FDA Supplement Inspection: Get Your GMP Records Ready

When the call or the knock comes, most supplement firms discover the same thing: the manufacturing is fine, but the paper cannot prove it. An investigator does not watch you make a capsule and take your word that it was made correctly. The investigator reads records, and the records either show that you followed your own written procedures or they don't.

This guide walks through how I would get a dietary supplement facility's GMP records ready for an FDA inspection under 21 CFR Part 111. It covers what the investigator asks for, which records fail most often, how to run a mock records pull, what to do during the inspection itself, and how to respond if you receive a Form FDA 483.

What Does an FDA Inspection of a Supplement Facility Actually Look Like?

An FDA investigator arrives, presents credentials, and issues a Form FDA 482, Notice of Inspection. From that point the investigator is looking at two things at the same time: the physical plant and the records. Walking the floor takes a day or two in most facilities. The records review is where the inspection is usually won or lost.

The governing rule is 21 CFR Part 111, Current Good Manufacturing Practice in Manufacturing, Packaging, Labeling, or Holding Operations for Dietary Supplements. FDA published it on June 25, 2007 (72 FR 34752), and it applies to anyone who manufactures, packages, labels, or holds a dietary supplement. If you want the broader picture of how FDA inspections work across product types, our FDA inspection prep page covers the process end to end.

At the close of the inspection, the investigator may issue a Form FDA 483 listing observations. The form itself invites a written response, and FDA's stated practice is to consider responses received within 15 business days before it makes a final classification of the inspection. That window is short, and it is the reason your records need to be organized before anyone shows up.

Which Records Will the Investigator Ask For First?

In my experience the opening requests follow the product. The investigator picks one or two recent finished batches and asks you to pull everything behind them. That single request tests nearly every part of your system at once.

The retention rule sits in 21 CFR 111.605: records must be kept for one year past the shelf life date, or two years beyond the date of distribution of the last batch associated with those records, whichever applies under the rule. Records also have to be available for FDA inspection and copying. If you can't produce a record from a batch you shipped 18 months ago, that is an observation waiting to be written.

Here is how the main record categories map to the regulation:

If you read that table as a map of where FDA warning letters for supplement firms tend to come from, you won't be far off. The recurring themes are missing or inadequate specifications, no identity testing on incoming dietary ingredients, master and batch records that don't match, and quality control that exists on paper but never made a decision.

How Do You Build a Batch Record That Survives Scrutiny?

A batch production record has one job. It proves that what happened on the floor matched the master manufacturing record that quality control approved. The two documents must be read side by side, and that is exactly what the investigator will do.

Under 21 CFR 111.260, the BPR has to capture things like the batch number, the equipment and processes used, the identity and weight or measure of each component, the actual yield compared with the theoretical yield, and the dates and initials of the people who did and checked each step. Under 111.210, the MMR has to specify the same elements in advance, including the theoretical yield and the point where you will check it.

The failures I see most often are not dramatic. They are small gaps that add up:

• A component weighed and recorded, but nobody second-checked it as the MMR requires.
• Actual yield outside the acceptable range from the MMR, with no documented investigation or quality control disposition.
• A handwritten correction with no initials, no date, and no reason.
• A BPR that references an MMR revision that was superseded months earlier.
• Blank fields left on the form, which an investigator reads as steps that did not happen.

Records made at the time of the work are credible. Records reconstructed the next morning from memory are not, and investigators can usually tell the difference from the handwriting alone. In my view, the fix here is rarely a new form. It is a floor team that understands why the form exists, which is a training problem more than a paperwork problem. Our piece on personnel training is worth a read if that is where your gaps are.

What Is the Biggest Records Gap in Most Supplement Facilities?

Identity testing and specifications, by a wide margin. Under 21 CFR 111.75(a)(1), you must conduct at least one appropriate test or examination to verify the identity of each dietary ingredient before you use it. A certificate of analysis from the supplier does not satisfy that requirement on its own. You can rely on a supplier's COA for other component attributes only if you qualify the supplier, which means establishing the reliability of its analysis through confirmation at appropriate intervals, and you document that qualification.

Specifications are the foundation. Under 21 CFR 111.70 you establish them for each component, for in-process controls where necessary, for the finished batch, and for packaging and labeling. If the specifications are vague, the testing is meaningless, and the batch records have nothing to be measured against.

The questions I would ask myself before an inspection:

1. Does every raw material in the building have a written specification, and does that specification include an identity test?
2. Is the identity method scientifically valid for that material, and can I show how I know?
3. If I rely on a supplier COA for anything, where is my documented supplier qualification?
4. Do finished product specifications cover identity, purity, strength, composition, and the limits on contaminants that could adulterate the product?
5. When a result fell outside specification, is there a record of who reviewed it and what they decided?

If any of those answers is "I think so," go find the document now.

How Do You Run a Mock Records Pull Before the Investigator Arrives?

Pick a finished batch that shipped in the last year, and pretend you are the investigator. I'd suggest doing this with someone who did not make the batch, because the person closest to the work will fill in gaps without noticing.

Start with the finished product and trace backward:

1. Pull the batch production record and the MMR revision in force on the manufacturing date.
2. Confirm every component lot in the BPR has a receiving record, an identity test result, and a quality control release.
3. Check that the finished batch test results meet the specifications, and that someone in quality control documented the disposition.
4. Verify the equipment used was cleaned and calibrated, with records dated before the run.
5. Confirm the label on the product matches the approved label in the packaging records, including the reconciliation of labels issued and used.
6. Check for any complaints tied to that lot and the investigation records that go with them.
7. Time the whole exercise. If it takes your team four hours to assemble a batch file, you are not ready, because an investigator asking for it will not wait that long without drawing conclusions.

Repeat with a second batch, preferably one with a deviation or an out-of-specification result, since those are the batches that expose whether your system actually works. A mock pull on the cleanest batch in the building tells you very little.

If you want a structured checklist to run this exercise, the GMP audit prep guide is available as a download.

Do Brand Owners and Amazon Sellers Need to Worry About This Too?

Yes, and this is the part many brand owners miss. FDA's position, stated in the preamble to the 2007 final rule (72 FR 34752), is that a firm that contracts out manufacturing, packaging, or labeling remains responsible for ensuring the product it puts into commerce complies with Part 111. Hiring a contract manufacturer does not move that responsibility to the contractor.

In practice, that means a brand owner needs its own set of records: the quality agreement, specifications it has approved, records showing it reviewed and released batches from the contractor, complaint handling, and adverse event files. If FDA inspects your contract manufacturer and finds problems with your product, you will hear about it. If FDA inspects you directly, an empty quality file is a finding.

The related question I get constantly is whether an Amazon seller using a contract manufacturer still needs a quality system of its own. The short answer is yes, and we cover it in detail in this article on selling your own supplement brand through a contract manufacturer.

What Else Will the Investigator Look At Besides Batch Records?

Several systems sit around the batch file, and each has its own records.

Complaints and adverse events. Under 21 CFR 111.553 and 111.560, you need written procedures for product complaints, and a qualified person must review and investigate each one involving possible failure to meet specifications or CGMP. Separately, section 761 of the Federal Food, Drug, and Cosmetic Act (21 U.S.C. 379aa-1) requires the responsible person to report serious adverse events to FDA within 15 business days of receiving the report. Investigators routinely ask to see both the complaint log and the adverse event file, and they compare the two.

Facility registration. Food facility registration under 21 CFR Part 1, Subpart H must be renewed every two years during the period from October 1 to December 31 of each even-numbered year (21 CFR 1.230). Because this article is dated October 2026, the renewal window is open right now. An expired registration is an easy observation to avoid.

Sanitation and pest control. The physical plant requirements in 21 CFR 111.15 cover cleaning, pest exclusion, and sanitary facilities. Logs for cleaning and pest control service reports are among the first documents requested on the floor walk. Our guide to a sanitation program goes into what a defensible program looks like.

Labeling and allergens. Labels are a records issue as much as a design issue. Packaging and labeling operations under Subpart L of Part 111 require control over label issuance and reconciliation, and an allergen mix-up in the packaging room is among the more serious findings an investigator can write.

What Should You Do During the Inspection Itself?

Preparation matters most, but conduct on the day matters too. A few practical points:

• Name a single point of contact who accompanies the investigator and a records runner who retrieves documents. Keep the rest of the team out of the way unless asked.
• Answer the question asked. If an investigator asks to see the cleaning log for Line 2, bring the cleaning log for Line 2.
• Keep your own copies of every document handed over, and note what was provided and when.
• Don't guess. If you do not know, say you'll find out and follow up. A wrong answer given quickly causes more trouble than a right answer given an hour later.
• Correct what you can on the spot, but never alter, backdate, or create records to fill a gap. Altered records turn a documentation observation into a data integrity problem, which is a different and far more serious conversation.
• Hold a daily wrap-up. Many investigators will discuss emerging observations at the end of each day. Take notes and begin working on responses that evening.

If your records are electronic, remember that 21 CFR Part 11 applies when you use electronic records to satisfy a predicate rule requirement. Audit trails, access controls, and signature controls will be part of the conversation.

How Do You Respond to a Form FDA 483?

Treat the 483 as a draft of your next warning letter if you do nothing with it. The response is a written document, and it should do four things for each observation: acknowledge it, explain the root cause, describe the corrective action already taken or underway with dates, and describe how you'll prevent recurrence.

A few lessons I'd pass along:

• Respond within the 15 business days. A late response may not be considered before FDA classifies the inspection.
• Provide evidence, not promises. Attach the revised procedure, the training record, the retested results.
• Look beyond the single batch. If one MMR was out of date, ask how many others are. Investigators notice when a response fixes the example and ignores the system.
• Commit only to what you can deliver. Missed dates in a response become the next observation.

A 30-Day Records Readiness Plan

If you have an inspection looming, here is a sequence I would follow, even if the full cleanup takes longer.

Close the gaps that put product at risk first, such as missing identity testing. Cosmetic documentation problems come second. And whatever you find, fix it going forward and document that you fixed it; do not rewrite history.

Preparing for an inspection is really an exercise in finding out whether your quality system works when nobody is watching. The facilities that do well are usually the ones whose records already tell an honest story, including the parts where something went wrong and somebody caught it. For help with the dietary supplement side of this work, see our dietary supplements page, or reach out to me at Certify Consulting.

Jared Clark, JD, MBA, PMP, CMQ-OE, CQA, CPGP, RAC GMP Compliance Consultant, Certify Consulting

Last updated: 2026-10-13

Frequently Asked Questions

What records does FDA review first during a dietary supplement inspection?

Investigators typically select one or two recent finished batches and ask for the full file: the batch production record, the master manufacturing record in force at the time, component identity test results, finished batch test results, equipment cleaning and calibration records, and quality control disposition. Specifications under 21 CFR 111.70 and identity testing under 111.75 are common focus areas.

How long must supplement GMP records be kept under 21 CFR Part 111?

Under 21 CFR 111.605, records must be kept for one year past the shelf life date if shelf life dating is used, or two years beyond the date of distribution of the last batch associated with those records, and they must be available for FDA inspection and copying.

Is a supplier certificate of analysis enough to meet identity testing requirements?

No. Under 21 CFR 111.75(a)(1), you must conduct at least one appropriate test or examination to verify the identity of each dietary ingredient. A supplier COA can be relied on for other component specifications only if you have qualified the supplier and documented that qualification.

How long do I have to respond to a Form FDA 483?

FDA's stated practice is to consider written responses received within 15 business days of issuance before it makes a final classification of the inspection. Responses should include root cause, corrective actions with dates, supporting evidence, and preventive measures.

Do brand owners that use contract manufacturers need their own GMP records?

Yes. In the preamble to the 2007 final rule (72 FR 34752), FDA stated that a firm that contracts out operations remains responsible for ensuring its product complies with Part 111. Brand owners should maintain quality agreements, approved specifications, batch release records, complaint files, and serious adverse event reports.