What GMP is, and what "GMP certification" really means
Good Manufacturing Practice is a set of rules for how products are made, tested, stored and released, so that every batch is consistently safe and of the intended quality. It covers premises, equipment, people, hygiene, raw materials, documentation, complaints and recalls.
In many countries GMP is a legal requirement enforced by the regulator, not a voluntary badge. In the US, the FDA sets current GMP (CGMP) rules for drugs, dietary supplements and food, and inspects facilities, including foreign ones that export to the US. The FDA does not issue certificates approving a facility as a whole. When buyers ask for "GMP certification", they usually mean either a regulator's licence or inspection outcome, or a certificate from an independent certification body that audited you against a GMP standard.
Who this is for
- Food and beverage processors preparing for customer audits or export.
- Dietary supplement and nutraceutical manufacturers selling into the US.
- Cosmetics makers whose retailers ask for ISO 22716 or GMP evidence.
- Pharmaceutical and API manufacturers upgrading to current regulator expectations.
- Contract manufacturers whose clients audit them before placing orders.
The rules that usually apply
| Product | US rules | Other common references |
|---|---|---|
| Human drugs | 21 CFR Parts 210 and 211 | WHO GMP, EU GMP, India's revised Schedule M |
| Dietary supplements | 21 CFR Part 111 | Third-party supplement GMP programmes |
| Human food | 21 CFR Part 117 (CGMP and preventive controls) | Codex hygiene principles, ISO 22000 |
| Cosmetics | GMP regulations required by MoCRA, not yet final | ISO 22716 |
Two points are time-sensitive. For cosmetics, MoCRA required the FDA to issue GMP regulations, but as of 2026 final regulations have not been issued and the rulemaking has slipped well past its statutory deadline, so many manufacturers follow ISO 22716 and FDA's existing cosmetic GMP guidance in the meantime. In India, the revised Schedule M came into force for larger drug makers first, and the extended deadline for smaller units ended on 31 December 2025, with regulators now inspecting against it.
What BookMyLLC handles
- A gap assessment of your facility and documents against the rules that apply to your product and market.
- A review of facility layout, material and personnel flow, and cleaning zones.
- Standard operating procedures for production, cleaning, calibration, sampling, release and complaints.
- Document control, batch records and deviation and CAPA procedures.
- GMP training for production, quality and warehouse staff.
- An internal audit and mock inspection before the real one.
- Support during the regulator inspection or certification body audit.
Step-by-step process
- Define scope. Products, markets, and which regulator or standard you need to satisfy.
- Gap assessment. We visit or review remotely, then report gaps by risk.
- Fix the facility. Layout, hygiene and equipment changes are planned and scheduled.
- Write the system. SOPs, forms and batch records are drafted with your team, not for them.
- Train and run it. Staff are trained and the system runs long enough to generate real records.
- Audit. An internal audit and mock inspection close remaining gaps.
- Inspection or certification. The regulator inspects, or you engage an accredited certification body, and we support you through it.
What an inspector or auditor looks at
Inspections follow the product. An auditor usually picks a recent batch and traces it backwards and forwards: which raw materials went in and whether they were tested, who made it and whether they were trained, which equipment was used and whether it was clean and calibrated, what the batch record says, and how the batch was released and shipped.
Along the way they look at the building, the flow of people and materials, pest control, water quality, labelling, returns and complaints. Gaps between what an SOP says and what staff actually do are among the most frequent findings. So are missing signatures, corrected entries without explanation, and deviations that were never investigated.
Choosing a certification body
If you need a third-party GMP certificate rather than a regulator inspection, choose a certification body that is accredited for the standard and product category, and check that your customers accept it. Some large retailers and importers only accept specific schemes. A certificate from an unrecognised body can cost as much as a credible one and still be rejected by the buyer who asked for it.
Documents and information you need
- Product list, formulas or specifications, and target markets.
- Site plan and equipment list.
- Existing procedures, records and licences.
- Supplier list and incoming material specifications.
- Recent customer or regulator audit reports, if any.
Timeline
For a small facility with basic controls in place, building and running a GMP system to audit readiness typically takes a few months. Facility changes and the need for several months of records before an audit are usually the longest steps.
Common mistakes to avoid
- Buying a certificate without a system. A certificate from a body that did not audit your site properly will not satisfy a serious buyer or regulator.
- Copying another company's SOPs. Procedures must describe what your staff actually do, on your equipment.
- Records written after the fact. GMP requires records made at the time of the activity.
- Ignoring suppliers. Your GMP is only as good as the materials coming in.
- Treating GMP as a one-off project. Regulators and auditors return, and they expect the system to have been running, reviewed and improved since their last visit.
This is general information on GMP frameworks, not regulatory advice for your product. Your regulator's current rules take priority. Food businesses often combine GMP with ISO 22000 food safety management, and many manufacturers add ISO 9001 or ISO 14001. Book a call to scope your facility.
GMP at a glance
| Question | Short answer |
|---|---|
| What it is | Good Manufacturing Practice: controls that keep products consistently safe and of the intended quality. |
| Applies to | Food, supplements, cosmetics and pharmaceuticals, under different rules in each sector. |
| Certificate | Issued by a certification body or accepted by a regulator, depending on the sector. |
| Core elements | Premises, equipment, people, documentation, production control and complaints. |
| Typical effort | A few months for a small facility. |
What an inspector looks at
| Area | Example evidence |
|---|---|
| Premises and equipment | Layout, cleaning, maintenance logs |
| Personnel | Training records and hygiene practices |
| Documentation | Specifications, batch records, procedures |
| Production control | Checks at each stage |
| Complaints and recalls | A working process |
| Suppliers | Approval and testing of materials |
Which rules apply depends on what you make and where you sell. We confirm the sector rules first, then build the system around them.
Choosing a certification body
- Check that it is recognised for your sector and your target markets.
- Ask what it charges for the audit and for surveillance visits.
- Ask how long it has audited businesses of your size.
- Confirm it will audit the standard your customers expect.
We help you prepare, but we are not the certification body, and we do not decide whether you pass. An independent audit is what gives the certificate its value.
Records you will need to keep
| Record | Purpose |
|---|---|
| Batch records | Show how each batch was made and checked |
| Cleaning and maintenance logs | Prove equipment is controlled |
| Training records | Show people know their tasks |
| Supplier approvals | Show materials come from checked sources |
| Complaint and recall records | Show you act on problems |
