How do I tell whether my contract manufacturer is genuinely compliant rather than just holding a certificate?

What this page covers, and what it does not. One thing: a dietary supplement made for you by somebody else in the United States, and a certificate issued under NSF/ANSI 455-2. If your product is a conventional food, a cosmetic, an over-the-counter drug or an animal product, a different manufacturing rule governs it and none of the mechanics below transfer. If your maker is outside the United States, there is a further program the supplement part points importers to, in subpart L of part 1 (21 CFR 111.5), and this page does not work through it; our article on what a quality agreement does and does not protect you from does, clause by clause. And it is about one scheme. Every scope rule, grade, validity window and review step below is a property of NSF/ANSI 455-2. Another scheme has its own, and none of these numbers carry across to it.

Read this before the requirements below, because most of the federal rule people quote in this conversation may not be addressed to you. The supplement part applies to you if you manufacture, package, label or hold a dietary supplement, and it defines “you” as a person who does one of those four things (21 CFR 111.1(a), 111.3). Read the four verbs against what your company physically does, not against what your contract calls you.

• You manufacture if you make the batch.
• You package or label if you fill, assemble, apply the label or put your own lot sticker on it. The part carries a whole subpart for those operations, addressed to whoever performs them (21 CFR 111.403, 111.415).
• You hold if finished stock sits in a building you control or one you pay to store it in. The section that settles who is subject carries one exception, and it is narrow: the holding requirements do not apply where you hold at a retail establishment for the sole purpose of direct retail sale to individual consumers, and a retail establishment does not include a warehouse or other storage facility for a retailer, or one that sells directly to individual consumers (21 CFR 111.1(b)).

Only where none of the four describes you is the part addressed somewhere other than to you. Then read how each requirement is written, because they are written to the party performing the operation: “Before you use a component, you must” reaches whoever uses the component (21 CFR 111.75(a)). Where your maker receives, tests, blends, packages and labels and you never take possession, those clauses are theirs. Where you do take possession, the holding and distributing subpart is yours: written procedures for holding and distributing operations, holding conditions that protect identity, purity, strength and composition, distribution under conditions that protect against contamination and deterioration, and records of product distribution (21 CFR 111.453, 111.455(a), 111.470, 111.475(b)(2)). That is a reading of how the part is written, offered so you can place yourself against it. It is not a determination about your company. Your own facts decide, and where the answer carries commercial weight it is a question for your own counsel.

Hold on to one more thing if it applies to you: a stock formula sold under several brands, or a product that runs on a line shared with other companies. It changes how a certificate’s exclusions read for you, and it comes back below.

What no allocation of operations touches is the product and the sale. A dietary supplement is deemed to be a food within the meaning of the Act (21 U.S.C. 321(ff)), and it is adulterated if it has been prepared, packed or held under conditions that do not meet the current good manufacturing practice regulations (21 U.S.C. 342(g)(1)). That provision is what your maker’s conditions decide. Two prohibited acts sit beside it, and neither names a party: the introduction or delivery for introduction into interstate commerce of an adulterated food (21 U.S.C. 331(a)), and the receipt in interstate commerce of an adulterated article and the delivery or proffered delivery of it, for pay or otherwise (331(c)). Each reaches whoever performs it. If they ship to you and you ship on, the second one describes an act you performed.

The same subchapter carries a limit on those penalties, and it is worth knowing before you assume the position is fixed. A person is not subject to the penalties of the lighter provision for having received an article in interstate commerce and delivered it or proffered delivery of it, if that was done in good faith, unless the person refuses to furnish, on request of an officer or employee duly designated by the Secretary, the name and address of the person the article was received from and copies of all documents pertaining to its delivery; nor for having violated the introduction-into-commerce paragraph, where the person establishes a guaranty or undertaking signed by, and containing the name and address of, the person residing in the United States from whom the article was received in good faith, to the effect that it is not adulterated or misbranded (21 U.S.C. 333(c)). That instrument is not a quality agreement and it is not an indemnity, and the article linked above works through it.

Two other instruments people reach for do not answer this. Subparts C and G of the preventive controls part for human food do not apply to any facility with regard to the manufacturing, processing, packaging or holding of a dietary supplement that is in compliance with the requirements of the dietary supplement part and with section 761 of the Act (21 CFR 117.5(e)). And NSF/ANSI 455-2 is not law. It is a voluntary consensus standard binding the facility that seeks certification and the body that certifies it. Its own scope describes it as a standardized approach to auditing the level of compliance of dietary supplement products with 21 CFR Part 111, together with additional retailer requirements layered on top (NSF/ANSI 455-2, clause 1.2). Nothing in it puts a duty on you.

On this page: “GMP certified” names no single status · What a certificate is a statement about · The report is the document to ask for · What the audit could and could not see · Who certified them, and who decides that is good enough · A certificate on the plant is not a result on your lot · What the regulator’s own record shows · The label does not tell you who made it · What to ask for, in order · Common questions

“GMP certified” names no single status

Take the phrase apart before anything else, because it is carrying more than it can hold. No federal agency confers GMP certification on a supplement plant. In the terminology the 455 family of standards uses, which clause 3 of this standard points to, certification is the procedure by which an accredited certification body, on the basis of an audit and assessment of a company’s competence, gives written assurance that the company conforms to a standard’s requirements (NSF/ANSI 455-2, clause 3; definition from NSF/ANSI 455-1).

Read what that sentence needs before it means anything. Which standard, and which body. A maker who writes “GMP certified” on a website or a marketplace listing has given you neither, and the phrase on its own does not tell you that anybody audited anything. So those are the first two questions, and everything on this page after them assumes the answer to the first is NSF/ANSI 455-2. We do not describe other marks or other schemes here, and the mechanics below should not be read onto one.

What a certificate is a statement about

The scope was negotiated, and its edges are printed. The scope of the audit is set by the number and type of products and the manufacturing processes used at the site, and it has to be agreed between the site and the certification body before the audit runs. Exclusion of products or processes is permitted, where the excluded products can be told apart clearly from those in scope and are made in a physically segregated area. The scope and any exclusions have to be described in the audit plan, in the audit report and on any certificate issued. Products under development or in trial production are excluded from the scope of the audit (NSF/ANSI 455-2, clause 5.3.4). So the first thing to read on a certificate is not the logo. It is the exclusions.

To read them you need two of the standard’s own terms. A product category is the organization of products by type of product, and the examples the terminology gives are tablets, capsules, liquids, suppositories, powders and ophthalmics. A product technology is a high-level description of the manufacturing technology used to make products, with tableting, encapsulation, liquids manufacture and sterile filling given as the examples (NSF/ANSI 455-2, clause 3; definitions from NSF/ANSI 455-1). Find the technology that makes your product in those terms, then find it in the certificate’s scope. This is also where a shared line or a stock formula matters: the exclusion rule turns on products being clearly distinguishable and physically segregated, which is exactly the question a shared line raises.

A separate official listing has to carry, for each certified company, the company name and address, the facility address, the facility type stated as contract manufacturer, manufacturer, packaging or distribution, and the exclusions and limitations (NSF/ANSI 455-2, clause 5.8.4). That the listing is published at all is an expectation stated in the standard’s informative annex rather than a requirement of the standard (NSF/ANSI 455-2, Informative Annex 1), so treat it as a check to try rather than a right you hold. Where a body does publish one, it is the only independent look at a certificate you can get without asking your maker for anything.

The date is older than it looks. A certificate stays valid for seventy-five days beyond the twelve-month anniversary of the last day of the certification audit, unless the next certification audit lands a grade of D, in which case certification is not granted and any previous certification is withdrawn (NSF/ANSI 455-2, clause 5.8.1). Do the arithmetic. A certificate that is current on the day you read it can be more than fourteen months from the last time anyone walked the floor. That validity period is not the only thing that can end a certificate: the standard separately requires suspension or revocation for circumstances such as violation of the body’s program rules or failure to meet financial commitments, and withdrawal where circumstances indicate the site no longer complies with the scheme, with evidence of falsification of records and failure to implement adequate corrective actions in time among its examples (NSF/ANSI 455-2, clause 5.8.5).

Not every audit counts. An audit conducted with the intent of achieving certification to this standard is recognized only where the body conducting it is recognized and approved by the American National Standards Institute (NSF/ANSI 455-2, clause 5.3.3). A report from a body outside that set may be perfectly good work. It is not this.

The report is the document to ask for, and the standard says who it is for

This is the part that answers the question at the top of the page.

At the end of each audit a written report is issued in a standardized format. The standard describes that report as giving the company, and its customers whether existing or prospective, an accurate view of the site’s quality systems and of its performance against the standard’s requirements. The report carries the status of corrective actions from past audit nonconformances where there are any, and it has to include the improvements made since the last audit (NSF/ANSI 455-2, clause 5.6.1). You are the prospective customer. The document was designed with you in it. The body communicates the final report and the grade to the company (NSF/ANSI 455-2, clause 5.6.4), so the company is who you ask.

What the report holds and the certificate does not is the shape of the site. The number and severity of nonconformances are communicated in the final report, and the grade is built from them (NSF/ANSI 455-2, clause 5.6.3). The company then submits a corrective action plan with implementation dates for every nonconformance within ten business days of receiving the final report, and where it needs longer it has to ask the body for more time (NSF/ANSI 455-2, clause 5.7.1). The body reviews that plan within ten business days and either approves it, rejects it, or asks for more; submitting a plan does not change the grade already assigned (NSF/ANSI 455-2, clause 5.7.2).

Then the grade decides how much more anyone had to do before a certificate could issue. That is what the certificate hides and the report shows.

What each grade obliged the site to do before a certificate could issue, and what was left to be checked later. Read from NSF/ANSI 455-2 clause 5.7.3, with the audit frequency at clause 5.8.3. This is a map of the site’s own obligations. It is not a scale of supplier acceptability: the standard sets no threshold at which a buyer should accept or refuse a maker, and neither does this page. That judgment is yours.

Grade	What was required before certification	What was left for later
A, zero nonconformances	Eligible for certification.	Certification audit every twelve months, within thirty days either side of the anniversary.
A or B, minor nonconformances only	Eligible once every corrective action plan is approved. Nothing has to be shown to have been done.	The effectiveness of those corrective actions is reviewed at the next certification audit. A monitoring audit only where the body deems repeat minor nonconformances need one.
B, with any major nonconformance	Eligible once plans for all nonconformances are approved and objective evidence is provided to the body showing the corrective actions for the major nonconformances are implemented and have been approved.	Effectiveness reviewed at the next certification audit.
C	On an initial certification audit, eligible once plans for all nonconformances are approved and corrective action against major nonconformances is shown to be in place and effective at the monitoring audit. On a recurring audit, eligible once the plans are approved.	A monitoring audit is required, at a frequency the body sets. Effectiveness against minor nonconformances is reviewed there or at the next certification audit.
D	Not eligible for certification.	A new, full certification audit is required.

Read the second row against the third. A site with nothing written against it, and a site that wrote plans for a handful of minor findings and has not had to show that any of them were done, both hold a certificate. The certificate does not distinguish them. The report does, and so does the grade printed in it.

What the audit could and could not see

An audit is a finite number of hours, and the standard says how few.

The certification body decides the duration and the number of auditors, and the plan typically calls for a single auditor. The standard gives a table of minimum audit lengths rather than fixed ones, and says the duration and resources may be adjusted for what is known about the manufacturer, its regulatory history and the focus of the audit. Two days is the base case for a manufacturer with up to five product categories and up to three technologies in one building, and it carries two stated assumptions: that water is used as a raw material, and that at least one material or product needs micro quality testing. A facility with a specialized, limited product may be audited in one day, and the example given is a maker of a nonaqueous, nonmicrobially sensitive product. Where a facility has all three of multiple buildings, more than five product categories and more than three technologies, the standard says it may need extra time, extra auditors, or both (NSF/ANSI 455-2, clause 5.4.2).

It may also not have been a visit. The initial certification audit has to be on site. A virtual audit may be permitted in place of an on-site annual certification audit because of travel suspension or restriction arising from travel warnings, advisories, or health and safety concerns, and only where the previous audit was a grade of A or B; where the annual certification audit is virtual or desk-based, the next one has to be on site (NSF/ANSI 455-2, clause 5.4.4). That is a narrow permission with a correction built into it, and it is still a year in which nobody stood in the room. Ask which kind the last one was.

And the line that runs your product may not have been running. The site has to ensure the scope of certification is in operation during the audit, and where a significant process runs seasonally or only occasionally, either the audit is scheduled for that time or a separate audit is required to assess it (NSF/ANSI 455-2, clause 5.4.3). If your product is the once-a-quarter run, ask whether it was made that week.

Who certified them, and who decides that is good enough

The uncomfortable version of your question is whether the body doing the certifying is hard enough on the company paying it. That worry is stated publicly by people who have sat in the chair, and it deserves a straight answer rather than reassurance.

Start with what a finding is. The standard sorts nonconformances into three levels. A critical finding is one that has already produced, or could lead to, a serious risk that the product is unsafe or hazardous, of a kind that could seriously injure or kill a consumer. A major finding is anything short of critical that amounts to a failure in one or more of the quality subsystems, or a group of minor findings that together add up to one. A minor finding is where a GMP element was not fully met, or where the shortfall does not adversely affect how the product performs, how reliable it is or how it is used, and where the objective evidence does not make it major. Classification is a function of the auditor’s judgment as to severity and risk, and is made on the observations and evidence collected during the audit; multiple minor findings taken collectively may be raised to a major (NSF/ANSI 455-2, clause 5.5.9).

That judgment does not stand alone. The report, the findings and the certification application are reviewed by a technical reviewer who has to hold expert knowledge of the standard and a full understanding of the grading model, and who has to be independent of the auditors who conducted the site visit. The reviewer evaluates how the findings were classified, confirms them as nonconformances, consults the auditor where something needs clarifying, and where several findings sit inside one system element the overall classification of that element has to be raised. Where the reviewer indicates modifications, the report goes back to the auditor for revision (NSF/ANSI 455-2, clause 5.6.2). The auditor then amends it, the amended report is routed back for final review, and the reviewer either approves it or asks for more changes before the grade is assigned; the whole review and publication process has to complete within ten business days of the end of the audit (NSF/ANSI 455-2, clause 5.6.3).

That is a real control, and it is worth knowing it exists. It is also a control exercised on paper by somebody who was not there, which is a different thing from a second pair of eyes on the floor.

Independence of the auditor is handled directly. The auditor must not have been employed by the audited company for at least three years, and must not have a familial or financial relationship that could be construed as a conflict of interest. An auditor assigned to a certification audit must not have been involved in a gap analysis or provided consulting services to the same company within the last two years. No auditor is to run more than three certification audits in a row at one site, with monitoring audits not counted against that. And the standard puts an obligation on the site rather than a permission: where it wants a particular auditor substituted, it is to request that of the body with sufficient, objective written justification (NSF/ANSI 455-2, clause 5.4.6). Appeals against a finding or a certification decision run through a documented procedure whose investigative steps have to be independent of the individual auditor (NSF/ANSI 455-2, clause 5.8.6).

Now the part that is honest and unsatisfying. Who the auditor is turns on information the site supplied: the standard makes it the site’s responsibility to give the certification body adequate and accurate detail of the products manufactured and the process technologies employed, and says that information assists the body in selecting an audit team with the skills to do the work (NSF/ANSI 455-2, clause 5.4.6). Alongside it the site has to supply the body with background information at least a week before the visit, and the standard says the information the body requests should include, without being limited to, the organization chart, the site plan, the process flow diagram, the list of products and technologies in scope, shift patterns, the standard operating procedure index, five years of regulatory inspection history and the site’s regulatory registration; and where the previous certification audit was done by a different body, the site has to give the new body the previous year’s audit report together with its corrective action plans (NSF/ANSI 455-2, clause 5.4.5). Separately, the company has to hand the body every regulatory action, inspection report or other notification any regulatory agency has sent it since the most recent regulatory audit, with Form 483s, warning letters, meeting requests and consent decrees named among them (NSF/ANSI 455-2, clause 5.2). Every one of those is a question you can put to your maker, and FDA’s published inspection record is where you can check the answer to the last one.

What the standard does not settle is the competence of the people who audit. It carries an informative annex on additional elements of a certification program, and that annex says of itself that the information in it is not part of the American National Standard, has not been processed under the Institute’s requirements for one, and does not contain requirements necessary for conformance to the standard (NSF/ANSI 455-2, Informative Annex 1). Inside it, the competence provision at clause I-1.3 sends the certification body to the competence requirements in ISO/IEC 17065. That document is not read here, so we will not tell you what it says; if it matters to your decision, buy it or ask the body to show you its accreditation against it. The annex goes on, at clause I-1.3.2, to say the body’s management should have the knowledge and processes to set up and operate a system for selecting auditing personnel, verifying their competence, assigning their tasks, training them initially and on an ongoing basis, and instructing and monitoring them. That is an expectation stated in an annex the standard says is not part of it, and it does not bind anyone (NSF/ANSI 455-2, Informative Annex 1).

The annex does write one hard word. Certification bodies shall ensure that auditors and other personnel involved in these audits understand the importance of a code of conduct, and shall keep signed statements of adherence to one. The elements the annex lists for that statement include not providing any consulting services to audited manufacturers, not accepting any inducement, gift, commission, discount or other benefit unavailable to the general public from manufacturers, packagers, material suppliers, distributors or their agents, and recording and reporting audit findings truthfully and accurately in an impartial and unbiased way (NSF/ANSI 455-2, Informative Annex 1). Read where that sits. It is a shall inside a document the standard has already told you is not part of the standard. So the answer to the worry is that this instrument does not close it, and what you can actually lean on are the four things in the paragraphs above: an approved body, an independent technical reviewer, the conflict-of-interest bars on the auditor, and an appeals route that goes around them.

A certificate on the plant is not a result on your lot

The second half of the question arrives in your inbox as a certificate of analysis. A buyer described publicly being sent one from a well-known maker whose only test was total plate count, with the rationale that FDA allows it. That is half a sentence, and the missing half decides it.

First, sort your own formula. The whole rule turns on a distinction the paperwork will not make for you. A component is any substance intended for use in the manufacture of a dietary supplement, including those that may not appear in the finished batch, and component includes dietary ingredients as described in section 201(ff) of the Act and other ingredients (21 CFR 111.3). Section 201(ff)(1) lists what a dietary ingredient is: a vitamin; a mineral; an herb or other botanical; an amino acid; a dietary substance for use by man to supplement the diet by increasing the total dietary intake; or a concentrate, metabolite, constituent, extract, or combination of any of those (21 U.S.C. 321(ff)(1)). Run your own formula against that list. The actives are dietary ingredients. The capsule shell, the flow agent, the binder, the sweetener, the color, the processing aid that never reaches the finished batch: those are components that are not dietary ingredients. The sort decides which of the next two paragraphs applies to each line on your formula.

For a dietary ingredient there is no substitute. Before you use it you must conduct at least one appropriate test or examination to verify its identity, unless you petition the agency and are granted an exemption (21 CFR 111.75(a)(1)(i), 111.75(a)(1)(ii)). A supplier’s paperwork does not discharge that.

For other components the rule is a duty first and a choice second. You must confirm the identity of other components and determine whether the other applicable component specifications established under section 111.70(b) are met; to do that you must either conduct appropriate tests or examinations, or rely on a certificate of analysis from the supplier of the component that you receive (21 CFR 111.75(a)(2), 111.75(a)(2)(i), 111.75(a)(2)(ii)). Reliance is not a shortcut around the duty; it is one of two ways of discharging it, and it is conditional on all five of these together:

1. you first qualify the supplier by establishing the reliability of the supplier’s certificate of analysis through confirmation of the results of the supplier’s tests or examinations (21 CFR 111.75(a)(2)(ii)(A));
2. the certificate includes a description of the test or examination methods used, the limits of those tests or examinations, and the actual results (111.75(a)(2)(ii)(B));
3. you maintain documentation of how you qualified the supplier (111.75(a)(2)(ii)(C));
4. you periodically re-confirm the supplier’s certificate of analysis (111.75(a)(2)(ii)(D)); and
5. quality control personnel review and approve the documentation setting out the basis for qualifying and requalifying the supplier (111.75(a)(2)(ii)(E)), which the part states again as a duty of the quality function in its own right (111.105(b)).

So the certificate of analysis is never the evidence on its own. The evidence is the qualification file behind it, and the certificate is what that file makes usable. Note also whose certificate the clause permits: one from the supplier of the component that you receive, carrying the actual results of the tests. A report issued under an internal product code you cannot tie to the material that arrived is not doing the work the clause describes, and that is worth checking on the face of every certificate you are sent.

A single microbiological count also does not answer the finished product question. For a subset of finished batches identified through a sound statistical sampling plan, or for every batch, you must verify that the finished batch meets product specifications for identity, purity, strength, composition, and the limits on the types of contamination that may adulterate or that may lead to adulteration of the supplement; and you must select the specifications that, if tested on finished batches, would verify the production and process control system is producing a supplement that meets all product specifications, or only those not otherwise exempted by quality control personnel under paragraph (d) (21 CFR 111.75(c), 111.75(c)(1)). That exemption is narrow and it is documented: quality control personnel may exempt a product specification only where they determine and document that the selected specifications cannot verify it and there is no scientifically valid method for testing it at the finished batch stage, with a written basis for what else ensures it is met, reviewed and approved by quality control personnel (111.75(d)(1), 111.75(d)(2)). A plate count is a limit on one type of contamination. It is not identity, purity, strength or composition, and no amount of it becomes them.

What actually reaches the lot in your warehouse. Two things, and neither is a certificate. Whoever distributes packaged and labeled dietary supplements must collect and hold a reserve sample of each lot they distribute, in the same container-closure system it is distributed in, retained for one year past the shelf life date where shelf life dating is used, or two years from the date of distribution of the last batch (21 CFR 111.83(a), 111.465(a)(2), 111.465(b)). If you distribute, that is your own sample of your own lot, and it is what any later investigation of that lot would run on. And the finished-batch result for your lot lives in the batch production record for it (21 CFR 111.260). Ask for both by lot number. That is the closest anything on this page gets to the boxes you already own.

What the scheme adds on top of the federal rule. Two of its supplier clauses go further than Part 111 does. Supplier qualification procedures have to include initial qualification, periodic examination for requalification, disqualification, and where necessary expedited approval on an emergency basis (NSF/ANSI 455-2, clause 4.3.2) — none of which the federal rule spells out. The scheme also requires a risk-based supplier qualification program for all ingredients, with a supplier and ingredient risk evaluation, qualification activities matched to it, and assurance that only approved suppliers are used (NSF/ANSI 455-2, clause 4.3.1); that clause carries its own federal reference to the preventive controls supply-chain provisions, which is why it is named here as a requirement of the scheme rather than as an extra federal duty on a supplement facility. Dietary ingredients have to be sampled, tested and released before use, with at least one appropriate test or examination verifying identity, unless the company has an FDA-approved identity-test exemption petition (NSF/ANSI 455-2, clause 4.6.5), and other raw materials and components have to be sampled, tested or confirmed, and released before use (NSF/ANSI 455-2, clause 4.6.6). Two of the scheme’s expectations, worded as should rather than shall, are the ones that would have caught the certificate in that story: that certificates from qualified suppliers may confirm every specification except identity, which should be tested (NSF/ANSI 455-2, clause 4.6.5.2), and that a certificate used to confirm conformance for a non-dietary ingredient should carry a description of the test used, the specification limits and the testing results (NSF/ANSI 455-2, clause 4.6.6.5).

What the regulator’s own record shows about that control

It is fair to ask whether any of this actually goes wrong or whether it is a paper worry. FDA publishes what its investigators write, and the clauses above are near the top of the list. Reading FDA’s published record on August 20, 2026, and counting each observation by the clause it was written under across fiscal years 2009 to 2026:

FDA published inspection observations written under 21 CFR Part 111, fiscal years 2009 through 2026, counted by clause and by the number of distinct facilities they were written against. Read August 20, 2026. Part 111 as a whole carries 23,440 observations across 2,507 facilities in the same record. What this does not evidence: it says nothing about whether any of these facilities held a certification, an observation is what an investigator wrote rather than a finding of law, and a high count means the control is often found absent, not that any particular certificate is unsound.

Clause	What the observation says	Observations	Facilities
111.75(a)(1)(i)	Did not conduct at least one appropriate test or examination to verify the identity of a dietary ingredient before use.	675	491
111.75(a)(2)(ii)(A)	Did not qualify a supplier by establishing the reliability of the supplier’s certificate of analysis through confirmation of the results of their tests.	533	399
111.75(c)	Did not verify that the finished batch meets product specifications.	519	386
111.75(a)(2)	Did not confirm the identity of components, or determine whether other applicable component specifications were met.	205	170
111.105(b)	Quality control personnel did not review and approve the documentation setting out the basis for qualification of suppliers.	73	68
111.75(a)(2)(ii)(B)	The certificate of analysis does not include a description of the test methods used, the limits of the tests, and the actual results.	52	48

What one visit can look like

The counts are a shape. One inspection is the thing itself. In FDA’s published record, an inspection of KAV America AG Inc. of San Bernardino, California ended on June 4, 2026 and was classified Voluntary Action Indicated. That is the middle of the three classifications the published record uses, below Official Action Indicated and above No Action Indicated, and on its own words it is not a statement that the agency took or recommended action. The observations posted from that single visit were written under eight clauses: the supplier was not qualified by establishing the reliability of the certificate of analysis (21 CFR 111.75(a)(2)(ii)(A)); the certificate of analysis for a component did not carry the test method, the limits and the actual results (111.75(a)(2)(ii)(B)); the identity of components was not confirmed (111.75(a)(2)); no appropriate test or examination verified the identity of a dietary ingredient before use (111.75(a)(1)(i)); component specifications for identity, for what is needed to ensure the supplement’s purity, strength and composition, and for limits on contamination were not established (111.70(b)); product specifications were not established (111.70(e)); a reserve sample fell short on retention time and quantity (111.83(b)); and a personnel practices measure was missing (21 CFR 117.10).

Six of those eight are one chain, and reading them as a chain is our reading of the record rather than anything the record states. Nothing established what the material was supposed to be, so nothing downstream could test against it, so the supplier’s paperwork became the answer by default, and the paperwork did not carry what the rule asks paperwork to carry. The other two, the reserve sample and the personnel measure, sit outside that chain. What this does not evidence: we read the published inspection and observation records and nothing else, so nothing here says whether that facility held any certification, whether any product was unsafe, what the firm said in response, or what it did next. The firm is named because the agency published it. And do not carry the wrong lesson away from one record: the point is not that certificates of analysis are worthless. It is that a certificate is usable exactly to the extent that the qualification file behind it exists, and here nothing established what the material should have been in the first place.

The label does not tell you who made it

One piece of advice is worth taking apart, because acting on it sends you the wrong way. The advice is that a label reading “Manufactured for” or “Distributed by” marks a product to avoid.

The label of a food in packaged form has to conspicuously state the name and place of business of the manufacturer, packer, or distributor (21 CFR 101.5(a)). Where the food is not manufactured by the person whose name appears on the label, that name has to be qualified by a phrase revealing the connection the person has with the food, such as “Manufactured for” or “Distributed by”, or any other wording that expresses the facts (21 CFR 101.5(c)).

So the phrase is not a confession. It is the rule working. Any brand whose name is on a product it did not itself make carries one of those phrases because the rule requires it, and it is there precisely so that nobody is misled. What it does not do is name the maker, and the rule never asked it to. If you want to know who made a competitor’s product, the label will not tell you. If you want to know whether your own maker is sound, it tells you nothing at all.

What to ask for, in order

Each of the first six is a document the standard requires to exist somewhere, held by your maker or by the body that certified them. That the standard requires it is not proof that your particular maker has it, which is part of what you are finding out.

1. Which standard, and which body. Before anything else, because “GMP certified” on its own answers neither, and only an ANSI-recognized and approved body’s audit is recognized for this standard (NSF/ANSI 455-2, clause 5.3.3).
2. The audit report, not the certificate. The whole report and the grade in it. The standard describes the report as giving the company and its customers, existing or prospective, an accurate view of the site’s quality systems and its performance against the requirements, and it carries the status of corrective actions from past nonconformances and the improvements since the last audit (NSF/ANSI 455-2, clauses 5.6.1 and 5.6.3).
3. The scope and the exclusions, read against your own product in the standard’s terms for product category and technology. They are stated in the audit plan, in the report and on the certificate (NSF/ANSI 455-2, clause 5.3.4), and the same information is set for the certification body’s official listing (NSF/ANSI 455-2, clause 5.8.4). Where the body publishes that listing, check the certificate you were sent against it. It is the one independent check available to you, and it costs nothing.
4. The date of the last day anyone was in the building, and whether they were physically in it. The certificate can run seventy-five days past the twelve-month anniversary of that date (NSF/ANSI 455-2, clause 5.8.1), and an annual certification audit can be virtual under stated conditions with the next one required on site (NSF/ANSI 455-2, clause 5.4.4).
5. The nonconformances, the plans and the evidence. How many at each level, what was submitted within the ten business days, whether the body approved or rejected it, and whether objective evidence of implementation was required by the grade or left to the next audit (NSF/ANSI 455-2, clauses 5.7.1, 5.7.2 and 5.7.3). The table above is what each answer means for what was actually done.
6. Whether the certification body changed, and what went across. Where the previous audit was done by another body the site owed the new one last year’s report and its corrective action plans (NSF/ANSI 455-2, clause 5.4.5). Ask separately what regulatory history was disclosed, since the company has to give the body its inspection reports, warning letters and consent decrees since the last regulatory audit (NSF/ANSI 455-2, clauses 5.2 and 5.4.5).
7. The supplier qualification file for the ingredients in your own formula, not the certificates of analysis. The documentation of how each supplier was qualified, the periodic re-confirmation, and the quality approval of that basis (21 CFR 111.75(a)(2)(ii)(A), 111.75(a)(2)(ii)(C), 111.75(a)(2)(ii)(D), 111.105(b)), plus the identity test for each dietary ingredient (111.75(a)(1)(i)), what was selected to verify the finished batch (111.75(c)(1)), and the batch production record for your own lot numbers (111.260).

And three on your own side, which you can close this week without anyone’s cooperation. Where the part reaches you, they are yours whatever your maker does. Your own written procedures for holding and distributing operations, and your records of product distribution (21 CFR 111.453, 111.475(b)(1), 111.475(b)(2)). Your reserve samples of each lot you distribute, held as the part describes (111.83(a), 111.465(b)). And the records themselves: everything the part requires of you, or copies of it, readily available for inspection and copying by FDA when requested, kept for one year past the shelf life date where shelf life dating is used or two years beyond the distribution of the last batch they relate to (111.610(a), 111.605(a)).

What a “no” means, and when you are done

A refusal has two readings and they are not the same. It can mean the document exists and they will not send it. It can also mean there is no such document, because there was no audit under this standard. Certification is voluntary and its own annex says conformance to the standard alone does not imply certification (NSF/ANSI 455-2, Informative Annex 1), so a maker outside the scheme is not concealing anything and is not doing anything unlawful. Items two to six only exist for a maker inside it. The item that survives either way is the last one, because the supplier qualification file, the identity tests and the finished-batch verification are required of the maker by federal rule whether or not anybody ever certified them (21 CFR 111.75(a)(1)(i), 111.75(a)(2)(ii)(A), 111.75(c)). Ask for those first if you get nothing else.

If confidentiality is the reason given, the honest answer is that this standard does not settle it either way. The annex asks the certification body to keep your maker’s confidential information confidential, and the code-of-conduct element it lists runs to the body’s own people not disclosing information obtained during audits. Both of those bind the body, not your maker (NSF/ANSI 455-2, Informative Annex 1), and the standard separately requires a discussion of confidentiality applicable to the site at the opening meeting of the audit (NSF/ANSI 455-2, clause 5.5.1). What would restrict your maker is its own agreement with that body, which neither of us has read. Ask them to show you the clause they are relying on.

You are done when you can answer three things: which standard and which body, what the last report said and what the grade obliged, and whether the ingredients in your own formula were identity-tested and their suppliers qualified. A clean set — your technology inside the scope, the last audit on site and inside twelve months, no major nonconformance left open, an identity test for every dietary ingredient and a qualification file behind every certificate you were shown — is a good answer set, and it is worth being exact about what it establishes. It establishes that an approved body examined that site against that standard on a stated date, and that the file behind your material exists. It does not establish that the lot in your warehouse conforms, because no audit of a plant is a test of a lot. And it does not move where the exposure sits (21 U.S.C. 342(g)(1), 331(a), 331(c)). Past that point what remains is a commercial judgment rather than a documentary one, and it is yours to make.

Two neighbouring questions this page could not carry, both of which change what these answers are worth to you. Whether a written agreement with your maker moves any of the exposure described at the top is worked through in what a quality agreement actually protects you from. Whether the numbers all this testing is judged against are yours to set or theirs is worked through in who is responsible for the specification.