Current good manufacturing practices: a practical guide for food and supplement teams

Current good manufacturing practices, or cGMP, are the operating controls that keep regulated products from being made by guesswork. For food and supplement teams, that means more than clean rooms and binders. It means trained people, controlled facilities and equipment, qualified suppliers, written specifications, reliable testing, batch records, deviation handling, and a quality decision before a lot ships.

The hard part is turning those requirements into evidence your team can use on a normal production day.

What current good manufacturing practices mean

In FDA-regulated categories, current good manufacturing practices are the minimum systems, facilities, methods, and controls used to make sure products are made consistently and meet their intended quality standard. FDA's CGMP facts page explains the central idea well: cGMP is about proper design, monitoring, and control of manufacturing processes and facilities.

The word current matters. FDA uses it to signal that the system has to reflect up-to-date methods, equipment, technology, and quality expectations. A process that looked acceptable 20 years ago may no longer be enough if better controls are now standard for preventing contamination, mix-ups, or documentation errors.

For food and supplement brands, cGMP works as a proof system. Can the team show that the product was made from appropriate materials, under controlled conditions, against defined specifications, with records that explain what happened and who released the lot?

We see that proof system most clearly where testing, certificates of analysis (COAs), batch records, and compliance reporting meet. A lab result is useful only when it connects back to the right lot, specification, method, supplier decision, and release record.

Which cGMP rules apply

There is no single universal cGMP checklist for every regulated product. The right rule depends on the product category and operation.

FDA modernized food cGMPs in 2015, moving the human-food rule from Part 110 into Part 117 and pairing it with Food Safety Modernization Act (FSMA) preventive controls. FDA's food cGMP page is a practical starting point for that food-specific scope.

Dietary supplements have their own category-specific rule in Part 111. FDA's supplement cGMP guide says the rule applies to firms that manufacture, package, label, or hold dietary supplements, including foreign firms whose products are imported or offered for import into the United States.

The cGMP evidence chain

A strong cGMP program does not rely on one final test to prove quality. FDA makes that point directly for drug manufacturing, and the same operating lesson applies to food and supplement quality systems. Testing is necessary in many programs. Controlled manufacturing builds quality before the sample ever reaches the lab.

For quality teams, the evidence chain usually looks like this:

1. Supplier and material approval. The team has a reason to trust the supplier, ingredient, component, packaging, and related documents.
2. Specifications. The team defines what acceptable means before production starts.
3. Testing and examinations. Samples are evaluated using appropriate methods for the product, matrix, and risk.
4. Production records. Batch or lot records show what happened during manufacturing, packaging, labeling, and holding.
5. Quality review. A qualified quality function reviews results, deviations, records, and open issues.
6. Release and audit packet. The lot ships only after the evidence supports release, and the record can be retrieved later.

This is where cGMP becomes practical. It gives the quality team a way to answer retailer questions, customer audits, FDA inspections, complaint investigations, and internal release decisions without reconstructing the story from scattered PDFs and emails.

Food cGMP under Part 117

For food manufacturers, Part 117 starts with the basics that prevent contamination and poor sanitary conditions. Those basics include personnel hygiene, plant and grounds, sanitary operations, equipment and utensils, process controls, warehousing, and distribution.

Food teams should connect those basics to the food safety plan. Under Part 117, facilities that are subject to preventive-control requirements need a written food safety plan that includes hazard analysis, preventive controls, supply-chain program where required, recall plan, monitoring procedures, corrective-action procedures, and verification procedures.

A practical Part 117 program usually answers these questions:

• Are employees trained for the hygiene, allergen, sanitation, and production risks in their area?
• Is the facility designed and maintained to reduce contamination, pest, drainage, waste, and cross-contact risk?
• Are hazards translated into written process, allergen, sanitation, supply-chain, and recall controls where needed?
• Are monitoring, verification, and corrective-action records created at the time the work happens?
• Are suppliers approved and verified when a hazard depends on a supply-chain-applied control?

The food cGMP mistake we see most often is treating sanitation, supplier approval, test results, and records as separate tasks. Under a working cGMP system, they point to the same release question: does this lot have enough evidence to ship?

Dietary supplement cGMP under Part 111

Supplement cGMP is more specification-heavy because dietary supplements depend on identity, purity, quality, strength, and composition. FDA's dietary supplement backgrounder describes the rule as a way to help ensure supplements contain what the label says and are not contaminated with harmful or undesirable substances such as pesticides, heavy metals, or other impurities.

Part 111 puts clear weight on specifications. A supplement manufacturer needs specifications where control is needed, including component identity, purity, strength, composition-related specifications, contamination limits, in-process specifications, and finished-product specifications as applicable.

The highest-risk weak points are usually familiar to supplement quality teams:

• Ingredient identity. Before use, Part 111 requires at least one appropriate test or examination to verify the identity of any component that is a dietary ingredient, unless FDA grants an exemption.
• COA reliance. A supplier certificate of analysis can support some specification decisions only when the supplier is qualified and the required confirmation and documentation conditions are met.
• Master manufacturing records. Each unique formulation and batch size needs a written master manufacturing record that defines the intended process.
• Batch production records. Each batch needs records that show the lot, components, equipment, cleaning, yields, monitoring, testing, examinations, and finished-specification evidence.
• Quality control release. Quality control personnel have to review the relevant specifications, records, deviations, material reviews, and finished-batch evidence before release.

That last point is where supplement cGMP becomes operational. A finished lot is not ready because production is complete. It is ready when quality has reviewed the evidence and approved release.

Testing, COAs, and specifications

Testing works best when it is tied to a defined decision. A heavy-metals result, microbiology result, potency result, pesticide screen, or identity test is useful because the team knows which lot it belongs to, which method was used, which specification applies, and what action follows.

That is why specifications come before routine testing. Without specifications, teams end up with numbers that are hard to interpret. With specifications, the result can support a clear decision: approve, hold, investigate, reject, reprocess where allowed, retest under a defined procedure, or escalate.

COAs need the same discipline. A COA should never be treated as a loose promise that a supplier or product is acceptable. It should be reviewed against supplier qualification, test method, specification, lot identity, date, result, and the regulatory rule that applies.

For dietary supplements, the identity-testing rule is especially important. A supplier COA does not replace the required identity test or examination for a dietary ingredient unless the firm has an FDA-granted exemption. FDA warning letters keep returning to this point. In a 2026 supplement warning letter, FDA objected to reliance on supplier COAs where the firm had not performed required identity testing for dietary ingredients.

For food, the question is broader and risk-based. Finished-product testing may be useful. It does not replace sanitation controls, allergen controls, supplier controls, environmental monitoring, process controls, verification, or corrective actions when those are the controls needed for the hazard.

Records, deviations, and inspection readiness

Records are the memory of the cGMP system. They have to show what happened clearly enough that another qualified person can reconstruct the event later.

Part 117 records must be accurate, indelible, legible, created concurrently with the activity, and detailed enough to provide the history of the work performed. Food records under Part 117 generally have to be retained at least two years, with more specific rules for certain records and circumstances.

Part 111 has its own supplement recordkeeping rule. Required supplement records are kept one year past the shelf-life date if shelf-life dating is used, or two years beyond distribution of the last associated batch if no shelf-life dating is used.

The practical record packet for a food or supplement lot often includes:

• supplier approval and material records
• specifications, sampling plans, COAs, and lab reports
• production, cleaning, packaging, in-process, and yield records
• environmental, allergen, or sanitation monitoring where relevant
• deviations, investigations, material review, and corrective actions
• quality review and release approval

Deviation handling matters because cGMP is tested most clearly when something goes wrong. A missed cleaning step, out-of-specification result, allergen-label issue, unexpected microbiology result, ingredient substitution, or undocumented rework decision should trigger a documented quality review. The record should explain the issue, affected lots, investigation, disposition, corrective action, and final release or rejection decision.

Where cGMP programs break down

The weak points are usually ordinary. They are rarely dramatic technology failures. They are missing specifications, missing identity testing, incomplete batch records, weak supplier qualification, undocumented deviations, and release decisions made before the evidence is complete.

FDA warning letters show the pattern. A supplement warning letter in 2026 cited problems such as missing specifications, missing identity testing, and unsupported reliance on supplier COAs. A food warning letter in 2026 cited failure to prepare and implement a food safety plan for ready-to-eat bakery products.

Those examples make cGMP concrete. The failure often starts before a product test fails: the company cannot show why the lot should have been accepted in the first place.

A practical cGMP lot-release checklist

Before a food or supplement lot ships, the quality team should be able to answer these questions from the record:

1. Product identity: Does the lot match the intended product, formula, batch size, packaging, and label?
2. Supplier evidence: Were the relevant suppliers, materials, components, and packaging approved for this use?
3. Specifications: Were the right component, in-process, finished-product, and contamination specifications defined before review?
4. Testing and examinations: Were the required tests or examinations completed with appropriate methods and traceable results?
5. COA review: Were supplier COAs reviewed against lot identity, method, result, specification, and supplier qualification requirements?
6. Production record: Does the batch or lot record show equipment, dates, personnel, materials, yields, checks, and packaging steps?
7. Sanitation and allergen control: Were required controls completed and documented?
8. Deviations and corrective actions: Were out-of-specification results, complaints, returned products, deviations, and corrective actions reviewed?
9. Quality release: Did the quality function approve release after reviewing the evidence?

If one of those answers is missing, the lot may still be resolvable. It should not be invisible. A cGMP system gives the team a disciplined way to hold, investigate, correct, and document before the product reaches customers.

For a deeper supplier-focused workflow, our supplier audit checklist maps the documents and questions that help brands evaluate supplier risk before it becomes a release problem.

How Light Labs helps

We help food, supplement, baby-food, and manufacturing teams make cGMP evidence easier to create, review, and share. Our ISO 17025-accredited lab supports product and contaminant testing, our testing menu gives teams a clear way to scope relevant methods, and our compliance workflow helps teams keep results, action limits, COAs, and reporting in one place.

That matters when the release decision depends on speed and traceability. Quality teams need more than a PDF result. They need the result connected to the product, lot, specification, supplier record, action limit, retest status, and customer or retailer documentation.

For supplement teams and manufacturer teams, the goal is practical: shorter testing cycles, cleaner records, and fewer blind spots between the lab, quality, operations, and commercial teams.

If your team is building a stronger cGMP testing and compliance workflow, talk with us.

Final takeaway

Current good manufacturing practices are the operating system for product quality. For food and supplement teams, the work spans suppliers, specifications, testing, COAs, batch records, sanitation, deviations, corrective actions, and quality release.

The strongest cGMP programs make one thing easy to prove: this lot was made under control, reviewed against clear requirements, and released with evidence the business can defend.