How to choose a supplement manufacturer: cGMP, certifications, FDA records and the audit questions

A supplement manufacturer makes your product, but your brand answers for it. Here is what 21 CFR Part 111 requires of a manufacturer, what third-party certifications do and don't prove, how to check FDA's public records before you sign, what goes in a quality agreement, and the questions to ask on an audit.

By the RevvyScales teamUpdated Oct 21, 202611 min read

On this page

What does a supplement manufacturer do?
What does cGMP require of a supplement manufacturer?
Does hiring a manufacturer make you responsible?
What do supplement certifications actually prove?
How do you check a manufacturer's FDA record?
What goes in a quality agreement?
Samples, stability and the first batch
Audit questions to ask a supplement manufacturer
What to do before you sign
Frequently asked questions

To choose a supplement manufacturer, check four things before price: that it follows FDA's current good manufacturing practice rule (21 CFR Part 111), which third-party audits or certifications it holds and what they cover, what FDA's inspection and warning letter records show, and whether it will sign a quality agreement with a certificate of analysis for every lot. Then compare quotes.

What does a supplement manufacturer do?

A contract supplement manufacturer turns your formula into finished, labeled product. Depending on the company, that can mean sourcing and testing ingredients, blending, encapsulating or pressing tablets, filling powders or gummies, bottling, labeling, testing finished lots and keeping reserve samples. Some also offer formulation, label design and fulfillment. Others specialize in one format and send steps such as packaging to another company.

That last point matters more than it sounds. Each company that performs an operation on your product has cGMP duties for that operation (more on that below), so ask for a written map before you sign: which facility does each step, and which steps are subcontracted. Then the work runs in this order:

From first quote to first released lot

Ask each manufacturer how long each step takes; it varies

ShortlistSearch FDA's records, then sign NDAs with three candidates
Quotes and questionsThe same audit questions to each, with documents behind the answers
Audit and samplesVisit or audit the facility; judge samples against your brief
Quality agreementSpecification, testing, COAs, release, change control, audits
Label approvalRequired statements and claims reviewed before printing
Production and testingIdentity tests on ingredients, the finished lot tested against the specification
Your releaseCompare the COA with the specification, then approve the lot

The order is the point. The audit, the samples and the quality agreement come before the purchase order, because after it you're negotiating with a supplier that already has your money.

What does cGMP require of a supplement manufacturer?

FDA's current good manufacturing practice rule for dietary supplements is 21 CFR Part 111, published in June 2007. It applies to anyone who manufactures, packages, labels or holds a dietary supplement (21 CFR Part 111). Here are its core requirements and what to ask to see for each:

Part 111 requirement	What the rule says	Ask to see
Specifications (111.70)	Product specifications for identity, purity, strength and composition, plus limits on contaminants	The specification for your product
Identity testing (111.75(a)(1))	At least one appropriate test or examination to verify the identity of each dietary ingredient	The method used for each of your ingredients
Supplier certificates (111.75(a)(2))	For other components, and for specifications beyond identity, a supplier's certificate may be relied on once that supplier is qualified	How each supplier was qualified
Finished batch (111.75(c))	Verify that finished batches meet product specifications: every batch, or a subset chosen by a sound statistical sampling plan	A recent certificate of analysis (COA) for a similar product
Master manufacturing record (111.205)	A written record for each unique formulation	Who writes yours and who approves changes
Batch production record (111.255)	Prepared every time a batch is made	A redacted batch record
Quality control (Subpart F)	Quality control operations, including decisions on product complaints and returned product	How complaints are logged and investigated
Reserve samples (111.83)	Each packaged lot, at least twice the quantity needed for its tests, kept 1 year past the shelf life date or 2 years after the last distribution	Where your samples are kept
Records (111.605)	Kept 1 year past the shelf life date, or 2 years after the last batch is distributed	How you get copies

A COA is the document that reports a lot's test results against its specification. None of these requirements tells you whether a manufacturer actually meets them. That's what the audit, the certificates and FDA's records are for.

Does hiring a manufacturer make you responsible?

Yes. FDA's Small Entity Compliance Guide for Part 111 works through this exact case. A distributor that contracts with a manufacturer to make a supplement sold under the distributor's own label "has an obligation to know what and how manufacturing activities are performed", and it must be able to decide whether the product meets its established specifications and whether to approve and release it for distribution (FDA Small Entity Compliance Guide). The same guide says contractors must follow the parts of the rule that apply to the operations they perform, and that a distributor holding stock must meet the rule's holding and distributing requirements.

In practice, the manufacturer's paperwork becomes your evidence. You need the specification, a COA for every lot, access to batch records when something goes wrong, and your own record of each release decision. This isn't legal advice: the rule and the guide are linked so you can read them yourself, and a regulatory consultant can review your setup.

What do supplement certifications actually prove?

Third-party marks help, as long as you know which question each one answers.

Facility GMP certification. NSF/ANSI 455-2 is NSF's good manufacturing practice audit standard for dietary supplements. Facilities involved in manufacturing, packaging, and warehousing and distribution are in scope, and the audit covers regulatory requirements, retailer quality requirements and industry best practices. Certified companies appear on NSF's listings for dietary supplement GMPs, so check the listing yourself (NSF/ANSI 455-2). NSF's page doesn't name Part 111, so read the certificate as NSF's finding, not FDA's.
Product verification. The USP Verified Mark says a product contains the ingredients listed on its label in the declared strengths and amounts, doesn't contain harmful levels of specified contaminants, breaks down and releases its ingredients within a specified time, and was made under FDA and USP good manufacturing practices (USP). NSF runs product certifications too, such as NSF Certified for Sport, separately from its GMP certification.
Lab accreditation. ISO/IEC 17025 sets the general requirements for the competence of testing and calibration laboratories. Accreditation covers only what is listed on the lab's scope, so check that your exact test (an identity method, heavy metals, microbial limits) is on it (A2LA FAQ). A2LA and ANAB both accredit laboratories to the standard.

Side by side, the three answer different questions:

Three kinds of quality marks

Each answers a different question

The factoryFacility GMP certification

Example: NSF/ANSI 455-2
Audits how a facility makes, packs or stores supplements
Says nothing about one product's potency
Verify it on the certifier's own listing

The productProduct verification

Example: USP Verified Mark
Tests a finished product against its label
Covers that product, not the plant's other products
Belongs on your label only if your product earned it

The labLab accreditation

Standard: ISO/IEC 17025
Covers only the methods on the lab's scope
Check the scope with the accreditation body
Makes a COA more credible, not a product better

One rule follows from the table. A facility certificate doesn't make your product certified, and a product mark belongs on your label or your sales page only if your product earned it. Anything else is a false claim, however small the logo.

How do you check a manufacturer's FDA record?

FDA publishes two records worth searching before you sign.

Warning letters. FDA's Regulatory Procedures Manual calls a warning letter "the agency's principal means of achieving prompt voluntary compliance" with the Federal Food, Drug, and Cosmetic Act (RPM, chapter 4). The letters' database can be searched by keyword and company and filtered by issuing office, issue date and whether a response or close-out letter is posted (FDA Warning Letters). Letters can appear weeks after they are issued, so search again just before you sign.
Inspection classifications. FDA classifies inspections as NAI (no action indicated: an acceptable state of compliance), VAI (objectionable conditions the facility can correct voluntarily) or OAI (official action indicated: an unacceptable state of compliance). Its Inspection Classification Database page sends you to the FDA Data Dashboard for the data, and warns that the list is not complete: inspections by states, among others, are left out (FDA Inspection Classification Database).

Read what you find in context. A VAI inspection with a Form FDA-483 that the company answered thoroughly is a different story from an OAI classification, or from an open warning letter about identity testing. Ask the manufacturer about anything you find, and ask directly for its last inspection date and any 483 observations; a good partner will walk you through them.

An empty search proves little on its own. Not every inspection is listed, and a young facility may simply not have been inspected yet. Treat a clean record as one input next to the audit and the documents, not as a seal of quality.

What goes in a quality agreement?

A quality agreement turns the manufacturer's promises into obligations. It sits next to the supply contract, which covers price and delivery, and says who does what for quality:

Clause	What it should say
Specification	The agreed specification for your product; changes need your written approval
Testing	Identity tests on every dietary ingredient, the finished-lot tests and which lab runs them
Certificates of analysis	A COA with every lot: each result, its specification, the method, the lot number
Release	You approve each lot before it ships to you or to your customers
Change control	Notice before any change of ingredient supplier, process or facility
Records	Batch records and test data available to you on request, kept for the Part 111 period
Reserve samples	Who keeps them, where, and for how long
Complaints and adverse events	How fast each side passes them to the other, and who investigates
Failed lots and recalls	What happens to a lot out of specification, who pays, how a recall would run
Audits	Your right to audit with notice, and to bring a consultant

A buyer's injury claim still comes to your brand, whoever filled the bottles: supplement liability insurance explains that cover and why recalls need separate policies.

Ownership belongs in the contract too: who owns the formula, the specification and the label artwork. The private label post explains why that clause decides whether you can ever switch manufacturers.

Samples, stability and the first batch

Order samples before you commit to a full run, and judge them against your brief: look, smell, taste, capsule size, how a powder mixes. Then look at the paperwork that comes with them. A manufacturer that can't produce a COA for a sample is telling you something.

If your label will carry a shelf life or best-by date, ask what stability data supports it and how long the study ran. Part 111 writes its reserve sample and record rules around a shelf life date "if shelf life dating is used", so whether to print a date is your choice, but once it is on the label it has to be true.

For the first production lot, compare every COA result with the specification before you approve the release, file the COA with the batch documents, and send a retained sample to an independent ISO/IEC 17025 lab for the tests your claims depend on. Then make sure the sales page says no more than the label and the COA support. On a RevvyScales VSL page, an ingredients content section can list each ingredient and amount exactly as the label does (content sections), and the scientific references block lists the studies behind your claims (comments and references).

Audit questions to ask a supplement manufacturer

Use these on the first call, again on the visit, and compare the answers with the documents you're shown:

Audit questions for a supplement manufacturer

The label is the other half of the first order. The supplement label requirements post covers what it must say, and the start a supplement company post shows where the manufacturer fits in the whole launch.

What to do before you sign

Search FDA's warning letters and inspection data for every facility on your shortlist.
Send the audit questions to three manufacturers, and ask for the documents behind the answers.
Visit or audit the strongest candidate, or hire a consultant to do it.
Sign the quality agreement before the purchase order, not after it.
Set your own release step: no lot ships until someone on your side has compared its COA with the specification.

Frequently asked questions

What is a cGMP supplement manufacturer?

One that follows FDA's current good manufacturing practice rule for dietary supplements, 21 CFR Part 111. The rule requires specifications for each product, at least one identity test for every dietary ingredient, master and batch records, quality control, reserve samples and record keeping. A cGMP line on a website is a claim, not a certificate, so ask for audit reports, a third-party GMP certification you can verify and the facility's FDA inspection history.

Is NSF certification the same as FDA approval?

No. NSF/ANSI 455-2 is NSF's own good manufacturing practice standard: NSF audits a facility against regulatory requirements, retailer quality requirements and industry best practices, and lists certified companies on its site. FDA's role is separate: it inspects facilities, classifies the inspections and issues warning letters. A certificate is good evidence about a facility, but it is NSF's finding, not FDA's, and it doesn't certify any one product.

How do I check if a supplement manufacturer has FDA violations?

Search FDA's warning letter database by company name, then check the FDA Data Dashboard for inspection classifications: NAI, VAI or OAI. Neither is complete or instant. Letters can appear weeks after they are issued, and some inspections, such as those by states, are not included. Ask the manufacturer for its last inspection date and any Form FDA-483 observations, and read how it responded.

Can a manufacturer use a supplier's certificate of analysis instead of testing?

Partly. Part 111 requires at least one appropriate test or examination to verify the identity of every dietary ingredient, unless FDA grants an exemption by petition, so identity can't rest on a supplier's paperwork alone. For other components and other specifications, a manufacturer may rely on a supplier's certificate once it has qualified that supplier by establishing that its certificates are reliable. Ask how each of your ingredient suppliers was qualified.

Do I need a quality agreement with my supplement manufacturer?

Get one. The supply contract covers price and delivery; the quality agreement covers specifications, testing, certificates of analysis, release, change control, records, complaints, failed lots and audits. FDA's guidance expects a brand that sells under its own label to know how its product is made and to decide whether it meets its specifications, and a quality agreement is how you get the information to do that.