A different logic from food preventive controls
Anyone arriving from the FSMA world expects to start with a hazard analysis. 21 CFR Part 111 does not work that way. It requires you to establish written specifications, to confirm conformance to them through testing or examination, and to have a quality control unit review and disposition the result.
That structural difference explains why food-trained teams often build Part 111 systems that feel complete but generate observations. The document set is different, and the burden sits on specifications rather than on hazard justification.
The specifications the rule contemplates
Part 111 requires specifications at multiple stages of the operation. Each should name what is being controlled, the method used to determine conformance, and the acceptance criterion.
- Component specifications, including identity specifications for each dietary ingredient
- In-process specifications at points where control is necessary to ensure quality
- Specifications for packaging and labels
- Finished batch specifications for identity, purity, strength and composition, and for limits on contamination that may adulterate the product
- Specifications for anything received from a supplier that becomes part of the product
Identity testing and the limits of a certificate of analysis
The rule requires at least one appropriate test or examination to verify the identity of a dietary ingredient. This particular requirement is not satisfied by a supplier's certificate of analysis alone, and that is one of the most consistently misunderstood points in the regulation.
For other component specifications, the rule permits documented reliance on a certificate of analysis where you have first established the reliability of the supplier's analysis through confirmation of the supplier's test results, and where you periodically re-confirm that reliability. The reliance has to be documented, justified and maintained — not assumed at the point of purchase.
Practically, this means the supplier qualification file and the testing program are the same conversation. A qualification file with no confirmation testing does not support reliance, and confirmation testing with no written reliance determination does not connect to the exemption.
Master records, batch records and the quality unit
The master manufacturing record fixes the process for a given product and batch size. The batch production record captures what actually happened for a specific batch. Where those two diverge without a documented deviation and disposition, the record set is not defensible.
The quality control unit is the mechanism that ties the chain together. It reviews and approves specifications and master records, reviews batch records including deviations, and dispositions batches. For that to function, it needs defined authority and a reporting position that does not require it to negotiate with production over a hold.
The most efficient way to test a Part 111 system is to trace a completed batch backwards: component receipt, identity test, specification, master record, in-process checks, deviations, reconciliation, finished testing, quality unit signature, distribution. Anything in that chain you cannot reconstruct is a finding waiting for an inspection.
Primary sources
Go to the source rather than relying on this summary. Regulation text and agency guidance are the authority; this page is an interpretation of them.
- 21 CFR Part 111 — cGMP in Manufacturing, Packaging, Labeling, or Holding Operations for Dietary Supplements
- FDA Small Entity Compliance Guide for the dietary supplement cGMP rule
- 21 CFR Part 101 Subpart F — nutrition and supplement labeling