cGMP Certification in the USA
Been asked for a cGMP certificate? Tell us what you make and where you make it, and we will tell you what a cGMP certification audit would actually look at. Talk to IAS.
Someone has asked your company for a cGMP certificate. A customer, a distributor, a contract giver, a buyer running a supplier questionnaire. You need to know what cGMP certification is, what the certificate proves, and what happens between now and holding one. This page answers that in order. It starts with what cGMP certification is not, because that is where most confusion begins.
What cGMP Certification Is Not
It is not a license to manufacture. It is not permission from any authority to sell a product. It does not replace a registration, a listing, an approval, or any filing your product may need before it goes to market. A certificate from a certification body and an authorization from a public authority are different objects issued by different kinds of organization for different reasons.
It is also not a product test. Nobody puts your tablet, powder, or cream on a bench and measures it during a cGMP audit. The audit looks at the system that produces the product, not at a sample of the output. If you need the product itself assessed, that is product certification, a separate route with its own product certification procedure.
And it is not a one-off event. cGMP compliance is a running state rather than a date on a document, and a certificate that arrives and then sits in a drawer for three years is a certificate that will not survive its first surveillance visit.
What cGMP Actually Asks of a Manufacturing Site
Current Good Manufacturing Practice is a way of running a site so that what you made yesterday, what you made today, and what you will make next quarter are the same thing. The word current is doing real work in that phrase. Practice that was acceptable a decade ago is not automatically acceptable now, and GMP certification reads your controls against how the sector works today rather than how it worked when your SOPs were first written.
The Six Themes Every cGMP Audit Covers
In practice the cGMP requirements repeat across food, pharmaceutical, cosmetic, supplement, and device manufacturing:
- Premises and equipment that suit the product, and are cleaned and maintained on a schedule someone actually follows.
- People who are trained for the job they do, with records that show it.
- Materials received, identified, quarantined, released, and traced.
- Process control — written procedures, in-process checks, and a way of knowing when something drifted.
- Documentation — batch records that let you reconstruct what happened months later.
- Deviation, complaint, and recall handling that works under pressure, not just on paper.
Nothing there is exotic. What separates sites that pass cleanly from sites that collect findings is whether the records match the floor.
The Same Themes, Different Weight in Each Sector
The headings above are common to every cGMP audit. What changes between sectors is which of them an auditor spends the most time on.
| Sector | Where the audit tends to concentrate | Question that comes up early |
|---|---|---|
| Food and beverage | Hygienic zoning, allergen segregation, pest control, sanitation verification, cold chain | How do you prove the line was clean before the next allergen profile ran? |
| Pharmaceutical and API | Batch record integrity, equipment qualification, process validation, release authority, data integrity | Who is authorized to release, and what did they see before signing? |
| Dietary supplements | Incoming material identity, label and claim control, blend uniformity, holding records | How did you confirm the ingredient is what the supplier says it is? |
| Cosmetics and personal care | Water systems, preservative controls, microbial limits, filling hygiene, batch retention | What is your water spec, and when was the system last verified against it? |
| Medical devices | Design and process linkage, environmental control, traceability to the unit, complaint feedback | Can you trace a single unit back through every process it passed? |
| Contract manufacturing | Quality agreements, contract giver approvals, decision rights, change notification | Which decisions are yours and which belong to the brand owner? |
A single site may sit in more than one row. If it does, say so at application, because the scope has to name every category you want covered.
Who IAS Is, and Who Assesses IAS
This is the part worth reading slowly, because it is the part most pages skip.
The certification body here is Integrated Assessment Services, known as IAS. IAS assesses your management system against the cGMP criteria for your sector and, if the evidence supports it, issues the certificate.
But a certification body cannot be the only judge of its own competence. So certification bodies are themselves assessed by accreditation bodies. IAS is accredited by UQAS. UQAS examines how IAS is run: auditor competence and qualification, impartiality arrangements, how decisions to grant or refuse certification are made, how appeals and complaints are handled, and whether the audit process is applied consistently from one client to the next.
What Accreditation Does and Does Not Tell You
Accreditation is an assessment of IAS. It passes no judgement on any manufacturer IAS has certified. UQAS has not visited your factory and has expressed no view about your product. What accreditation gives you is a reason to believe the audit behind your certificate was done to a defined standard by a body that is itself checked. You can read more about who IAS is and about how certification bodies are structured.
What the cGMP Certificate Covers, and What It Does Not
| What cGMP certification assessed | What it did not assess |
|---|---|
| The management system at the site or sites named on the certificate | Any site, line, or warehouse not written into the scope |
| The product categories listed in the scope statement | Products you make but did not declare |
| Whether documented controls exist and are being followed | Whether an individual batch meets its specification |
| Evidence available during the audit period | Everything that happened between visits |
| Conformity with the cGMP criteria applied | Conformity with any country’s statutes or regulations |
| The system as it stood on the audit dates | The system as it will stand in two years |
That table is the honest boundary of the document. It is worth sending to a customer who asks the certificate to prove more than it can. The cGMP certification brochure sets out the schemes and scopes IAS works to.
Who Usually Asks for cGMP Certification
Rarely does a manufacturer wake up wanting cGMP certification. The request normally arrives from outside:
- A retailer or distributor running supplier approval.
- A brand owner doing due diligence on a contract manufacturer.
- An export customer who needs something from a third party, not a self-declaration.
- A contract giver in pharma or supplements who is answerable to their own customers.
- A tender or RFQ with a supplier-standards annex.
If you also hold or are pursuing ISO 9001, ISO 22000, HACCP, or ISO 13485 — or ISO 27001 where data integrity is the sticking point — much of the underlying evidence overlaps. Combined audits are often practical. Say so at the application stage rather than after the plan is written.
Choosing the Right cGMP Certification Route for Your Situation
| If this describes you | The usual route | What to have ready first |
|---|---|---|
| A customer asked specifically for cGMP | cGMP certification of the named site | Scope, site list, product categories, current SOPs |
| You need the product itself assessed | Product certification | Specifications, test data, production controls |
| You want broad quality-system credibility | System certification | Process map, objectives, internal audit history |
| You are preparing a device for the US market | FDA-related support and 510(k) submission | Device classification, predicate work, design file |
| Your own team must run the internal audits | cGMP internal auditor training | Named candidates and their current roles |
| Your lab supports the release decision | ISO/IEC 17025 | Method validation, equipment calibration records |
The cGMP Certification Route From First Contact to Certificate
The sequence is not mysterious. It is the same shape for most applicants, and the general certification process applies here too.
- Application and scope. You tell IAS what you make, where, on how many lines, and with how many people. Scope errors here cause more trouble later than anything else on this page.
- Documentation review. Your quality manual, SOPs, batch record templates, and training records are read before anyone arrives. Gaps found here are cheap to fix. Gaps found on site are not.
- On-site audit. Auditors walk the floor, follow product flow, pull records, and interview the people who do the work. They are checking whether the written system and the observed system are the same system. The audit procedure sets out how this is conducted.
- Findings and corrective action. Nonconformities are written up with evidence. You respond with root cause, correction, and preventive action. Responses that only describe the fix, and never the cause, get returned.
- Decision. A person who did not perform the audit reviews the file and decides. That separation is deliberate and it is one of the things UQAS checks.
What Auditors Actually Look At on the Floor
A cGMP certification audit concentrates, roughly in this order, on:
- Traceability. Pick a finished batch. Walk it backward to raw material lots, equipment used, operators, and release. If that walk breaks, the audit slows down.
- Cleaning. Not the schedule — the verification. Who signed, against what acceptance criteria, and what happens when it fails.
- Change control. A supplier changed. A line was re-laid out. Show the assessment that happened before, not the note added after.
- Deviations. Open items, aging, and whether the same deviation keeps recurring under different numbers.
- Training. The operator in front of the auditor, doing a task, with a training record that covers that task. Where the role is new to someone, foundation training plus an on-the-job assessment is the usual evidence.
- Calibration and maintenance. Instruments that make release decisions, in date, with certificates on hand.
Area by Area, What cGMP Certification Evidence Is Expected
| Area | What the auditor examines | What satisfies it |
|---|---|---|
| Premises | Flow of people, materials and waste; separation of clean and dirty operations; environmental monitoring | A layout that matches the floor, and monitoring results with action taken when one drifted |
| Equipment | Suitability, cleaning method, logbooks, qualification after installation or modification | Equipment history showing use, cleaning and maintenance in one readable sequence |
| Personnel | Job-specific training, competence assessment, hygiene practice, who may sign what | A training matrix tied to roles, with evidence the assessment was more than attendance |
| Documentation | Version control, issue of blank records, correction practice, retention, system access rights | A current document at the point of use, and an obsolete one nobody can pick up by accident |
| Validation | Rationale for what was validated, protocols, acceptance criteria, results, revalidation triggers | A file that explains why the criteria were chosen, not only that they were met |
| Change control | What counts as a change, who assesses it, what is done before implementation | An assessment dated before the change, naming the areas reviewed |
| Complaints and recalls | Intake, investigation, linkage to batch records, recall decision, mock exercise | A complaint file that reaches a cause, plus one recall exercise that was timed |
| Supplier control | Approval criteria, monitoring, handling of a supplier that changed something | Evidence a supplier change was noticed by you, not reported by a customer |
What a Weak Answer Sounds Like Next to a Strong One
Auditors ask questions to find records, not to catch people out. The difference is rarely honesty. It is whether the answer ends at an opinion or at a document.
| Question | Weak answer | Strong answer |
|---|---|---|
| How do you know the line was clean? | “We always clean between runs.” | “Here is the cleaning record for that changeover, the acceptance criterion, and the swab result.” |
| Why was this deviation closed? | “It was a one-off.” | “Here is the investigation, the cause, the batches reviewed, and the check we added afterwards.” |
| Is this operator trained for this step? | “She has been here for years.” | “Here is her record for this SOP, the revision she was trained on, and the assessment.” |
| What happened when the supplier changed grade? | “It was the same material.” | “Here is the change assessment, the trial batch, and the specification update that followed.” |
| How do you control this document? | “It is on the server.” | “This is the controlled copy at the point of use; the previous revision was withdrawn on this date.” |
Notice that the strong answers are shorter. They are shorter because the work was done earlier.
cGMP Certification Findings That Recur, and What Prevents Them
- Records completed later. One hand, one pen, one sitting, for a shift that ran twelve hours. Record at the point of the activity, and make the record easy to complete there.
- Uncontrolled copies. A laminated sheet at the machine, two revisions behind the master. Withdraw physically, not only electronically.
- CAPA that is only correction. The batch was reworked; nothing was done about why. Require a named cause before a closure is accepted.
- Training that is attendance. A signature on a sheet, with no evidence anyone can perform the task. Assess on the job.
- Calibration lapses on release instruments. Tie the schedule to the instruments that influence release, not to the whole asset register.
- Scope drift. A new product line running under a certificate that never mentioned it. Treat scope as something to update.
Who Does What
| Activity | Your site | IAS |
|---|---|---|
| Define and declare the scope | Proposes it | Confirms it is auditable |
| Build and run the management system | Owns it entirely | Assesses it |
| Internal audits before the visit | Performs them | Reviews the outputs |
| Audit planning and team assignment | Confirms availability | Plans and assigns |
| Collecting audit evidence | Provides access and records | Samples and records findings |
| Root cause analysis and correction | Performs and documents | Verifies acceptability |
| Certification decision | No role | Independent reviewer decides |
| Ongoing conformity between visits | Maintains it | Samples it at surveillance |
| Use of certification marks | Applies the rules | Publishes the logo rules |
Keeping cGMP Certification, Not Just Getting It
A cGMP certificate runs on a cycle. After the initial audit there are surveillance visits, and before the cycle closes there is a recertification audit that looks at the system as a whole again. Surveillance is not a formality. It samples different areas each time, and it pays particular attention to whether the previous findings stayed fixed.
What to Do Between Audits
The period between the decision and the first surveillance visit is where habits set. Close out anything deferred to the next visit and keep the evidence together. Tell IAS about anything that changes the basis of the certificate — a new line, a moved site, a change of ownership, an undeclared product category — because a scope extension assessed in advance is ordinary, while one discovered during surveillance is a finding. If the same site also holds ISO 14001 or ISO 45001 certification, ask for those surveillance visits to be planned alongside this one; it costs the floor less time. And run one internal audit on an area the certification audit did not sample.
The sites that struggle are not the ones with weak systems. They are the ones that built a system for the audit rather than for the factory. Six months later the temporary controls have quietly stopped, and the next visit finds it.
What a cGMP Certificate Actually Evidences
Be precise about this when you send the certificate to a customer.
A cGMP certificate issued by IAS means that, on the dates of the audit, a sample of evidence at the named site supported a finding that the management system met the cGMP criteria within the stated scope. It means the audit was performed by a body whose competence and impartiality are assessed by UQAS.
It does not mean every batch is correct. It does not mean no deviation will occur. It does not mean the product is safe, effective, or fit for a particular customer’s purpose. It does not extend to sites or product lines outside the scope line. And it is not a guarantee of any future outcome — certification is based on sampling, and sampling has limits by design.
Saying this plainly protects you. A customer who understands the boundary will not later claim the certificate promised something it never did.
On Law and Regulation
This page describes a voluntary certification service. It makes no claim about the law in the United States or in any other country, and nothing here should be read as a statement of what any statute, regulation, or authority requires of you. Legal and regulatory duties depend on your product, your markets, your customers, and your corporate structure. Those questions belong with your own attorneys and regulatory advisers. Certification by IAS neither creates nor discharges any such duty.
Training and Preparation Before the Next Audit
The single cheapest improvement most sites can make is a competent internal audit program. If your internal audits are performed by someone who was handed a checklist and told to go look, they will find what the checklist says and nothing else.
cGMP internal auditor training and broader GMP training teach people to follow evidence rather than boxes. Teams that also run an ISO-based system tend to pair it with ISO 9001 internal auditor training, or send the person who leads the program to ISO 9001 lead auditor training. The wider ISO training courses in the USA cover the other schemes, and dates are listed on the training schedule.
A Short cGMP Certification Pre-Audit Checklist
- Fix the scope statement in writing. Every site, every product category.
- Run one full internal audit and close what it finds, properly.
- Do a traceability exercise on a real batch, timed.
- Check that every instrument used for a release decision is in calibration.
- Review open deviations and CAPAs. Age them. Explain the old ones.
- Confirm the people who actually perform the tasks will be on shift.
Ready to scope it out? Send us your site list and product categories and we will come back with a clear view of what cGMP certification would cover at your site. Call +1 (888) 493-0916 or email enquiry@iascertification.com, or compare cGMP with ISO certification in the USA.
Frequently Asked Questions About cGMP Certification
Is cGMP certification mandatory?
This page makes no statement about legal obligation. Certification by IAS is voluntary and is usually pursued because a customer, distributor, or contract giver asked for it.
Does the certificate cover my whole company?
Only what the scope says. If a second site or a new product line is not written into the scope, it is not covered. Extending scope means an assessment of the addition.
We already hold ISO 9001. Does that help?
Yes, practically. Document control, internal audit, corrective action, and management review overlap. It does not replace the cGMP-specific controls around hygiene, materials, batch records, and release.
What happens if we get a nonconformity?
You submit root cause, correction, and preventive action with evidence. Major findings usually require verification before a decision. Minor ones may be verified at the next visit.
Can the audit be done remotely?
Parts of a documentation review can be. A cGMP audit relies on observing the floor, so on-site work is central to it. Discuss any constraints at planning, not on the day.
Can we use the IAS mark on product packaging?
Marks are used under published rules, and system certification marks are not product marks. Read the logo usage guideline before printing anything.
What is the most common reason sites lose time?
Scope defined loosely at application. The audit plan then does not fit the factory, and days are spent renegotiating what should have been settled in the first conversation.