21 CFR Part 111 sets current good manufacturing practice for manufacturing, packaging, labeling and holding operations for dietary supplements. Its structure will feel familiar to anyone from pharmaceutical manufacturing and unfamiliar to anyone from food: it begins with written specifications and a quality control unit rather than with a hazard analysis.
That difference explains a specific failure pattern. Food-trained teams build systems that feel complete — a hazard analysis, prerequisite programs, monitoring records — and still generate observations, because the burden in Part 111 sits on specifications, identity testing and quality unit review.
The specification chain
Part 111 requires specifications at several stages, and each should name what is controlled, the method used to determine conformance, and the acceptance criterion. Where a specification does not exist, no amount of testing satisfies the requirement.
- Component specifications, including an identity specification for each dietary ingredient
- In-process specifications at points where control is necessary to ensure quality
- Packaging and label specifications
- Finished batch specifications for identity, purity, strength and composition, and limits on contamination that may adulterate the product
- Specifications for anything received from a supplier that becomes part of the product
- Master manufacturing records fixing the process for each product and batch size
- Batch production records capturing what actually happened, including deviations and reconciliation
Identity testing and the certificate of analysis question
The rule requires at least one appropriate test or examination to verify the identity of a dietary ingredient, and that particular requirement is not satisfied by a supplier's certificate of analysis alone. This is among the most consistently misunderstood provisions in the regulation.
For other component specifications, documented reliance on a certificate of analysis is possible where you first establish the reliability of the supplier's analysis by confirming their results, and periodically re-confirm that reliability. The reliance must be documented and justified rather than assumed at purchase — which means supplier qualification and your testing program are one conversation, not two.
The quality control unit, and how to test your own system
The quality control unit reviews and approves specifications and master records, reviews batch records including deviations, and dispositions batches. For that to be real, it needs defined authority and a reporting position that does not require it to negotiate with production over a hold. A quality unit that has never rejected anything is worth examining.
The most efficient self-test is to trace a completed batch backwards: component receipt, identity test, specification, master record, in-process checks, deviations, reconciliation, finished testing, quality unit signature, distribution. Anything in that chain you cannot reconstruct from records is a finding waiting for an inspection.
Brand owners should note that Part 111 can reach them directly. A company that holds or labels dietary supplements may fall within scope in its own right, separately from its contract manufacturer's obligations, and it carries commercial and reputational exposure for what is in the bottle regardless.
SURU Compliance is an independent regulatory consulting practice. We are not the FDA or any other government agency, not a certification body or accredited certifying entity, and not a law firm. We do not provide FDA approval, guaranteed inspection or audit outcomes, or legal advice, and we refer legal matters to qualified counsel. Regulatory applicability depends on your specific products, processes, size and jurisdiction.