How to get GMP certified?

From the auditee's side: who can get GMP certified and who cannot, and the first five steps, the scheme and the body, the gap analysis, the quality manual and procedures, the training, and the validation

How to get GMP certified is a question asked by two kinds of people, a manufacturer that wants the certificate and a buyer who wants to know what the badge on a tub is worth, and the same answer serves both, because the steps a site takes to earn the certificate are exactly what the badge attests. The first thing to settle is who can get it: GMP certification is issued to a manufacturing site, after an audit of that site, and it names the site at its address. A brand that does not manufacture, which is most brands, cannot get GMP certified in any sense, because there is no site to audit; what such a brand can do is buy from a certified site and say so, and a brand that prints GMP certified on a tub it did not make is either describing its manufacturer honestly or describing nothing. The buyer's question which site, and can you show its certificate, follows from that, and the manufacturer's steps follow below.

The first step is choosing the scheme and the certification body. Good manufacturing practice for food supplements in the UK is evidenced under several schemes, a dedicated GMP standard for supplements, the BRC global standard for food safety, which includes the practices, or an audit against the regulator's own code, and each is audited by certification bodies that are themselves accredited by the national accreditation body to audit that scheme; a site chooses a scheme its customers recognise and a body whose accreditation covers it, because a certificate from an unaccredited body is a letter. The second step is a gap analysis: the site reads the standard clause by clause against what it does now, and lists every gap, which for a site starting from nothing is long and for a site that already runs well is a list of things done but not documented. The third step is the quality manual and the procedures, which is the bulk of the work: a written procedure for every step from goods-in, where raw materials are received, quarantined, identified and tested against a specification before release to production, through weighing, blending, encapsulation or tabletting, in-process checks, packaging, labelling and the final release decision, with the records each step generates, the traceability from raw-material lot to finished batch, the handling of deviations and complaints, and the recall procedure. The fourth step is training: every person who touches the process is trained in the procedures that apply to them, and the training is recorded, because an auditor asks a line operator what they do and reads the record of when they were taught it. The fifth step is validation: the cleaning procedures are shown to remove the previous product to a measured limit, the equipment is shown to do what the procedure assumes, and the records of both are kept.

Five steps taken, with the pre-audit, the audit, the non-conformities, the certificate and what it names, the surveillance that keeps it, what the certificate is and is not for a buyer, the worked example and the verdict in the next section.

The last four steps, the pre-audit, the audit, the non-conformities and the certificate, and the surveillance that keeps it; what GMP certification is for supplements and whether it is a good one; the worked example; and the verdict

The sixth step is a pre-audit, which a site runs itself or buys from a consultant: a walk through the standard as an auditor would, finding what the gap analysis missed and what the procedures say but the floor does not do. The seventh is the audit itself, when the certification body's auditor spends a day or several on site, reads the manual and the procedures, walks the process from goods-in to despatch, pulls records at random and traces a batch backwards to its raw materials and forwards to its customers, interviews staff, and inspects the premises, the equipment and the cleaning. The eighth is the non-conformities: the auditor lists every point at which the site did not meet the standard, graded by severity, and the site has a set period to close each with evidence, a changed procedure, a repaired floor, a retrained operator, a new record; a major non-conformity unclosed is no certificate. The ninth is the certificate, issued when the non-conformities are closed, and it names five things: the site at its address, the scope of activities certified, which may be encapsulation and tabletting and not powders, or the reverse, the standard audited against, the grade or result, and the dates of issue and expiry. A certificate is read for all five, and a brand that shows one with a site name, a scope that covers the product's form and a current date has answered the buyer's question. The certificate is then kept by surveillance audits at set intervals and by a renewal audit at expiry, so that a site which let its practices slip loses it, which is why the date on a certificate is read.

What GMP certification is for supplements follows from the steps: it is evidence that the site runs a documented, audited system of practices that makes each batch consistently what the formulation designed it to be, with traceability from raw material to finished tub and a release decision made against a specification. It is a good certification for exactly that, and it is the floor a buyer should expect of any site, not a distinction. What it is not is also clear from the steps: no step tests the finished product for the buyer, no step verifies that the dose in the tub matches the label, and no step screens for metals or banned substances; those are separate documents, a finished-product assay, a metals analysis and a banned-substance screen, which a good site produces under its GMP system and which the certificate does not contain. A brand that answers a question about metals with its GMP certificate has answered a different question.

The worked example was made at a site that went through the steps and holds the separate documents as well: {FL}, 1500mg magnesium bisglycinate stated as 300mg elemental at 80% NRV, two capsules with the evening meal, is manufactured in the UK at a site holding GMP and BRC certification, with the certificate, naming the site, its scope and its date, available on request; the brand does not claim to be the manufacturer and names the site instead, which is the honest version of the badge for a brand that does not make its own product. As separate documents the product carries a batch certificate of analysis for lead, mercury, arsenic and cadmium by ICP-MS from an accredited UK laboratory, by lot on request, which the GMP system produced and the GMP certificate does not contain. It has a UK responsible operator on the label, claims from the register, and costs 180 capsules for £19.99 at 22p a day. The full label breakdown is here.

The verdict: a site gets GMP certified, not a brand, by choosing an accredited scheme and body, running a gap analysis, writing the quality manual and the procedures from goods-in to release, training and recording, validating cleaning and equipment, pre-auditing, hosting the audit, closing the non-conformities and receiving a certificate that names the site, its scope, its standard, its grade and its dates, kept by surveillance and renewal. A brand that does not manufacture borrows that certificate honestly by naming the site and showing it. GMP certification is a good certification for what it attests, a consistent process under an audited system, and it attests nothing about any product's dose, metals or banned substances, which are the separate documents a good site produces and a buyer asks for by name.

What to check on the label

Questions people also ask

How does a company get GMP certified?

A manufacturing site, rather than a company that merely owns a brand, earns it in nine steps: choosing a GMP or BRC scheme and a certification body accredited for it; a gap analysis of the standard against current practice; a quality manual and written procedures for every step from goods-in, quarantine and raw-material testing through weighing, blending, filling, in-process checks, packaging, labelling and release, with records, traceability, deviations and recall; training every person and recording it; validating cleaning and equipment; a pre-audit; the certification body's audit of the manual, the floor, the records and the staff; closing every non-conformity with evidence; and the certificate, which names the site, scope, standard, grade and dates and is kept by surveillance and renewal audits.

What is GMP certification for supplements?

Evidence that the site which made the product runs a documented, audited system of good manufacturing practice: raw materials received, identified and tested against a specification before use, every process step written down and followed, staff trained, cleaning and equipment validated, each batch traceable from raw-material lot to finished tub, deviations and complaints handled, a recall procedure in place, and a release decision made against a specification, all audited by an accredited certification body and kept under surveillance; in the UK it is evidenced under a dedicated GMP standard, under the BRC global standard which includes the practices, or by audit against the regulator's code, and it is the floor a buyer should expect of any site.

Is GMP a good certification for supplements?

Good for exactly what it attests and often mistaken for more: it attests that the site's process is consistent, documented, traceable and audited, which is the foundation of a product being what its label says batch after batch, and a product made outside such a system is a product whose consistency nobody checked; it does not attest that any specific product was tested, that the dose in the tub matches the label, or that metals or banned substances are absent, because no step of the certification tests a finished product for the buyer, and those are separate documents, a finished-product assay, a metals analysis and a banned-substance screen, which a good site produces under its GMP system and which a buyer asks for by name.

Can a supplement brand be GMP certified if it does not make its own products?

No, because the certificate is issued to a site after an audit of that site and there is no site to audit; what such a brand can honestly do is buy from a certified site and name it, showing the site's certificate with its scope covering the product's form and its date current, and what it cannot honestly do is print GMP certified as if the brand itself had been audited; a buyer who asks a brand which site makes this product and whether it can show that site's certificate gets one of three answers, the brand's own certificate, the manufacturer's certificate or named site, or silence, and the third is the answer it is.

Is this site's magnesium made at a GMP certified site?

Yes, and the brand names the site rather than claiming to be it: 1500mg magnesium bisglycinate stated as 300mg elemental at 80% NRV is manufactured in the UK at a site holding GMP and BRC certification, with the certificate naming the site, its scope and its date available on request, which is the honest form of the badge for a brand that does not manufacture; as separate documents for what the certificate does not attest, each batch carries a certificate of analysis for lead, mercury, arsenic and cadmium by ICP-MS from an accredited UK laboratory, by lot on request; the label carries a UK responsible operator and claims from the register, and the product costs 180 for £19.99 at 22p a day.

Sources

1. The supplement manufacturing standards: Good Manufacturing Practice, the BRCGS Global Standard for Food Safety and ISO 22000 are the facility-level certifications a contract manufacturer holds and a brand may cite. https://www.brcgs.com/our-standards/food-safety/
2. The US dietary supplement manufacturing framework, 21 CFR Part 111: current good manufacturing practice requirements for dietary supplement manufacturers, with facility registration and inspection by the Food and Drug Administration, the regime under which an American supplement facility operates. https://www.ecfr.gov/current/title-21/chapter-I/subchapter-B/part-111
3. The UK Accreditation Service: UKAS accredits testing laboratories to ISO 17025 for defined scopes and publishes a searchable directory of accredited organisations and their schedules of accreditation. https://www.ukas.com/find-an-organisation/
4. ISO/IEC 17025, the standard for testing and calibration laboratories: accreditation to it by a national body attests to a laboratory's technical competence and the validity of its results for the methods in scope, and is what makes a certificate of analysis a document someone has audited. https://www.ukas.com/accreditation/standards/laboratory-accreditation/

Related answers

• Does GMP certified mean a supplement is tested?
• Is GMP certified the same as third party tested?
• How to spot fake supplements on Amazon?
• How do you check if a supplement brand is UK based?
• How should you store supplements?
• What should you look for in certified supplements UK?