Good Manufacturing Practice verification is an independent audit that confirms a production facility meets the federal quality standards for its industry, ending in a formal certificate that identifies the site and the products it covers. The audit looks at three things at once: the physical facility, the way work actually gets done on the floor, and the documentation that proves those conditions hold every time a product is made. The specific rules differ by product type, but the underlying question the auditor asks is always the same. Does what happens here match what the regulations require, batch after batch?
Which GMP Rule Applies to Your Product
Federal GMP requirements attach to any industry where a manufacturing defect could directly harm a consumer, and the applicable regulation depends on the product.
Drug manufacturers work under 21 CFR Part 211, which sets minimum GMP standards for finished pharmaceuticals intended for humans or animals and covers building design, equipment, laboratory controls, and record-keeping.1eCFR. 21 CFR Part 211 – Current Good Manufacturing Practice for Finished Pharmaceuticals It is the oldest GMP framework and is often used as a reference point for the others.
Dietary supplement manufacturers, packagers, labelers, and holders follow 21 CFR Part 111, which defines quality as consistently meeting specifications for identity, purity, strength, and composition, and requires at least one test to verify the identity of every dietary ingredient used.2eCFR. 21 CFR Part 111 – Current Good Manufacturing Practice in Manufacturing, Packaging, Labeling, or Holding Operations for Dietary Supplements3Food and Drug Administration. Small Entity Compliance Guide – Current Good Manufacturing Practice for Dietary Supplements
Human food facilities operate under 21 CFR Part 117, the Food Safety Modernization Act framework, which requires a written food safety plan, a hazard analysis, and risk-based preventive controls.4eCFR. 21 CFR Part 117 – Current Good Manufacturing Practice, Hazard Analysis, and Risk-Based Preventive Controls for Human Food5eCFR. 21 CFR Part 820 – Quality Management System Regulation6Food and Drug Administration. Modernization of Cosmetics Regulation Act of 20227Food and Drug Administration. Registration and Listing of Cosmetic Product Facilities and Products
Facility size does not change which rule applies. A small-batch supplement company carries the same basic GMP obligations as a multinational drug maker, though inspection frequency and enforcement priorities are set by risk.
The Documentation That Decides the Audit
GMP verification lives and dies in the paperwork. An auditor can walk into a clean facility staffed by skilled workers and still fail it if the records do not prove that those conditions hold every day. The documents are the evidence.
Standard Operating Procedures describe how every critical task is done, specifically enough that any trained employee can follow them and get the same result. Master Manufacturing Records act as the blueprint for each product, listing ingredients, quantities, processing steps, and in-process checkpoints. Every batch generates a batch production record with the actual measurements, times, and operator signatures at each step, and those records must line up with the master.
Around that core sit the environmental and personnel records: sanitation logs, equipment calibration records, temperature and humidity readings, water quality test results, and training files showing that each employee is qualified for the tasks they perform. For drug manufacturers, 21 CFR 211.180(e) specifically requires records maintained in a way that supports at least an annual evaluation of quality standards for each drug product.8eCFR. 21 CFR 211.180 – General Requirements
Raw material traceability is where audits often break down. Every incoming ingredient needs a receipt record, a supplier certificate of analysis, and a clear chain of documentation from arrival through production to finished product. If a contamination issue surfaces six months later, you have to trace backward from the affected batch to the specific lot of every raw material used. Facilities that cannot do this quickly during the audit itself pick up serious findings.
Auditors expect several months of consistent, dated entries. A quality system hastily assembled the week before the visit is easy to spot. Missing signatures, gaps in daily logs, and incomplete deviation investigations are among the most common findings that delay or block certification.
How the Audit and Certification Work
The visit itself follows a predictable sequence, whether the auditor is from the FDA, a third-party certification body, or a customer conducting a supplier audit.
An opening meeting sets the scope and schedule. Then the auditor walks the facility, observing production in real time, checking equipment condition and hygiene practices, and looking for anything that contradicts what the written procedures say. This is where undocumented process steps, gowning lapses, and expired calibration stickers surface. After the walkthrough, the auditor moves to the documentation review, cross-referencing batch records against SOPs, checking sanitation and calibration logs for gaps, and comparing training records against the people actually on the floor. How the facility handles deviations and out-of-specification results gets particular attention, because that is where a quality system is actually tested.
A closing meeting summarizes what the auditor found. Deviations are written up in an audit report and classified by severity. Critical findings pose direct risk to product safety. Major findings indicate systematic failures in the quality system. Minor findings are isolated lapses. Critical or major findings usually have to be corrected before a certificate can issue.
Once corrective actions are verified, the certifying body issues a GMP certificate identifying the facility address and the scope of products covered. In the European Union, authorities must issue a certificate within 90 days of an inspection that finds the facility compliant, and a certificate should not be relied on if more than three years have passed since the underlying inspection.9European Medicines Agency. The Issue and Update of GMP Certificates Third-party programs in the United States set their own validity periods, often one to three years before a full re-audit.
Audit fees depend on facility size, product complexity, and the length of the site visit. Regulated-industry audits generally run higher because the auditors need specialized expertise and the reports have to meet stricter standards. USDA’s Agricultural Marketing Service offers food GMP audits at published rates,10Agricultural Marketing Service. Good Manufacturing Practices Audits while private third-party audits for small to mid-sized facilities commonly run into the low thousands, with large multi-product sites paying substantially more.
A Note for Medical Device Manufacturers
Device makers have an option the other industries do not. The Medical Device Single Audit Program (MDSAP) lets one audit by a recognized auditing organization satisfy the regulatory requirements of the FDA, Health Canada, Australia’s Therapeutic Goods Administration, Brazil’s health surveillance agency, and Japan’s regulators at the same time.11Food and Drug Administration. Medical Device Single Audit Program The FDA may accept an MDSAP report in place of a routine agency inspection, which can meaningfully reduce the audit load for manufacturers selling into multiple markets.
What Happens If You Fail
FDA enforcement follows a clear escalation path, and where you sit on that path determines what options you still have.
When an investigator observes conditions during an inspection that may violate the Federal Food, Drug, and Cosmetic Act, the agency issues a Form 483 at the end of the visit. A 483 is not a final finding that violations occurred; it lists observations and gives you a chance to respond in writing with a corrective action plan.12Food and Drug Administration. FDA Form 483 Frequently Asked Questions The response matters. A credible, thorough plan can end the matter at this stage. A dismissive or incomplete response accelerates things.
If the observations are not adequately addressed, the FDA may escalate to a Warning Letter. This is a formal notice that the agency views the violations as significant enough to warrant further action if uncorrected. Warning letters are public, so the reputational damage begins immediately on posting.
Beyond warning letters, the FDA can ask a federal court to seize adulterated products, even without direct evidence of a specific defect, if manufacturing conditions violate GMP requirements. The agency can also seek an injunction ordering the company to stop manufacturing until it demonstrates compliance. Both routes typically end in court orders requiring facility repairs, additional testing, improved training, and ongoing monitoring.13Food and Drug Administration. Facts About the Current Good Manufacturing Practice
The most severe outcome is a consent decree of permanent injunction, obtained by the FDA working with the Department of Justice. A consent decree effectively shuts down manufacturing until the company satisfies specific conditions: products receive any required FDA authorization, the FDA inspects the facility and finds it compliant, and the agency notifies the company in writing that it appears to be in compliance.14Food and Drug Administration. Federal Court Enters Consent Decree Against Philips Respironics Getting out from under one can take years and cost millions in facility upgrades, independent expert reviews, and lost revenue. Criminal prosecution, with fines and jail time, is also possible for GMP violations.
Keeping the Certificate Valid
A GMP certificate is the start of the obligation, not the end.
Third-party certification programs typically require re-audits on a set schedule, often annually. The FDA uses a risk-based approach for its own inspections, prioritizing facilities by compliance history, product risk, and whether the site has been inspected in the past four years.15Food and Drug Administration. FDA Risk-Based Approach to Inspections For food facilities, FSMA mandates inspections every three years for high-risk domestic facilities and every five years for non-high-risk ones. A clean track record may lengthen the interval between FDA visits, but absence of an inspection is not absence of oversight.
Pharmaceutical manufacturers have a specific ongoing task. 21 CFR 211.180(e) requires written records that support at least an annual evaluation of quality standards for each drug product, covering a representative number of approved and rejected batches, complaints, recalls, returned products, and investigations conducted during the period.8eCFR. 21 CFR 211.180 – General Requirements The point is to catch trends that indicate the process or specifications need updating. Skipping or rushing this review is one of the more common findings in pharmaceutical GMP inspections and signals that a facility’s quality system is reactive.
Significant changes to the manufacturing process, facility layout, equipment, or key management personnel need to be documented and, depending on the certification program, reported to the certifying body. Unreported changes are a common trigger for suspension. One major certifier explicitly lists failure to keep the management system aligned with the current organization and processes as grounds for suspending a certificate.16DNV. Procedure for Suspension and Withdrawal of Certificate
Complaint tracking and recall records get similar scrutiny at re-audit. Auditors read them to see whether the facility identified root causes and put effective corrective actions in place. A pattern of repeat complaints about the same issue is one of the clearest indicators that a quality system is not doing its job, and it is the kind of finding that turns a routine re-audit into a serious problem.