Find out what NSF/ANSI 455-2 will say about your plant, before the auditor does.
Send us your procedures, your validation packages, and a sample of your records. We read the whole standard against all of it and tell you what is wrong, while there is still time to fix it.
FDA has written 23,440 observations against 21 CFR Part 111 across 2,507 supplement facilities. Part 111 is the floor this standard is built on, not the ceiling.
The standard behind “we need you GMP certified.”
It is what a supplement plant gets audited against when a retailer, a customer or a distributor asks for certification. Most people meet it as one line in an email and assume it is the federal GMP rule with a certificate stapled on.
It is not. Clause 1.2 says the standard audits your product to 21 CFR Part 111 and to additional retailer requirements layered on top. Then it asks for work federal law never asked of a supplement plant: a written recall plan, mock recalls every year that have to come back between 99.5% and 101.5% inside four hours, environmental monitoring, supplier qualification for every ingredient rather than only the ones you take a certificate on, and a corrective and preventive action program covering every nonconformance, where Part 111 asks only for corrective action plans for when a specification is not met.
You can run a plant FDA has been happy with for a decade and be missing every one of those.
And it is not only Part 111.
Section 2 names five more federal rules and makes them requirements of this standard by reference. An auditor can write you up under any of them. Most people reading it as “the GMP standard” have never opened one.
If your batch records, training records or approvals live in software, this is in scope. It is the one almost nobody has read.
Import an ingredient and you owe a modified FSVP. Meet your Part 111 specification duties and 1.511 lifts § 1.502, §§ 1.504 through 1.508 and § 1.510 — supplier verification at 1.506 among them — leaving § 1.503 and § 1.509.
Clause 4.2.7 puts this on you by name: someone qualified has to be responsible for transport operations meeting it.
Named directly, including the recall-plan rule Part 111 facilities are normally exempt from.
Food defense. The Audit Requirements Guidance also says documentation of your exemption status under it should be available.
The standard exists to audit Part 111 plus what the retailers wanted added. Meeting the federal rule is not the whole test.
Then there is your lab, whoever runs it. The Audit Requirements Guidance that goes with the standard, the document an auditor works from, says at 4.3.2.4 that suppliers should be defined to include contract laboratories, which drops your lab straight into the risk-based supplier qualification program clause 4.3.1 requires. It goes further at 4.6.14.9: a contract laboratory should be qualified against defined and documented selection criteria, and periodically reviewed for its performance. Sending work to an accredited lab is how most people evidence that. Almost nobody has written the criteria.
And your own lab does not get the easy ride. Laboratory operations, facilities, controls, equipment, calibration and separation each carry their own clauses aimed straight at it.
NSF/ANSI 455-2 System Assessment
We read the whole standard against your system, tell you what is wrong with it, and tell you what to fix first.
And it is built to survive more than one auditor’s reading. Regulatory Options does not put one reader on your system. We examine every clause against the documents meant to answer it, the records meant to prove it, the technical discipline behind it, and everything elsewhere in your system that could contradict it. We make those reads independently and then reconcile them into one answer, so forty findings that all come from one missing control arrive as one problem with every affected clause attached.
The certification auditor still decides. They simply have far less left to work out for themselves.
What this covers
- Whether what you have already written is good enough, requirement by requirement
- Which of your documents answers which requirement, and where inside it
- Whether the certificates and testing you already pay for actually cover you
- Whether the lab you use was ever qualified, and whether your own lab meets the clauses aimed at it
- What an auditor would write up, and the exact thing that would close it
- Where the standard asks for more than Part 111 ever did, and whether you have it
- Which requirements no document can answer, because they are about the building or about what people do
- What to fix first, so you do not do the same work twice
What you get back
Every requirement of the standard, in the order the standard puts them, marked answered or not. Where one of your documents answers it, we name the document and the page. Where nothing does, we say so and leave it blank.
Then the things that are not simply missing. What is there but does not go far enough. What one of your documents says that another one contradicts. What a procedure claims happens that your records do not show happening.
When forty findings all come from one missing procedure, we write it once and point the rest at it. You get the cause, not the pile.
And we tell you what to fix first. Fix the procedure before you rewrite a year of records to match it, not after. Every entry names the thing that is absent: the evidence, the decision, or the document. Not how to run your plant.
You get the assessment, and a workbook listing every requirement against the document that answers it. Hand that one straight to the auditor.
What you send
Your procedures and controlled documents, your qualification and validation packages, and a sample of your records. We tell you which records and which dates, so you are not guessing and you are not uploading the whole file room.
Five business days, from the day we confirm we have everything. If something important is missing, you hear about it before the clock starts.
What this catches
A plant FDA has never had a problem with, read against this standard. The company is made up. The rules underneath are real and you can look every one of them up.
Three years of certificates, and no supplier decision anywhere.
A certificate of analysis on file for every lot of every raw material, going back three years. Nothing missing.
Every certificate is the supplier’s own. Nothing anywhere records who decided that supplier was acceptable, on what basis, or when anyone looks at that decision again.
This fails both bars. Part 111 lets you lean on a supplier’s certificate only if you qualified the supplier first, wrote down how, re-confirm the certificate periodically, and had quality control approve the basis. Then clause 4.3.1 goes further and wants a risk-based qualification program for every ingredient whether you lean on a certificate or not, and 4.3.2 wants requalification, disqualification and emergency approval written as procedures of their own.
A recall procedure nobody has ever run.
A written procedure naming a recall coordinator and describing how customers would be told.
Nobody has ever run a traceability exercise, and nothing says how often one should happen.
Clause 4.6.19 wants a written recall plan that names the steps and who takes them. Clause 4.6.20 wants traceability and mock recalls at least once a year, forward and backward, landing between 99.5% and 101.5% inside four hours. Part 111 itself carries no recall requirement, and Part 117 does not supply one here: 21 CFR 117.5(e) lifts subparts C and G off a facility for a dietary supplement it makes in compliance with Part 111 and with section 761 of the Federal Food, Drug, and Cosmetic Act, and the recall-plan rule sits in subpart C. On paper, a procedure nobody has ever run looks exactly like one that works.
Every lot passes. Nobody has ever tested the plant itself.
Finished-product testing on every lot, passing results throughout.
Nothing samples the room the product is made in. There is no environmental monitoring program, because federal law never asked for one.
Clause 4.5.84 wants a risk-based environmental monitoring program with controls to evaluate and mitigate the presence of nonpathogenic microorganisms in your production areas and equipment. Part 111 sets none at all. Passing lots tell you about those lots. They do not tell you the plant is drifting.
Made-up company, real rules. We write these to show you the kind of thing that gets found, not to claim we found it. Your assessment is written against your own documents.
Price
All purchases are final. Fees are non-refundable once we begin work on your order — for a service, when you submit the records we request. Terms of Service.
What actually lands on your desk.
Four pieces of a finished assessment, opened here on the page. They come out of one written against a company we invented, so you can see the shape of the thing before you pay for it. The company, its documents and its records do not exist. The requirements underneath are the real, published requirements of the standard.
Cascade Nutraceuticals is invented, and so are its documents and its records. They were written to show what the deliverable looks like, not to claim a catch. The requirements they are read against are the real, published requirements of the standard. The standard’s own wording is not reproduced here; the clause identifiers and the federal citations are.
Every requirement of NSF/ANSI 455-2-2024, in the standard’s own clause order, with how it is answered, what that rests on and where inside it, and any finding against it. Five of the 695 rows.
The delivered workbook carries each requirement in the standard’s own wording. That wording is not ours to publish, so what you read below is our paraphrase of it. The clause identifiers and the federal citations are the standard’s own.
| Clause | The requirement, paraphrased | How it is answered | What that rests on, and where inside it | Finding |
|---|---|---|---|---|
| 4.1.1 | Whoever holds quality responsibility is not the post that runs operations. [21 CFR 111.12(b)] | Not found in what was supplied | Read against OOS-24-007 signature line, HR-TRN-01 “Competency by Function” first row, and LAB-2403-118 “Review & Approval”. Each of the three records the quality post and the operations or analyst post as one post; none establishes the separation the requirement calls for, and no organization chart, written assignment or delegation record was supplied. | 4.1.1 |
| 4.1.2 | The quality control work is identified, and it is carried out. [21 CFR 111.65] | Addressed, not settled from what was supplied | SOP-QC-012 §3.0 identifies the quality control duties, and OOS-24-007 and LAB-2403-118 record those duties being exercised on two lots. What was supplied does not reach whether quality control operations are implemented across manufacturing, packaging, labeling and holding: no batch production record, master manufacturing record or packaging and labeling record arrived, and none was declared as not existing. | No finding |
| 4.2.1 | Written procedures set out what quality control is responsible for. [21 CFR 111.87, 111.103, 111.105, 111.140(b)(1)] | Evidenced, no finding | SOP-QC-012 §3.0 Responsibilities. | No finding |
| 4.4.19 | Sewage and waste are plumbed away from the plant so they cannot reach contact surfaces, product, components or the water supply. [21 CFR 111.15(g)] | No document can answer it | Named at the front, under what documents could not answer. It turns on how the building is plumbed, which nothing you could send can settle, and no directed remote observation was purchased. It carries no finding. | No finding |
| 4.6.15 | Quality sets and approves the laboratory controls, including the sampling plans, how specifications are set, the test methods and the reference standards, and those methods are used to the criteria set for them. [21 CFR 111.315] | Evidenced, with a finding | LAB-2403-118, “Reference Standards & Reagents”; “System Suitability”. | 4.6.15 |
Eight dispositions run down that third column and every one of the 695 rows carries one. “Not found in what was supplied” says nothing was found in what was examined. It never says the control does not exist in your operation.
Constructed specimen. Cascade Nutraceuticals, its documents and its records do not exist and were written to show the deliverable. The requirements are the real, published requirements of the standard. Nothing here is a finding against any company.
Every document supplied and what each one points at, built from the same references the drawn map in the assessment is built from. Fourteen documents arrived.
| Your document | What it references | Was the reference supplied | What points at it | How many point at it |
|---|---|---|---|---|
| SOP-QC-012 | FORM-QC-12A; FORM-QC-12B; SOP-QA-005; SOP-QC-002 | None supplied | OOS-24-007; HR-TRN-01 | 2 |
| MV-RHO/ASH-01 | ASSAY-RHO/ASH-01 Rev. 0; SOP-QC-002 | None supplied | Nothing points at it, and nothing has to | 0 |
| LAB-WS-007 | ASSAY-RHO/ASH-01 Rev. 0; QC-CALC-Rhodiola.xlsx; LAB-2403-118 | LAB-2403-118 supplied; ASSAY-RHO/ASH-01 Rev. 0; QC-CALC-Rhodiola.xlsx not supplied | Nothing points at it, and something has to | 0 |
| LAB-2403-118 | ASSAY-RHO/ASH-01 Rev. 0; QC-CALC-Rhodiola.xlsx | None supplied | LAB-WS-007 | 1 |
| OOS-24-007 | SOP-QC-012; CA-24-006 | SOP-QC-012 supplied; CA-24-006 not supplied | Nothing points at it, and nothing has to | 0 |
| QC-RSV-01 | Record-retention SOP | None supplied | CMP-LOG-AS | 1 |
| HR-TRN-01 | SOP-QC-012; Record-retention SOP | SOP-QC-012 supplied; Record-retention SOP not supplied | Nothing points at it, and something has to | 0 |
| SQF-RHO-03 | Supplier certificates of analysis; RM-RHO | None supplied | Nothing points at it, and nothing has to | 0 |
| REG-CLM-AS500 | AS-LBL Rev. 3 (2023); Ingredient supplier monographs | None supplied | Nothing points at it, and something has to | 0 |
| CMP-LOG-AS | QC-RSV-01 | Supplied | Nothing points at it, and something has to | 0 |
| PDC-AS700-01 | MBR-AS700; MF-AS700 rev A; SOP-VAL-02; CC-25-031 | None supplied | Nothing points at it, and nothing has to | 0 |
| CWC-SQCA-220 | CWC-SCA | Supplied | CWC-SCA | 1 |
| CWC-SCA | CWC-SQCA-220 | Supplied | CWC-SQCA-220 | 1 |
| NNRG-SQ-014 | No document named | No reference to check | Nothing points at it, and nothing has to | 0 |
Sixteen of the twenty-one documents this set names were not themselves supplied. They get their own sheet in the workbook, and that is the sheet worked first: it is the shortest route to closing the largest number of open rows on the requirement map.
Constructed specimen. Cascade Nutraceuticals, its documents and its records do not exist and were written to show the deliverable. The requirements are the real, published requirements of the standard. Nothing here is a finding against any company.
Each finding is headed by the requirement it rests on and a short name for what is at issue. Findings sit in the standard’s own clause order, under the group stating what the assessment established about your record, and each one closes on the consequence that follows from it. This is one of eleven.
The delivered assessment heads the finding with the requirement in the standard’s own wording. That wording is not ours to publish, so the requirement line below is our paraphrase of it.
The release result reported for lot AS4830922 was not calculated against a reference standard that was within the expiry the record itself states for it.
LAB-2403-118, “Reference Standards & Reagents” table: the Rosavin reference standard, lot R04219, carries an expiry of 30 NOV 2023. The same report records the run as acquired 11 MAR 2024 and the reportable result as calculated from the bracketing Rosavin standard mean.
LAB-WS-007 for the same lot repeats the standard lot as R04219 and the reference-standard expiry as 11/30/23, and records the reportable value as transcribed from a spreadsheet named in the worksheet rather than calculated on the worksheet.
LAB-2403-118, “System Suitability”: the replicate-standard %RSD is entered as “not calculated” and the suitability acceptance criterion is entered as “per method file”, so the record carries no criterion the standard was judged against on the day of the run.
The reference standard is what the result is measured against; where its expiry has passed, the number the lot was released on has nothing established behind it.
What was supplied does not establish a supportable result for the release of lot AS4830922.
Constructed specimen. Cascade Nutraceuticals, its documents and its records do not exist and were written to show the deliverable. The requirements are the real, published requirements of the standard. Nothing here is a finding against any company.
One row per finding, in the standard’s own clause order. Eleven rows. This is one of them.
The delivered register carries the requirement in the standard’s own wording. That wording is not ours to publish, so the requirement cell below, and the one place another cell restates a clause, are our paraphrase.
QC-RSV-01, “Reserve Sample Records”, the row for lot AS4815602 (manufactured 11/2023, expiring 11/2026): the units retained column reads “none on file”, and the container, retain-until, storage and logged-by columns are each empty.
QC-RSV-01 is the only record supplied that addresses reserve sample collection; its header states the retention policy as written rather than referring to a procedure, and names no procedure that governs it.
Everything under “Yours to fill” is yours, and it is delivered empty. No owner is assigned, no date is set and no status is pre-filled, because each of those needs to know what your operation can absorb and nothing in this assessment knows that. There is no formula in the file, so you can add columns, add rows and set your own filters without breaking it.
Constructed specimen. Cascade Nutraceuticals, its documents and its records do not exist and were written to show the deliverable. The requirements are the real, published requirements of the standard. Nothing here is a finding against any company.
Straight answers.
You never see my plant. What is the point?
We read every requirement. The ones that are about the building, or about what people physically do, get named as exactly that and get no finding. The rest can be answered from what you send, and that is most of the standard. The walkthrough exists if you want the remainder answered too.
Will you tell me what grade I am going to get?
No, and nobody honestly can. Clause 5.5.9 leaves the severity of every finding to the auditor on the day, and under clause 5.6.2 the certification body reviews the report afterwards. What we can tell you first is which requirements your system does not answer.
Can I just download the checklist?
You can, and it will tell you the clauses exist. It will not open your recall plan and tell you the clause is still unanswered. Having a document is not the same as having one that answers the requirement. That gap is the whole job.
What if you find something we cannot fix in time?
Then you know before the auditor does, and you get to decide what to do about it. That is the point of the name. We lay out what is there and what would close it; which risks you carry into the audit is yours to choose.
Our audit is not booked yet. Is this useful now?
That is the better time for it. Getting on a certification body’s schedule takes months, and once a date is set they charge to move it. Everything this finds is work you would rather be doing before there is a date at all.
Is what I send confidential?
Yes. What you send is used only to do the work you paid for, seen only by the people doing it, never sold, and never used to train any public AI model. We retain it only as long as needed to deliver the work and meet our record obligations. Section 4 of the privacy policy, linked at the foot of every page.
This page is about one standard. You may need something else.
An assessment reads your whole system and tells you what is wrong with it. If that is not the job in front of you, here is where the rest of the work goes.
The questions people ask before they buy this.
Regulatory work product, not legal advice. An assessment is prepared from the records you submit and is not legal counsel, not a certification decision, and not a prediction of any audit outcome or grade — those are decided by the certification body. It is a read of documents, and no site visit is performed at any price. Every requirement that depends on physical conditions or observed practice is named as outside the read and gets no finding unless the optional facility walkthrough, a scheduled video call, is purchased, in which case each such finding states what was shown, by whom, and on what date. It relies on what you supplied and on your own declarations about your operation, none of it independently verified. Clause references are quoted from NSF/ANSI 455-2 and from its Audit Requirements Guidance. All companies and products shown in examples are constructed; any resemblance to a real company or product is coincidental. Regulatory Options is not affiliated with or endorsed by NSF.