration: protocols (accelerated, intermediate, long-term), pull schedule auto-generated per condition × time point, sample inventory linked to the originating batch, and a trend engine that flags any result approaching its specification limit before it crosses.

Out-of-trend (OOT) results trigger an investigation; out-of-specification (OOS) stability results trigger a market-impact assessment and, if warranted, a shelf-life reduction, a label change, or a controlled recall workflow. Annual stability review assembles the prior year's results per product and feeds into the Specifications Review.

21 CFR 111 Subpart L requires written sanitation procedures for physical plant, equipment, utensils, and all food-contact surfaces; scheduled cleaning and sanitising; and regular monitoring to demonstrate the programme works. V5 implements these as first-class workflow objects. Sanitation event records include the surface or equipment cleaned, the sanitising agent and concentration, the operator, the contact time, and the verification result (visual inspection, ATP bioluminescence, microbiological swab). Results are linked to the equipment record; a surface that fails verification is quarantined until a re-clean passes.

For allergen control, V5 enforces an allergen-sequencing rule before any work order is released: if the prior run on the shared equipment train contained a major allergen (per FALCPA + FASTER Act) and the current run is allergen-free, a verified allergen-changeover procedure must be signed before the work order can start. Environmental monitoring (EM) for non-sterile supplement facilities covers air and surface microbiological sampling, with alert and action limits per zone; exceedances route to QA and are assessed against in-flight batches.

V5 manages the cleaning matrix: every product pair × shared equipment train, with the cross-contamination risk assessment (ingredient hazard, residue level, analytical detection limit, cleaning agent and procedure), the validated cleaning SOP, the swab and rinse sample plan, and the acceptance criteria. Changeover at the kiosk follows the protocol step by step; swab or rinse results return from the lab or the on-site ATP reader and a clean-status flag flips on the equipment before the next batch can be released to that train.

A released equipment train carries a 'clean window': if the next run isn't started inside it, V5 forces a re-clean or a documented hold-time extension. Periodic re-verification is calendar-driven and automatically re-triggered when a new product enters the shared equipment train or the cleaning SOP is revised. Cross-contamination risk is particularly acute in supplement facilities running botanical extracts, heavy-metal-active ingredients, or hormonal compounds — V5 carries explicit risk flags at the ingredient-master level for these categories.

21 CFR 111 Subpart H requires that all equipment and utensils used in manufacturing be calibrated according to written procedures, that calibration records be maintained, and that equipment of improper design or out-of-calibration not be used. V5 holds the asset register: equipment ID, location, manufacturer, model, qualification status (IQ/OQ/PQ with linked validation packs), calibration plan, PM plan, change history, and criticality classification. Calibration certificates are stored with as-found / as-left readings; any out-of-tolerance calibration triggers a back-look assessment against every batch touched by that instrument since the last successful calibration.

PM is scheduled by runtime hours, calendar, or condition (vibration levels, particle count for tablet presses, blade wear for grinders). Open PM work orders for an instrument prevent it from being assigned on a production routing. Spare-parts inventory is linked; minimum-stock levels for critical assets trigger a purchase requisition automatically. Decommissioning is a controlled workflow with data-archive and audit trail.

V5 ingests consumer complaints and adverse event reports from multiple channels: the product label phone number intake form, a customer portal, a CSM ticket, or an API from an external call-centre system. Each case opens with reporter demographics, product and lot code (look-up enforced against the ledger), symptom narrative, suspect ingredient attribution, and a severity and reportability assessment. The case auto-links to the BPR for the implicated batch and to any other open cases on the same lot — so a cluster of reports is visible before anyone manually searches for it.

For Serious Adverse Events, DSNDCPA and 21 CFR 111 Subpart O are unambiguous: the responsible person must submit a report to FDA within 15 business days of first receiving a report. V5 starts the 15-business-day clock on intake, prompts a structured case narrative, pre-populates the MedWatch 3500A with the product and lot data already in the ledger, and logs every edit, every reviewer sign-off, and every submission attempt. Annual summary SAE reports to FDA are generated from the same dataset — no separate extraction required. The submission audit trail is the evidence an FDA investigator needs to verify you met the mandatory reporting timeline.

Attributable — every action is bound to an identity-verified user account; every record carries the operator ID, role, and timestamp. Legible — every record renders in human-readable form on demand, with the original raw value retained alongside any transformation. Contemporaneous — actions write at the moment they happen, not at end-of-shift or end-of-batch. Original — raw instrument readings are captured from the instrument interface and retained; any derived value is calculated by the system, not hand-entered. Accurate — tolerances, calculations, and validation rules are codified in the MMR and enforced by the kiosk.

Plus: Complete (no fragmenting across spreadsheets or paper logs), Consistent (one ledger, one truth), Enduring (immutable append-only audit trail, timestamped, cryptographic hash on critical records), Available (queryable for the full 21 CFR 111.605 retention period — one year beyond shelf life). GAMP 5 Computer Software Assurance (CSA) is the validation posture — risk-based test coverage proportionate to patient/consumer impact, with a documented URS-to-test-evidence traceability matrix.

Supplier portal: COA uploads, qualification document maintenance, change notifications, and document acknowledgements. Customer portal: CoAs, lot pedigree, complaint submission, and document subscriptions. Co-manufacturer portal: brand-owner can see the co-man's BPRs and deviation status for their products; the co-man sees only their scope. QA dashboard: KPIs including right-first-time rate, OOS rate, identity test failure rate, SAE 15-day compliance rate, deviation cycle time, and CAPA closure rate. Management review: automated KPI assembly for the periodic management review meeting, with trend charts and exception summaries.

Investigator Mode is available for FDA ORA investigators, state agency inspectors, and NSF certification auditors — a read-only scoped view with one-click evidence export, an inspection log capturing every document shown and every question asked, and a real-time response workspace for the inspection team. Reports are generated from the live ledger, not built from an export. When an investigator asks 'show me the BPR for lot 2026-0412', the answer is a URL with a full, signed, immutable record — not a PDF assembled the night before.

Onboarding follows a fixed playbook: site discovery (product count, component library, existing SOPs, equipment register) → import of supplier master, ingredient master, and MMR library → role mapping and training matrix configuration → kiosk hardware list → identity testing method library configuration → validation pack tailored to your products and GAMP risk classification → operator training → go-live walk-through. Most sites are running first batches on V5 inside three weeks; full 21 CFR 111 programme migration completes inside a quarter.

Support is tiered: a 24/7 incident channel for floor-stopping issues, a dedicated CSM for adoption and change control, a regulatory advisor for FDA inspection prep and NSF/USP certification audit readiness, and a quarterly platform review to surface emerging risks and KPI drift. The regulatory advisor is a cGMP practitioner — not a sales engineer — with direct experience preparing dietary supplement facilities for 21 CFR 111 inspections.

This is the abbreviated mapping. Each link below opens the full readiness guide for that regulation. Touchpoint numbers refer to the nine touchpoints described in Sections 03–13 above.