Does GMP certified mean third-party tested?

Third party to what: why the same two words name two different parties doing two different things, the certification body that audits a site and the laboratory that tests a lot, and what each one's certificate is about

Does GMP certified mean third-party tested is a question that sounds like it should answer itself, because both phrases contain a third party, and the honest answer begins by asking the question the phrases leave out: third party to what. A third party is someone who is neither the brand nor the buyer, and in each phrase there is one, but the two are different organisations doing different things to different objects, and once the objects are named the two phrases stop looking alike. In GMP certification the third party is a certification body, and what it does is audit: its auditor visits a manufacturing site, reads the quality manual and the procedures, pulls records and traces batches, interviews staff, inspects premises, equipment and cleaning, lists non-conformities and, when they are closed, issues a certificate. The object of that certificate is the site. It names the site at its address, the scope of activities certified, the standard, the grade and the dates, and it says that this site runs a documented, audited system of practices that would produce a consistent product. It does not name a product, a lot or an analyte, because none was examined; a GMP auditor does not take a sample to a laboratory.

In third-party testing the third party is a laboratory, and what it does is analyse: a sample from a specific production lot is submitted with a request naming the analytes, the laboratory prepares it, runs the method on its instruments, and issues a certificate of analysis. The object of that certificate is the lot. It names the product and its lot number, the analytes and their measured values, the method and its limits, the laboratory and its accreditation number, and the date, and it says that this lot, when sampled, contained these amounts of these things. It does not name a site, a procedure or a quality system, because none was examined; a laboratory analyst does not visit a factory. GMP certified therefore means third-party audited, which is a real and valuable attestation about a site; it does not mean third-party tested, which is a different attestation by a different third party about a different object, and a brand that answers a question about testing with its GMP certificate has produced the right kind of document about the wrong thing.

The distinction matters because the two can come apart. A site that passed its audit can release a lot that fails a test, through a raw material that arrived contaminated and was passed on a supplier's certificate, through a weighing error inside the tolerance of the procedure but outside the label's, through a stability failure the system did not predict; the audit asked whether the system would produce a consistent product, and the test asks what this lot contains, and the second is the only one that measures the tub. Equally, a lot that passed a test can come from a site that would fail an audit, by luck, and the next lot may not; the test asked about one sample, and the audit asks whether the next sample is likely to match. Each document answers its own question and neither answers the other's.

The two parties and their two objects named, with the two certificates set side by side on five lines, the two accreditations behind them, why a good product holds both, the worked example holding both and the verdict in the next section.

The two certificates side by side on five lines; the two accreditations behind the two third parties and where each appears on the national register; why a good product holds both and why each is worth nothing as a substitute; the worked example; and the verdict

Side by side, the two certificates differ on every line. On the object: a site at an address, against a product at a lot number. On what was examined: procedures, records, premises, equipment, staff and traceability, against a sample's prepared extract or digest. On the question asked: would this system produce a consistent product, against what does this lot contain. On the result: a certificate with a scope, a standard, a grade and an expiry, maintained by surveillance audits, against a certificate with analytes, measured values, methods, limits of quantification and a date, valid for that lot only. On who issued it: a certification body, against a laboratory. A buyer who holds one and is asked about the other has the wrong document, and a brand that offers one in place of the other has either misunderstood the question or hoped the buyer would.

Behind each third party stands an accreditation, and the two are as different as the parties. A certification body that audits sites against a GMP or BRC standard is itself accredited by the national accreditation body to run that certification scheme, under the international standard for bodies certifying management systems and products, and appears on the national register as a certification body with the schemes it is accredited for; a GMP certificate from a body not on that register is a letter. A laboratory that tests samples is accredited by the same national body under the international standard for testing laboratories, and appears on the register as a laboratory with a schedule of methods by analyte and matrix; a certificate of analysis from a laboratory not on that register, or for a method not on its schedule, is a document from an unaccredited source. The two accreditations sit under different standards on different schedules, and a buyer checks each third party on the register for the thing it claims to have done, the body for the scheme and the laboratory for the method.

A good product holds both, and the reason is that the two documents cover each other's blind spot. The site certificate makes consistency likely, because a documented, audited system with traceability and release testing is the thing that makes the next lot match the last; the lot certificate measures the result, because only an analysis of a sample says what is in the tub. The site certificate without the lot certificate is a promise about process with no measurement of outcome; the lot certificate without the site certificate is a measurement of one sample with no reason to expect the next to match. Each is worth a great deal with the other and nothing as a substitute for it. The worked example holds both and is placed as holding both: {FL}, 1500mg magnesium bisglycinate stated as 300mg elemental at 80% NRV, two capsules with the evening meal, is manufactured in the UK at a site holding GMP and BRC certification from an accredited certification body, the site certificate naming the site, scope and date on request, which is the third-party audit; and each lot is tested for lead, mercury, arsenic and cadmium by inductively coupled plasma mass spectrometry at a UK laboratory on the national accreditation register, the lot certificate naming the lot, the four metals, the method, the limits and the date on request, which is the third-party test. The brand names the site rather than claiming to be it and names the laboratory rather than describing it; 180 capsules for £19.99 at 22p a day. The full label breakdown is here.

The verdict: GMP certified does not mean third-party tested, because the two phrases name two third parties doing two things to two objects. In GMP certification a certification body audits a site and certifies the site, which is third-party audited; in third-party testing a laboratory analyses a lot and certifies the lot, which is third-party tested. The two certificates differ on every line, the two accreditations sit under different standards on the national register, and a good product holds both, the site certificate for the likelihood of consistency and the lot certificate for the measurement of the result. A buyer asks for each by name and accepts neither in place of the other.

What to check on the label

Questions people also ask

Is GMP certification the same as third-party testing?

No, though both involve a third party: in GMP certification the third party is a certification body whose auditor examines a manufacturing site's procedures, records, premises, equipment and staff and issues a certificate about the site, which is third-party audited; in third-party testing the third party is a laboratory that analyses a sample from a specific lot and issues a certificate of analysis about that lot, which is third-party tested; the audit asks whether the system would produce a consistent product and the test asks what this lot contains, a site can pass the first with a lot that fails the second, and a good product holds both documents because each covers the other's blind spot.

Does GMP certification involve testing the product?

Not by the certification body: a GMP auditor reads the quality manual and procedures, pulls records, traces batches backwards and forwards, interviews staff and inspects the premises, equipment and cleaning, and takes no sample to a laboratory, so the certificate names a site, a scope, a standard, a grade and dates and no product, lot or analyte; the GMP system itself requires the site to test raw materials at goods-in and to release each batch against a specification, so a certified site does test, but those are the site's own tests under its own system, and the third-party test of a lot is a separate certificate from a separate laboratory that a buyer asks for by lot.

What is the difference between a GMP certificate and a certificate of analysis?

The object and the issuer: a GMP certificate is issued by a certification body about a manufacturing site, naming the site at its address, the scope of activities certified, the standard, the grade and the dates, and is maintained by surveillance audits; a certificate of analysis is issued by a laboratory about one lot of one product, naming the lot, the analytes and their measured values, the method and its limits of quantification, the laboratory and its accreditation number, and the date, and is valid for that lot only; a buyer checks the certification body on the national register for its scheme and the laboratory for its method, and reads each certificate for its own lines, since neither says anything the other does.

Is a GMP certified supplement safe?

More likely to be consistent than one made outside such a system, which is what the certificate attests, and not thereby measured for anything: the site's documented, audited practices, traceability and release testing make the next lot likely to match the last, and a product made at an uncertified site is one whose consistency nobody has checked; but safety for a specific lot is a measurement, the four metals against the contaminant limits, the microbial panel, the assay against the label, which only a laboratory's certificate of analysis for that lot gives, so a buyer reads the GMP certificate as the likelihood of consistency and asks for the lot certificate as the measurement, and treats neither as the other.

Does this site's magnesium have both a GMP certificate and third-party testing?

Yes, both, and the brand names the third parties rather than claiming to be them: 1500mg magnesium bisglycinate stated as 300mg elemental at 80% NRV is manufactured in the UK at a site holding GMP and BRC certification from an accredited certification body, with the site certificate naming the site, scope and date available on request, which is the third-party audit; and each lot is tested for lead, mercury, arsenic and cadmium by inductively coupled plasma mass spectrometry at a UK laboratory on the national accreditation register, with the lot certificate naming the lot, the four metals, the method, the limits and the date available on request, which is the third-party test; 180 for £19.99 at 22p a day.

Sources

1. The supplement manufacturing standards: Good Manufacturing Practice, the BRCGS Global Standard for Food Safety and ISO 22000 are the facility-level certifications a contract manufacturer holds and a brand may cite. https://www.brcgs.com/our-standards/food-safety/
2. The UK Accreditation Service: UKAS accredits testing laboratories to ISO 17025 for defined scopes and publishes a searchable directory of accredited organisations and their schedules of accreditation. https://www.ukas.com/find-an-organisation/
3. ISO/IEC 17025, the standard for testing and calibration laboratories: accreditation to it by a national body attests to a laboratory's technical competence and the validity of its results for the methods in scope, and is what makes a certificate of analysis a document someone has audited. https://www.ukas.com/accreditation/standards/laboratory-accreditation/
4. The heavy metals analysis literature: inductively coupled plasma mass spectrometry is the standard method for quantifying lead, cadmium, mercury and arsenic in dietary supplements against regulatory maximum levels. PubMed record

Related answers

• Does GMP certified mean a supplement is tested?
• What does third-party tested actually mean for supplements?
• Is GMP certified the same as third party tested?
• What are the best third party tested supplements?
• What are some reputable, third-party tested supplement brands in the UK?
• What should you look for in list of third-party tested supplements?