GMP Readiness: What FDA Actually Cites in Supplement & Cannabis Facilities

Supplier verification failures. Facilities accept a supplier's certificate of analysis and never identity-test the incoming lot themselves — even though 21 CFR Part 111 requires identity testing of dietary ingredients. When the wrong botanical ships, you get recalls like the Niwali tejocote / yellow oleander case.

Part 111 is the dietary supplement GMP rule — identity testing, batch records, the works. Part 117 is human food: GMP plus FSMA's hazard analysis and risk-based preventive controls. Part 507 is the animal-food equivalent of 117. Decision rule: supplements go to 111, human food to 117, animal food to 507.

Validation is the study that proves your cleaning procedure works — documented, with residue limits and evidence. Verification is the routine check that each cleaning was done right: visual inspection, swabs, review of the cleaning log. You need the procedure validated first; verification alone is just checking a box.

No. For dietary ingredients, Part 111 requires you to confirm identity yourself, with only limited exceptions. A COA is the supplier's claim about their lot; your identity test is your evidence about yours. Trust, but verify — literally.

Everything needed to reconstruct the batch: the master record it was made against, lot numbers of every component, each step performed with initials and dates, in-process test results, any deviations and their investigations, and review and approval before release. If a stranger can't rebuild your batch from the paper, it's incomplete.

Root cause and effectiveness. Real CAPA means the deviation was investigated to an actual root cause, the corrective action addresses that cause, and somebody checked later that it worked. Paperwork CAPA is “retrained the operator,” filed, forgotten — investigators can tell the difference in about ninety seconds.

“We clean between runs” with nothing written down — no procedure, no residue limits, no evidence the procedure works. It's especially common in shared-equipment cannabis and food facilities. Investigators want a validated procedure with limits that have a rationale, not a mop and a memory.

Yes, electronic records are fine — but then Part 11 controls apply: validated systems, audit trails, unique logins, no shared passwords, and data integrity throughout. Paper with gaps is bad; electronic records with shared logins and no audit trail are worse, because they look like you're hiding something.

Week 1: we review your documents and records against the applicable regulation and map the gaps. Week 2: facility walkthrough and interviews. Week 3: we validate findings with you and build a risk-ranked gap register plus SOP inventory. Week 4: you get the final gap report, a prioritized CAPA roadmap, and a readout call.

Remediation itself — we don't rewrite your SOPs or execute the CAPA plan inside the four weeks. It also isn't legal advice, and it isn't a mock FDA inspection. What you get is the diagnosis and the ordered treatment plan; your team can execute it, or remediation can be scoped separately.

Pricing depends on your facility’s size and scope — we agree a fixed fee in the statement of work before starting. Four weeks, fixed deliverables, no hourly meter running. The gap report, CAPA roadmap, and readout are yours whether or not we ever work together again.

Two reasons. First, state regulators and GMP certification bodies borrow the same framework — the systems discipline is identical even where the regulator differs. Second, the moment you touch hemp-derived products in interstate commerce or make health claims, federal rules can reach you. GMP readiness now is cheaper than scrambling later.