GMP compliance means running your plant in conformance with Good Manufacturing Practice regulations: the baseline rules for facilities, personnel hygiene, sanitation, equipment, process controls, and records that keep products safe and consistent. In the US, food GMPs live in 21 CFR Part 117 and drug GMPs in 21 CFR Parts 210 and 211.
GMPs are the floor, not the ceiling. HACCP plans, preventive controls, and certification schemes like SQF all assume the GMP basics are already in place and working. This guide covers where the requirements come from, what a working GMP program contains, and how to handle the part that sinks most plants in an audit: the records. A downloadable self-audit checklist, organized around the themes of 21 CFR 117 Subpart B, is included at the end.
What is GMP compliance?
GMP compliance is conformance with the legally enforceable regulations that define the minimum conditions and practices for manufacturing safe products. For food in the US, that is 21 CFR Part 117, Subpart B: requirements covering personnel, plant and grounds, sanitary operations, sanitary facilities, equipment and utensils, process controls, warehousing, and defect action levels.
Two things make GMPs different from voluntary standards. First, they are law: FDA inspectors audit against them, and failures show up as Form 483 observations, warning letters, or worse. Second, they are deliberately written as outcomes rather than prescriptions. The regulation says equipment must be designed and maintained to be adequately cleanable; it does not tell you which sanitizer to buy or how often to swab. Your plant fills in the “how” with its own programs and standard operating procedures, and then proves the “how” happened with records.
What is the difference between GMP and cGMP?
The “c” stands for “current.” cGMP is FDA's way of saying that compliance is measured against current technology and current industry practice, not against whatever was acceptable when your plant was built. A sanitation program that passed inspection in 1995 can be a finding today if the industry has moved on. In practice the terms are used interchangeably; the “c” is a reminder that the bar moves.
Which regulations define GMP requirements?
It depends on what you make. The main US citations:
| Regulation | Covers | Notes |
|---|---|---|
| 21 CFR Part 117 | Human food | Subpart B holds the CGMPs; Subpart C adds hazard analysis and risk-based preventive controls (FSMA). Subpart F covers records. |
| 21 CFR Part 110 | Human food (historical) | The original umbrella food GMPs, first established in 1969. Part 117 modernized and replaced them after FSMA; Part 110 is history, not your current obligation. |
| 21 CFR Part 111 | Dietary supplements | Separate, more prescriptive CGMPs for supplement manufacturing, packaging, and holding. |
| 21 CFR Parts 210 and 211 | Pharmaceuticals | Drug CGMPs: much heavier requirements for batch records, quality unit oversight, validation, and laboratory controls. Out of scope for food plants, but the documentation philosophy is instructive. |
A few dates anchor the food side. FDA first established food CGMPs in 21 CFR Part 110 in 1969. The FDA Food Safety Modernization Act (FSMA) became law in January 2011, and FDA published the final rule creating Part 117, Current Good Manufacturing Practice, Hazard Analysis, and Risk-Based Preventive Controls for Human Food, on September 17, 2015. That rule did two things at once: it modernized the old Part 110 GMPs into Part 117 Subpart B, and it added the preventive controls requirements that most registered food facilities now operate under. FDA's overview of food CGMPs is here.
If you sell to major retailers, note the stacking: GMP compliance is the regulatory floor, a HACCP-based food safety plan sits on top of it, and a GFSI-benchmarked certification like SQF wraps both in a certified management system. You cannot pass the higher layers with a weak GMP base.
How do you build a GMP compliance program?
Build it the way the regulation is organized: cover the physical plant, the people, the cleaning, the equipment, the process, and the paper, in that order. Here is a practical build-out sequence that maps to the themes of 21 CFR 117 Subpart B.
- Facilities and grounds. Walk the site like an inspector. Grounds maintained to avoid attracting pests; buildings sized and laid out to prevent cross-contamination; floors, walls, and ceilings cleanable; adequate lighting, ventilation, and screening. Fix the structural problems first, because no sanitation schedule compensates for a leaking roof over an open line.
- Personnel and hygiene. Written hygiene rules that match 117.10: illness reporting and exclusion, clean outer garments, hand washing, glove control, hairnets and beard covers, jewelry rules, and where people may eat, drink, and smoke. Then make supervision real; the regulation explicitly holds management responsible for compliance.
- Sanitation and pest control. A master sanitation schedule covering every surface and utensil, with methods, chemicals, concentrations, and frequencies; controls for cleaning compounds and toxic materials; and a pest control program with documented monitoring. Pre-operational checks verify the cleaning actually worked before product runs.
- Equipment and utensils. Food-contact surfaces made of suitable, corrosion-resistant, cleanable materials; equipment installed so it can be cleaned around and under; calibrated instruments where measurements matter (thermometers, pH meters, scales); and a preventive maintenance program so lubricant, flaking paint, and loose fasteners never meet product.
- Process controls, warehousing, and distribution. Controls appropriate to your products under 117.80: raw material inspection and approval, time and temperature control, allergen handling and label control, protection against contamination in processing and storage, and controls during holding and shipping under 117.93.
- Records and documentation. Every monitoring activity, cleaning event, training session, calibration, and corrective action generates a record with a date, a result, and a signature or initials. Part 117 Subpart F sets the formal requirements: records must be accurate, legible, indelible, created concurrently with the activity, and retained (generally for two years) and retrievable when FDA asks.
- Training and competence. Under 117.4, every person who manufactures, processes, packs, or holds food must have the education, training, or experience to do their job hygienically, including training in food hygiene and food safety, and that training must be documented. Refresh it; do not treat orientation as lifetime coverage.
- Self-audit and correct. Schedule internal GMP audits, walk the floor against a checklist, log findings, assign owners and due dates, and verify closure. This loop is what turns a binder of programs into a living system. The downloadable checklist below gives you a starting structure.
Why do records decide GMP audits?
Because to an auditor or an FDA investigator, an activity without a record did not happen. The oldest rule in quality holds: if it isn't written down, it didn't happen. You can run the cleanest plant in the state, but if the sanitation log for the week of the inspection has gaps, the finding is real and it is yours.
The paperwork load is where GMP programs quietly fail. A single line can generate dozens of records per shift: pre-op checks, hourly monitoring, changeover and allergen verifications, equipment checks, corrective actions. On paper, those records get filled in late, filled in wrong, lost in binders, and transcribed into spreadsheets by someone whose morning disappears into collation. Gaps surface months later, during an audit, when nothing can be done about them.
This is a solvable problem, and solving it does not require replacing your systems. Moving those same checks to digital capture at the station means each record is created concurrently (as Subpart F requires), time-stamped, attributed, and immediately searchable, and missed checks show up now rather than at audit time. That is what Harmony's paperwork digitization module does, and it is the pattern Chattanooga Labeling Systems followed: paper production logging replaced with digital capture at the point of work, and the morning reporting grind automated away. No rip-and-replace. If your records must also satisfy FDA's electronic-records rule, see our guide to 21 CFR Part 11.
How often should you audit your own GMP compliance?
Monthly walk-throughs and a full-system internal audit at least annually is a workable baseline for most plants; high-risk areas earn more frequency. The cadence matters less than the loop: findings get logged, assigned an owner and a due date, verified closed, and trended over time. If the same hand-washing or door-seal finding shows up three audits running, the problem is not the finding, it is the corrective action process.
Two habits separate plants that pass external audits calmly from plants that cram. First, audit against the regulation text, not against memory; the checklist below maps to the Subpart B themes so nothing gets skipped. Second, rotate auditors. A quality tech who walks the same line every day stops seeing it; borrowing a supervisor from another area, or swapping auditors between sister plants, resets the eyes. Treat every internal finding as a free version of the finding an FDA investigator or certification auditor would have written, because that is exactly what it is.
What happens when GMP compliance fails?
FDA inspections escalate in stages. Observations get written on a Form 483 at the close of inspection; unresolved or serious problems draw a warning letter; and beyond that sit import alerts, seizures, injunctions, and mandatory recalls. Customers move faster than FDA: a failed customer or certification audit can cost a contract long before a regulator acts. The cheap path is the boring one, run the self-audit loop, close findings, keep records current, so that any auditor on any day finds the same clean system.