What actually gets written up in a GMP audit, and how serious is it?

Settle which one is in front of you first, because it decides what you do next. The two do not reach you on the same terms, and a rule from one is routinely quoted at the other.

What this page covers, and what it does not. It reads two things: the certification audit run under NSF/ANSI 455-2, which is the dietary supplement standard in the NSF 455 family, and the federal inspection of a dietary supplement operation. If you make a cosmetic or an over-the-counter drug, that family carries a separate standard for your category and this page reads neither; if you make a conventional food, an animal food or a drug, neither the standard nor the federal rule below is yours. A certification audit under this standard is also not the only audit you can be asked to take. A retail customer’s own audit, and the other certification schemes a customer may name, run to their own rules and are not covered here.

A certification audit under NSF/ANSI 455-2 reaches you because you asked for it. You submit an application to a certification body, which is an independent audit company, and an audit counts toward this standard only where that body is recognized and approved by the American National Standards Institute (NSF/ANSI 455-2, 5.4.1; 5.3.3). The standard is not United States law. It is a scheme built to audit a dietary supplement operation against 21 CFR Part 111 and against retailer requirements layered on top of it (NSF/ANSI 455-2, 1.2). Meeting the standard is also not the same as being certified to it: the standard’s informative annex says that conforming to it does not on its own mean you are certified, and that annex marks itself as not part of the American National Standard (NSF/ANSI 455-2, Informative Annex 1). If you never apply, no certification body writes anything about you.

Certification also attaches to a site rather than to a company. The audit scope is site or campus specific, exclusions of products or processes from that scope are permitted, and the scope and any exclusions are written into the audit plan, the audit report and the certificate itself (NSF/ANSI 455-2, 5.3.4). The certification body’s official listing names the company, the facility address, the facility type — contract manufacturer, manufacturer, packaging or distribution — and the exclusions and limitations (NSF/ANSI 455-2, 5.8.4). A certificate is never a statement about everything a company does, and reading one means reading its exclusions.

An FDA inspection does not wait to be invited. Officers or employees designated by the Secretary may enter, at reasonable times and on credentials and written notice, any factory, warehouse or establishment in which food is manufactured, processed, packed or held, either for introduction into interstate commerce or after it, and may enter a vehicle being used to transport or hold such food in interstate commerce, and inspect what they enter (21 U.S.C. 374(a)(1)). A dietary supplement is deemed to be a food for the whole Act except for two purposes the definition names, the drug definition and the reportable food registry section, and neither of them is inspection (21 U.S.C. 321(ff)). The federal good manufacturing practice rule reaches you if you manufacture, package, label or hold a dietary supplement, and it names two cases people assume are outside it: a supplement you manufacture that somebody else packages or labels, and a supplement imported or offered for import (21 CFR 111.1(a); 111.1(a)(1); 111.1(a)(2)). The rule states one exception and it is narrow. It lifts the holding requirements only, and only from a retail establishment holding for the sole purpose of direct retail sale to individual consumers — and the same clause says a retail establishment does not include a warehouse or other storage facility for a retailer, or one that sells directly to individual consumers (111.1(b)).

One of these you can decline, though declining is rarely free. The standard exists to audit Part 111 plus retailer requirements layered on top (NSF/ANSI 455-2, 1.2), and it is usually a customer, not a regulator, who puts the audit on your calendar. The federal inspection you cannot decline.

The two events side by side: who runs each, what gets written, and what follows from it.

	Certification audit	FDA inspection
Who runs it	A certification body, an independent audit company, recognized and approved by ANSI (NSF/ANSI 455-2, 5.1; 5.3.3)	Officers or employees designated by the Secretary, on credentials and written notice (21 U.S.C. 374(a)(1))
Why it happens	You submitted an application for certification (NSF/ANSI 455-2, 5.4.1)	For enforcement of the Act (21 U.S.C. 374(a)(1))
What gets written	Findings naming specific procedures, practices and production lots, drawn from the auditor’s detailed notes (NSF/ANSI 455-2, 5.5.6)	A written report, handed over before the investigator leaves, of conditions or practices that in his judgment indicate filth or insanitary conditions (21 U.S.C. 374(b)(1))
How severity is set	One of three levels, on the auditor’s judgment, then evaluated by an independent technical reviewer (NSF/ANSI 455-2, 5.5.9; 5.6.2)	That subsection sets no levels. It commands the report and names what belongs in it (21 U.S.C. 374(b)(1))
What follows	A grade, from the number and severity of the nonconformances, and a certification decision (NSF/ANSI 455-2, 5.6.3; 5.7.3)	No grade and no certificate. FDA’s published record classifies the inspection as a whole

What the auditor is actually writing down

Findings have to be specific. The standard asks the auditor to name the particular procedure, the particular practice, the particular production lot, and to make detailed notes of every finding and observation during the audit. Those notes are the basis of the report (NSF/ANSI 455-2, 5.5.6). The auditor also raises observations and findings with the site host at the time they are made, and verifies them and runs further checks as needed (NSF/ANSI 455-2, 5.5.6).

None of that comes off a checklist at a desk. It comes off what you show him. The facility tour generally follows production flow, from raw material receiving through processing, packaging, warehousing, testing, release and shipping, and takes in the quality control laboratory and maintenance (NSF/ANSI 455-2, 5.5.2). Employees are picked at random from different parts of the operation and asked to explain their own tasks (NSF/ANSI 455-2, 5.5.3). The document review reaches incoming material records, pre-weigh and dispensing forms, manufacturing and packaging records, shipping and traceability records, test methods and specifications, deviation and out-of-specification records, change control, maintenance, cleaning, sanitization and training records, complaint and recall documents including mock recall records, the subcontracting program and the pest control program (NSF/ANSI 455-2, 5.5.4). And a traceability challenge is run on raw and packaging material through production, and on finished goods through distribution (NSF/ANSI 455-2, 5.5.5). That document list is the cheapest self-check on this page. Walk your own file room against it and mark what you could put your hand on this afternoon.

Three words travel through all of this and they are not the same word. During the audit the auditor raises observations and findings with you as they are made (NSF/ANSI 455-2, 5.5.6). Afterwards the technical reviewer confirms findings as nonconformances (NSF/ANSI 455-2, 5.6.2). Only nonconformances carry a level and feed the grade (NSF/ANSI 455-2, 5.5.9; 5.6.3). Something said to you on the tour has not yet become any of those.

One line in the tour clause is worth knowing before the day arrives. Where the auditor finds the site is clearly not ready for certification, he concludes the audit, after consulting the certification body’s management (NSF/ANSI 455-2, 5.5.2). There is a state below a bad grade, and it is being sent home.

The three levels, and what puts you in one

Findings are evaluated and classified into one of three levels of nonconformance, on the observations made and the evidence collected during the audit. The standard is direct about where the line comes from: it makes the classification of findings a function of the auditor’s judgment on severity and risk. The three levels, in that same clause (NSF/ANSI 455-2, 5.5.9):

• Critical. A nonconformance or condition which has produced, or may lead to, a significant risk of an unsafe or hazardous product which may be harmful and puts the consumer at risk of serious injury or death.
• Major. A nonconformance other than critical that results in failure in one or more of the quality subsystems. Or a combination of minor nonconformances, none of them major on its own, which together may represent a major one, in which case it is explained and reported as such.
• Minor. A nonconformance where an element of GMP has not been fully met, or does not adversely affect the performance, reliability or use of a product, but which on the objective evidence does not meet the definition of a major one.

Read the major definition twice, because its second half is the part that catches people. A stack of small findings is not automatically a stack of small findings. The standard says outright that multiple minor nonconformances considered collectively may raise the category to a major (NSF/ANSI 455-2, 5.5.9).

Now notice what the standard withholds. The major definition turns on failure in one or more of the quality subsystems, and the standard uses that phrase in this one clause and nowhere else. It never lists them (NSF/ANSI 455-2, 5.5.9). The escalation rule turns on a system element, and the standard uses that phrase in one clause and nowhere else, offering training as its only example (NSF/ANSI 455-2, 5.6.2). Neither term is defined anywhere in the standard. So you cannot classify your own gaps against it, and reading harder will not fix that. It is the same fact the classification clause states plainly, seen from your side: the line is drawn by a person, on the day. What is inside your control is the evidence you can put in front of that person, and then in front of the reviewer.

The closing meeting is where people talk themselves into trouble

The most common search on this subject is not about clauses. It is what not to say during an audit. The standard answers it, in the clause that governs the closing meeting.

At that meeting the auditor presents the audit findings, and shall not comment on the likely outcome of the certification process (NSF/ANSI 455-2, 5.5.8). Anything you think you hear about how it went is not the answer, and the person in front of you is not permitted to give you one. What he does explain is the technical review the report goes through before the nonconformances are finally classified.

The discussion has a narrow and useful purpose: clarifying what was seen, restating the requirements, and dealing with a possible miscommunication. And the standard puts one thing on you in that room, which happens to be the only thing that helps. The site shall provide additional objective evidence to resolve a miscommunication or misunderstanding (NSF/ANSI 455-2, 5.5.8).

That is what the clause gives you, and it is narrower than the question people ask. The standard does not list things not to say, and no honest page can supply one. What it does is say what the room is for and what moves a finding in it. Argument does not move a finding. A record does. If the finding exists because the batch record you handed over did not show a step, the thing that changes it is the record that does. Bring people who can find that record, which is why senior managers with the authority to see corrective action taken are expected at the closing meeting, and at the opening meeting as well (NSF/ANSI 455-2, 5.5.8; 5.5.1).

The classification you heard is not necessarily the one you get

The report does not go straight to you. It goes to a technical reviewer at the certification body, and the standard sets what that person has to be: someone with expert knowledge of the standard and its requirements and a full understanding of the grading model and its intent, who is independent of the auditors who conducted the site visit (NSF/ANSI 455-2, 5.6.2).

That reviewer evaluates the classification of the findings, confirms the findings as nonconformances, and consults the auditor where something needs clarifying. Where several findings are reported within a single system element, and the standard’s own example is training, the overall classification of that element is raised, and multiple minors are grouped into a major (NSF/ANSI 455-2, 5.6.2).

Where the report needs changing it goes back. The auditor edits it against the reviewer’s comments, and the amended report is routed to the technical team for final review, which either approves it or asks for more (NSF/ANSI 455-2, 5.6.3). Only after that is the grade assigned, from the number and severity of the nonconformances observed, and the whole final review and report publication is to be completed within ten business days from the end of the audit (NSF/ANSI 455-2, 5.6.3).

So there are two judgments, not one, and the second belongs to somebody who was never in your building.

A grade is still not a certificate. After reviewing the audit report, the corrective action report and the applicable supporting documentation, including a monitoring audit report where there is one, the certification body makes the certification decision. Where a certificate is awarded it is issued within ten business days of that decision, it details the scope of the audit and any limitations or exclusions from it, and it is valid for seventy-five days beyond the twelve-month anniversary of the last day of your certification audit (NSF/ANSI 455-2, 5.8.1).

What it takes to close one

You submit a corrective action plan with implementation dates for each nonconformance, within ten business days of receiving the final audit report. If you need longer, you ask the certification body for the time (NSF/ANSI 455-2, 5.7.1). The body reviews the plan within ten business days of receiving it, and each plan is independently reviewed and either approved, rejected, or sent back with a request for more information (NSF/ANSI 455-2, 5.7.2).

One line in that clause is the one people misread. Submitting a corrective action plan does not change the grade the certification body assigned during that audit cycle (NSF/ANSI 455-2, 5.7.2). Fixing a finding does not un-write it. What the plan changes is what happens next, and what happens next runs off the grade (NSF/ANSI 455-2, 5.7.3).

• Grade A with zero nonconformances is eligible for certification.
• Grade A or B with only minors is eligible once all the corrective action plans are approved, and the effectiveness of those actions is reviewed at the next certification audit.
• Grade B with any major is eligible once the plans are approved and you have given the certification body objective evidence that the corrective actions for the majors are implemented, and that evidence has been approved.
• Grade C on an initial certification audit is eligible once the plans are approved and the corrective action against the majors is shown to be in place and effective at the monitoring audit.
• Grade C on a recurring certification audit is eligible for recertification once the plans for all the nonconformances from that audit are approved, with completion and effectiveness against the majors reviewed at the monitoring audit.
• Grade D is not eligible for certification. A new certification audit is required.

One path sits outside that list. Where there are critical nonconformances, an audit is scheduled after the corrective actions are closed out and the facility has shown objective evidence that they are complete and effective (NSF/ANSI 455-2, 5.8.3). And there is one state on the whole scale that needs no corrective action plan: grade A with zero nonconformances (NSF/ANSI 455-2, 5.7.3). That is what clean looks like here.

A grade of C also carries a monitoring audit as a required follow-up, and a certification body may call for one where minor nonconformances have gone unclosed, whatever your grade (NSF/ANSI 455-2, 5.8.3; 5.3.1). And an unclosed finding follows you. Corrective action from a previous audit that is not in place and effective at the next certification audit is deemed a repeat nonconformance, and the classification of a repeat may be escalated on the risk and severity (NSF/ANSI 455-2, 5.7.3).

If the finding itself is wrong

You can appeal, and the standard is specific about what is open to appeal: the identification of a nonconformance, its categorization, or both, and the certification decision (NSF/ANSI 455-2, 5.8.6).

The appeal is made in writing. It includes evidence supporting it and demonstrating compliance, and the standard names the kinds: documentation, records, photographic evidence. The certification body has to hold a documented procedure for considering and resolving appeals, and the investigative procedures are independent of the individual auditor. Where an appeal fails, the body has the right to charge you the cost of conducting it (NSF/ANSI 455-2, 5.8.6).

An appeal is not a complaint about tone. It is a second reading of the evidence, and you supply the evidence.

What FDA writes up is a different record

None of the above describes an FDA inspection, and the two are not versions of each other.

The statute commands a written report. On completing an inspection of a factory, warehouse, consulting laboratory or other establishment, and before leaving the premises, the investigator gives the owner, operator or agent in charge a report in writing setting out any conditions or practices observed which, in his judgment, indicate that a food, drug, device, tobacco product or cosmetic in that establishment consists in whole or in part of a filthy, putrid or decomposed substance, or has been prepared, packed or held under insanitary conditions whereby it may have become contaminated with filth or rendered injurious to health. A copy goes promptly to the Secretary (21 U.S.C. 374(b)(1)).

That report is the Form FDA 483. FDA describes it the same way: during an inspection its investigators may observe conditions they deem objectionable, and those observations are listed on a Form FDA 483 when, in the investigator’s judgment, the conditions or practices observed indicate that an FDA-regulated product may be in violation of FDA’s requirements (FDA, Inspection Observations).

Read what that subsection does and does not do. It requires the report and names what belongs in it. It assigns no severity level and no grade, and it sets no deadline for you to answer. What follows is not in that subsection. It is in the rest of the Act.

What can follow. A dietary supplement prepared, packed or held under conditions that do not meet the current good manufacturing practice regulations is adulterated (21 U.S.C. 342(g)(1)). Introducing, or delivering for introduction into interstate commerce, a food that is adulterated or misbranded is a prohibited act (21 U.S.C. 331(a)). An adulterated or misbranded article is liable to seizure (21 U.S.C. 334(a)(1)), and a person who violates a prohibited act is liable to imprisonment for not more than one year, or a fine, or both (21 U.S.C. 333(a)(1)). No deadline in the report clause is not the same thing as no consequence, and that is the distance between the two.

Notice that the same word carries both records. One is the auditor’s judgment on severity and risk. The other is what the investigator judged the conditions to indicate. Both are one person’s judgment, written down, and read afterwards by somebody else.

What ends up on those federal reports is published, and you can go and read it (FDA, Inspection Observations).

What FDA has written up under the supplement GMP rule

We counted FDA’s published inspection citation records, the rows that carry the firm, the inspection, the clause cited and FDA’s own standardized text for the observation written under it. The filter is one thing and nothing else: every row whose cited authority begins 21 CFR 111, the dietary supplement good manufacturing practice rule. It returns 23,440 observations, written across 4,183 inspections at 2,507 facilities, in fiscal years 2009 through 2026. Read on 20 August 2026, so fiscal year 2026 is a part year and every count here is a floor rather than a total.

The five most-cited clauses of 21 CFR Part 111 in FDA’s published observation record, with the count of observations citing each and what the clause requires.

Observations	Clause	What the clause requires
1,387	21 CFR 111.70(e)	Product specifications for the identity, purity, strength and composition of the finished batch, and limits on the types of contamination that may adulterate it
914	21 CFR 111.205(a)	A written master manufacturing record for each unique formulation and each batch size, prepared and followed
885	21 CFR 111.103	Written procedures for the responsibilities of quality control operations, established and followed, including material review and disposition
675	21 CFR 111.75(a)(1)(i)	Before you use a component, at least one appropriate test or examination to verify the identity of any component that is a dietary ingredient, unless you petition the agency and it exempts you from that testing
600	21 CFR 111.553	Written procedures established and followed to fulfill the requirements of the product complaint subpart

One family runs through the whole record. Of the 23,440 observations, 3,921 carry a short description beginning with the words written procedures. That is roughly one in six. Of those 3,921, the largest group by far is 2,641 saying the procedure was never established, or never made and kept, at all. Another 856 say it was neither established nor followed, 387 say it existed and was not followed, and 37 carry a garbled variant of the same never-established wording.

What that does not evidence. These are counts of citation rows, not counts of firms, and not counts of the inspections where nothing was written. The clause filter is ours, so the total is a floor rather than a census. A clause cited because a document was absent is evidence that a document was absent, and it is not evidence about the quality of the documents that do exist; the standardized wording of most of these observations does not separate the two. FDA says as much about its own publication: the observation data is pulled from its electronic inspection tools, not every Form FDA 483 is generated by those tools because some are prepared by hand, and what it publishes is not a complete listing of all inspectional observations (FDA, Inspection Observations). And this is FDA’s record. No comparable record of certification audit findings is read here, and a certification body’s official listing carries the company, the facility, the facility type and the exclusions rather than the findings (NSF/ANSI 455-2, 5.8.4). So nothing here tells you how a certification body would have classified any of it.

One more difference worth holding on to. FDA’s own classification attaches to the inspection rather than to the individual observation, and it is one of three: No Action Indicated, Voluntary Action Indicated, or Official Action Indicated. The three names say what they say: no action, voluntary action, official action. That records what the agency decided about the inspection. It is not a rating of your quality system, and it is not a grade.

Your FDA history is an input to the certification audit

The two events are separate, and one of them reads the other. Before a certification audit you give the certification body any regulatory actions, inspection reports or other notifications you have received from any regulatory agency, including Form 483s, warning letters, meeting requests and consent decrees, since the most recent regulatory audit (NSF/ANSI 455-2, 5.2). You also supply the certification body with background information at least a week before the site visit so the auditor arrives prepared, and the standard’s list of what that request should cover includes your regulatory inspection history for the past five years (NSF/ANSI 455-2, 5.4.5).

So part of the answer to what happens if you fail an FDA inspection is this: your certification body has it in front of it. Not as a finding of its own, but as the first place to look.

The traffic runs one way. A certificate is not a federal anything — it is issued by a certification body under a scheme you chose, not by FDA, and holding one does not change what the Act requires of you.

Three things that get written up that nobody expected

The procedure that has never been run. A written recall plan and a recall plan nobody has ever exercised look identical in a binder. They stop looking identical during a traceability challenge, which is run on raw and packaging material through production and on finished goods through distribution, and where a review of a mock recall is used to evaluate the site’s material control system (NSF/ANSI 455-2, 5.5.5). Mock recall records are named in the document review as well (NSF/ANSI 455-2, 5.5.4). The audit does not read the procedure. It runs it.

The person who cannot explain his own job. Employees are selected at random from different parts of the operation and asked to explain their tasks, to verify that they understand the duties they are assigned to and the standard operating procedures and good manufacturing practices related to their function. Their names are recorded so the training records can be checked against them (NSF/ANSI 455-2, 5.5.3). A procedure nobody at the bench can describe is a finding about the procedure, not about the person.

The small stuff, counted together. This is the one that changes an outcome. Several minor findings inside one system element get the classification of that element raised by the technical reviewer, and minors considered collectively may become a major (NSF/ANSI 455-2, 5.6.2; 5.5.9). The standard’s grading table puts a site with no critical and no major nonconformances and between eight and fifteen minors at grade B (NSF/ANSI 455-2, 5.6.3). Nobody plans for that. It arrives as an accumulation of things everyone agreed were small.

All of this ends up in one document, and it is not the certificate. If somebody is asking you to prove your compliance, or you are trying to check a contract manufacturer’s, here is what a certificate does and does not tell you, and what the audit report tells you instead.

What the standard asks of you before any of this starts. Before a certification audit, the company conducts a self-assessment against the standard and the facility addresses the gaps that assessment finds. Separately and optionally, a gap analysis audit of the site may be conducted by a third-party consultant other than the certification body (NSF/ANSI 455-2, 5.3.2). You can run the self-assessment yourself, and the document review list above is where to start. If you do buy a third-party gap analysis, know what it costs you at the other end: an auditor who has been involved in a gap analysis for you, or who has provided you consulting services, cannot be assigned to your certification for two years (NSF/ANSI 455-2, 5.4.6).

And if none of this is in front of you — no certification in play, no inspection scheduled — there is nothing here you have to act on today. It becomes yours when a customer names a standard or an investigator names a date.