GMP Compliance of Foreign Suppliers: The Importers Guide [eBook]

Learn how the FDA holds importers accountable to GMP regulations and how to assess your foreign supplier's FDA inspection readiness

gmp compliance

gmp complianceIn 2007, the former head of China’s Food and Drug Agency (CFDA), Zheng Xiaoyu, was executed for accepting bribes from manufacturing firms to register their sub-standard products without regulatory checks. At the time, a CFDA spokeswoman said, “As a developing country, China's food and drug supervision work began late and its foundations are weak”.

With origins in the U.S. Federal Food, Drug and Cosmetic Act of 1938, good manufacturing practice (GMP) regulations in the U.S. and other Western countries have arisen from many decades of experience-driven efforts to regulate key industries.

But as the example above shows, China and other developing countries in Asia often don’t have this same strong foundation for holding manufacturers accountable for quality issues. At the same time, Western importers in GMP-regulated industries are increasingly outsourcing production abroad, as:

So what does this mean for you if you’re manufacturing a regulated product abroad?

Importers who manufacture their product abroad are still held accountable to GMP regulations. Companies that import substandard products into the U.S. can have the public alerted about their products, their products seized at the border and even face multi-million-dollar fines.

Your job as an importer is to educate your foreign suppliers on GMP guidelines and hold them accountable to your requirements. In this eBook we’ll explore why importers need to assess GMP compliance of foreign suppliers in the first place and how importers can evaluate suppliers to protect their business and consumers.

Read along, email a PDF to yourself for later by filling out the form on this page or click the links below to jump to the section that interests you most!

Chapter 1: What is GMP?

Good manufacturing practice (GMP) is a regulatory framework to ensure key products are consistently produced to quality standards appropriate for their intended use and product specifications.

Developed to protect consumers against unsafe and adulterated products, GMP regulations hold manufacturers in key industries like food, pharmaceuticals and medical devices legally accountable to quality issues in their products.

GMP regulations are a national framework, and national regulatory agencies are responsible for developing and enforcing GMP standards. These agencies include the U.S. Food and Drug Administration (FDA), Health Canada, the European Medicines Agency (EMA) and others.

Importers are only responsible for maintaining compliance with the GMP regulations for the target market they are intending to sell in. Each product type has its own regulatory document, which reflects the specific quality concerns and manufacturing processes for that product type.

gmp complianceIf you are intending to sell in many markets, U.S. FDA regulations are typically considered the “gold standard” for good manufacturing practice. U.S. compliance will typically give you access to most other markets. Thus, this guide will focus primarily on U.S. FDA requirements, but much of the advice is universal.

Regulatory agencies continue to amend GMP regulations periodically to reflect important changes in the regulatory climate. In the U.S., GMP standards are officially referred to as “cGMPs”, where the “c” refers to current. This is to impress upon manufacturers that they always need to compliant with current regulations and strive for continuous improvement.

Other countries simply use the “GMP” acronym, but they also require manufacturers to stay current with updated regulations.

Is your product regulated under GMP guidelines?

Those importing the following products to the U.S. market must comply with FDA good manufacturing practices under Title 21 of the Code of Federal Regulations (CFR):

  • Food and beverage products, including dietary supplements, under the 100 series. Part 110 and part 111 detail GMP requirements for food and supplements, respectively.
  • Pharmaceuticals, including both active pharmaceutical ingredient (API) and finished drug facilities, under the 200 and 300 series. Part 210 details GMP requirements.
  • Biologics, including vaccines, blood and blood products, under the 600 series. Part 606 details GMP requirements.
  • Veterinary products, under the 500 series. Part 507 details GMP requirements.
  • Medical devices, under the 800 series. Part 820 details GMP requirements.

The FDA defines a medical device as any product “which is intended for use in the diagnosis of disease or other conditions, or in the cure, mitigation, treatment, or prevention of disease, in man or other animals.” This can include items like first aid kits, hospital beds and tongue depressors that you might not commonly consider “devices”.

Though not mandated, GMP compliance for cosmetic products is highly recommended in the U.S. And the FDA has the legal authority to inspect cosmetic facilities, as well as imported cosmetics.

Cosmetic GMP compliance is mandatory in the EU under European Regulation 1223/2009. Regulation 1223/2009 is harmonized with the ISO 22716 standard, meaning manufacturers can obtain ISO 22716 certification to prove compliance with EU legislation.

How do GMP guidelines differ from ISO 9001 quality management system requirements?

Experienced importers are likely familiar with ISO 9001 standards. Both GMP guidelines and ISO 9001 standards cover a factory’s quality management system (QMS).

But you shouldn’t regard GMP and ISO 9001 as equivalent standards, as they vary in their structure and purpose. Factories compliant with ISO 9001 requirements won’t automatically be compliant with GMP requirements, nor vice versa.

Let’s look at some of the key differences in the table below:gmp compliance

The focus of GMP is purely on product quality as it relates to product safety and efficacy. The focus is on protecting the consumer, or the patient in the case of medical devices and pharmaceuticals.

As you can see, ISO 9001 incorporates product quality into a manufacturer’s other important business needs. Meeting customer expectations and legal requirements is an important element of the ISO 9001 seven quality management principles. But ISO 9001 also focuses on operational leadership success, personnel engagement and continual improvement in addition to product quality goals.

Can you use ISO certifications to verify GMP compliance or readiness?

It’s generally a good practice to ask your supplier for any local or international certifications they hold as part of the qualification process for new suppliers.

For GMP compliance, ISO 9001 certifications and other industry-specific certifications like ISO 13485 for medical devices and ISO 22716 for cosmetics are a good sign of a manufacturer’s GMP readiness. A factory that already has a well-developed, ISO-compliant QMS will likely find it easier to become GMP compliant than a factory with no experience in QMS standards. The factory will already have in place the structure, personnel and mindset for maintaining a QMS.

But you cannot use ISO certifications to verify GMP compliance, except for cosmetics in the EU. You’ll still need to cooperate with your suppliers to educate them on GMP guidelines and help them become compliant to pass a GMP audit.

Though ISO 9001 and GMP requirements differ in their mission and purpose, the goals of these frameworks can be complementary. If it’s important to your business that manufacturers comply with both ISO 9001 and GMP guidelines, be sure to educate your supplier on the differences in these two frameworks.

⇑ Back to Top

Chapter 2: Why importers need to assess the GMP compliance of their foreign suppliers

A quick online search of FDA import alerts and warning letters can reveal many GMP violations that should strike fear in importers’ hearts.

A June 2016 FDA inspection of a Chinese drug manufacturer in Yangzhou, Jiangsu province revealed several worrisome GMP violations:

  • The inspector documented copious amounts of an unknown black, mold-like material on the floor and walls of a storage warehouse for production units.
  • The company had no written procedures for production and quality unit responsibilities.
  • The factory denied the inspector access to some facilities, and when asked to explain a microbiological testing processes, the factory representative refused, stating it was a “trade secret”.

gmp complianceIt’s the importer’s responsibility to pressure their foreign suppliers to care about GMP compliance, as well as educate them. The above supplier was probably unaware of the exact role of the FDA, as the FDA does not disclose details or so-called “trade secrets” gathered during inspections.

Think you’re not at risk if you’re only importing the product, not manufacturing it? Think again. In 2017, the FDA also issued a warning letter to Aztex Enterprises, a Canadian company that sourced drug materials from a supplier banned from importing to the U.S. The warning letter reads:

Because you used adulterated materials that you purchased from a firm on Import Alert … the drugs you manufacture also are adulterated under the FD&C Act.

You might be willing to risk that your supplier won’t be one of the facilities found to be noncompliant during an official FDA inspection. And you might think FDA auditors are less likely to inspect foreign facilities. But the importer actually bears the brunt of the consequences if their foreign suppliers aren’t compliant.

Mandatory foreign supplier verification program (FSVP) for food importers

With the passage of the FDA Food Safety Modernization Act in 2011, food importers are now required to comply with the Foreign Supplier Verification Program (FSVP). Importers must verify that their suppliers meet applicable FDA food safety requirements, including that the food is not adulterated or misbranded with respect to allergens.

The FDA observed a failure to develop an FSVP in 108 food inspections in FY2017—its first year of mandated compliance. B&I Overseas Trading Company, a seafood importer, received a warning letter in April 2017 for a FSVP violation:

You do not have or have not implemented written verification procedures, product specifications and an affirmative step for ensuring that fish you import are processed in compliance.

Following FDA guidance, acceptable foreign supplier verification program activities may include:

  • On-site auditing of foreign suppliers
  • Review of supplier’s food safety records
  • Random sampling and testing of received shipments

Food importers should expect FSVP to be a continued point of attention in future FDA inspections. Importers should take steps to develop and implement an effective FSVP following FDA guidance documents.

FDA inspections of foreign facilities are increasing in number year by year

Food and pharmaceutical inspections currently make up the bulk of foreign inspections conducted by the FDA. The FDA was mandated by the Food Safety Modernization Act to increase the number of foreign food facility inspections it conducts. Within one year of enactment, the law directed FDA to inspect at least 600 foreign facilities and to double those inspections every year for the next five years.

As more Chinese facilities register with the FDA, the FDA has begun to inspect more Chinese facilities. The number of drug manufacturing facilities in China increased 66 percent from 2011 to 2016.

In 2016, the FDA inspected 21 percent of 754 registered drug facilities in China. Objectionable conditions that warrant FDA regulatory and/or administrative sanctions were found at 22 percent of the inspected facilities.

The FDA recognizes that foreign inspections of medical devices are increasingly important, as imported medical devices now constitute 35 percent of the U.S. medical equipment market. U.S. Congress enacted the FDA Reauthorization Act of 2017 (FDARA) to reform the FDA’s inspection practices for medical devices and promote the adoption of a risk-based inspection approach.

The total number of foreign food facility inspections increased from 994 in 2011 to 1,363 in 2015. For drugs and devices, the number of foreign inspections has increased from 1,138 in FY2013 to 1,652 in FY2016. Beginning in 2015, the FDA conducted more foreign drug facility inspections than domestic. gmp compliancegmp compliance

FDA cooperation with global regulatory bodies to improve GMP inspection efficiency

National regulatory bodies are increasingly working together to improve inspection efficiency and decrease inspection duplication. U.S. FDA and regulatory bodies in Canada, Australia, Brazil and Japan have joined the Medical Device Single Audit Program (MDSAP). After the successful completion of a two-year pilot program in 2016, the FDA now accepts MDSAP reports as a substitute for routine inspection FDA reports.

The EU has signed mutual recognition agreements with Australia, Canada, Israel, Japan, New Zealand, Switzerland and the United States covering most human medicines. The U.S. FDA’s only similar mutual recognition agreement is with the EU, signed in 2017 to cover most human medicines and active pharmaceutical ingredients (APIs). This means EU routine inspection reports can now be used to assess compliance with U.S. FDA requirements.

What are the consequences of GMP violations for importers?

The FDA is not required to obtain the same level of documentation in foreign facilities as in domestic facilities to establish evidence of GMP violations during inspection.

The agency has the authority under the Food, Drug and Cosmetics Act to administratively restrict the importation of a product without demonstrating the adulteration of the product. Similar consequences apply if your supplier refuses to allow FDA inspections.

The FDA has the legal authority to enforce GMP guidelines through a number of mechanisms. These include:GMP compliance

Official FDA global enforcement statistics for fiscal year 2017 included:gmp compliance

It’s harder to quantify the risk GMP violations pose to your brand’s reputation and customer loyalty. GMP regulations are in place for consumer protection, and the FDA publicizes all enforcement actions online. News that your product is unsafe or doesn’t perform as marketed can lead to negative product reviews, reduced sales and lower customer satisfaction and retention rates.

⇑ Back to Top

Chapter 3: How does the U.S. FDA assess GMP compliance of foreign facilities?

All foreign manufacturing facilities that manufacture products for import into the U.S. are required to register with the FDA and are subject to FDA inspections.

The FDA conducts four different types of inspections of manufacturing facilities, including:

  • Pre-approval inspections (PAI), either after a company applies to the FDA to market a new product or the first time a facility applies, to ensure the facility can manufacture the product and that data submitted are accurate and complete
  • Post-approval inspections, for specific products following application approval to cover aspects not ready during the application review period and more critical to quality assurance
  • Routine or “surveillance” inspections, a systems-based inspection of a facility for compliance with GMP regulations, generally conducted every two years
  • “For-cause” inspections, to follow up on past GMP violations and informant allegations when the FDA has reason to believe a facility is not compliant with GMP requirements

How does the FDA decide which foreign facilities to routinely inspect?

The FDA chooses which foreign facilities to routinely inspect based on risk. This is to help ensure the FDA uses its resources effectively and efficiently to address the most significant public health risks. GMP complianceThese risk factors include:

  • Nature and inherent risk of the product
    • High risk foods such as atmosphere packaged products, acidified and low acid canned foods, seafood, custard filled bakery products, dairy products; unpasteurized juices, fresh fruits and vegetables and processed fruits and vegetables, spices, shell eggs, sandwiches, prepared salads, infant formula and medical foods
    • Class III devices, class II devices, implantable devices and life supporting and life sustaining devices. Device classification procedures are outlined in Title 21 Part 860
    • Drugs or devices in critically low supply or critically important
  • Recently introduced devices or drugs
  • The complexity of the product and manufacturing processes involved
  • The compliance history of the facility and past inspection frequency

What to expect during and after an FDA inspection

Unlike domestic inspections, the FDA pre-announces foreign inspections. Factory management can notify relevant personnel and gather relevant documents ahead of the announced audit date.

Routine inspections are system-based, meaning inspectors will look at each system (records, equipment, personnel, etc.) individually and assess compliance. Foreign facility inspections typically last one to three days.

Depending on the FDA inspector’s preference, they might conduct an audit using one of three fact-finding methods:

  • Trace forward: start with checking raw materials and follow the production flow through the factory to storage and distribution
  • Trace backwards: start at the final product of a specific batch and move backwards
  • Random: start at points that appear significant (e.g. complaints, corrective and preventative action [CAPA] plans, training), proceeding to inspect areas at random without necessarily following any particular logical flow

If the inspector observes GMP violations on-site, the FDA will release an FDA Form-483, colloquially known simply as a “483”, within 90 days after an inspection. The 483 lists “inspection observations” or the violations found during the FDA inspection.

The overall result of the inspection is indicated as one of the following:gmp compliance

After issuing the 483, the FDA may issue a warning letter. A warning letter indicates that higher FDA officials have reviewed the inspection observations and that a serious violation at the facility may exist.

What are common GMP violations among foreign facilities?

You can learn of some common GMP violations from official warning letters, import alerts and inspection observations published online by the FDA.

The FDA publishes a summary of inspectional observations for each fiscal year on their website. These are a composite of both foreign and domestic FDA inspection observations. Below are some of the common GMP violations observed in FY 2017 at food, medical devices and drug facilities:gmp compliance

As you can see, GMP violations often vary by product types. Sanitation issues are more commonly found in food facilities. Laboratory controls are only applicable to drug facilities.

Data integrity issues have been a recent focus for the FDA both domestically and abroad. The FDA defines data integrity as:

The completeness, consistency, and accuracy of data. Complete, consistent, and accurate data should be attributable, legible, contemporaneously recorded, original or a true copy, and accurate (ALCOA).

Data governance/data integrity deficiencies were cited in 67 percent of warning letters to drug firms outside the U.S. in fiscal year 2017. You can reasonably expect data integrity to be a focus in any upcoming FDA inspection, across all industries, both domestically and internationally.

For medical devices, inadequate procedures for corrective and preventive action (CAPA) was the most-often cited compliance issue in 2017. According to the FDA’s Inspection Guideline for CAPA, the purpose of a CAPA system is to:

Collect information, analyze information, identify and investigate product and quality problems, and take appropriate and effective corrective and/or preventive action to prevent their recurrence.

Many suppliers across all industries don’t implement CAPA well. Many suppliers fail to critically look at out-of-specification results to minimize their recurrence. And after an inspection has passed, many suppliers forget or otherwise neglect to follow up on CAPA. More focused on daily operations, manufacturers might feel they don’t have the time or resources to dedicate to CAPA development.

Factory staff can identify quality issues during manufacturing processes, during an audit or laboratory test or, in the case of customer complaints, after the product has hit the market. An effective CAPA system identifies and addresses all these quality issues with clear and documented steps to prevent their recurrence.

⇑ Back to Top

Chapter 4: How should importers assess FDA inspection readiness of foreign suppliers?

It does not matter if it’s a Chinese or U.S. factory, most factories don’t have the discipline to implement, maintain and monitor a robust GMP compliance system,” says Kelvin Hooi, a GMP compliance professional with 20 years of manufacturing experience.

Your foreign suppliers are likely motivated by a desire to do business with Western customers but are not held accountable to your standards by local laws. As such, your supplier may see GMP requirements as a foreign imposition or requirement, not an ethical necessity. So taking proactive steps to assess GMP compliance of your foreign suppliers can be the only way to hold them accountable.

A pre-audit, often also referred to as a “mock audit”, is typically conducted by a third-party auditor to assess compliance to a standard, regulation or retailer framework. GMP pre-audits closely follow official GMP regulations to assess FDA inspection readiness.GMP compliance

GMP pre-audits can help importers:

  • Assess FDA inspection readiness of potential suppliers
  • Understand what information the FDA is looking for in an inspection
  • Identify compliance issues and take corrective action before an official GMP audit
  • Educate their supplier on GMP guidelines and set expectations

Pre-audits are also a valuable opportunity to prep your supplier on the general process of a GMP audit before the official audit date. Relevant personnel can practice answering questions, gathering necessary documents and familiarizing themselves with the auditor’s processes.

How to prepare for a GMP pre-audit

For a first GMP audit, the exact audit path and procedures might not be available or known ahead of time. The FDA is not actually required to find all noncompliances at a supplier’s facility during a routine audit. Audit paths often vary based upon observations during the audit itself.

Always do your homework before a GMP audit. Evaluating the compliance history of your supplier can reveal systemic issues and provide an early warning of potential issues to focus on during the pre-audit.

A GMP audit checklist should be designed to identify all or most of what the FDA could identify during the audit. The official FDA audit path will vary from one facility to another and from one audit to another. Important factors to consider and integrate into a pre-audit include:

Monitor FDA inspection observation trends

Based on trends in compliance issues gathered from other audits, the FDA might require auditors to include certain checks in all inspections. For example, if the FDA observes several facilities failing to monitor controlled temperature storage readings, then the FDA may require that inspectors include this check in all applicable inspections. 

Study GMP compliance history of the facility in question

The compliance history of a facility will usually drive the audit process. FDA auditors will almost always follow up on previous observations to ensure issues have been adequately addressed. Importers and third-party auditors should monitor warning letters, Form 483s, import alerts and recalls from all previous FDA inspections at the supplier’s facility.

Consider product-specific manufacturing processes

FDA auditors will check critical processes involved in the manufacturing of the product. Evaluate your supplier’s capabilities by finding out how much experience your supplier has in manufacturing this product for your market and what certifications they hold.

Evaluate customer complaints for product quality issues

Along with compliance history, product complaints are a strong indicator of previous issues at the facility. As the importer, you should have a clear understanding of customer concerns. Evaluate product complaints to determine the origin of quality issues.

How to select the right GMP pre-audit team

A pre-audit is typically conducted by one or two auditors with GMP experience over the course of two days. A pre-audit team should be aware of the current compliance climate for your industry and manufacturing country. These auditors should create a GMP audit checklist and plan the pre-audit path accordingly to focus on these factors and recognize associated issues.GMP compliance

A language barrier is a major hurdle in determining whether issues exist in records and reports, including data integrity issues. Naturally, if you’re importing from a Chinese manufacturer, all their internal documents are likely to be written in Chinese. Translation of these technical documents can be difficult (and remediation even more difficult) when it comes to identifying and addressing specific compliance issues.

If possible, work with a mock third-party auditor that has local and international expertise. Local expertise is important for identifying and translating supplier’s records, data, training plans and procedures. International or Western expertise is important to ensure the auditor is deeply aware of GMP requirements in your target market.

When should importers assess GMP compliance?

Ideally, you should audit potential suppliers before you begin working with them as part of the evaluation phase.

21 CFR Part 820.50 for medical devices states each manufacturer should:

Evaluate and select potential suppliers, contractors, and consultants on the basis of their ability to meet specified requirements, including quality requirements. The evaluation shall be documented.

After you’ve selected and started working with a supplier, it’s generally best practice to audit each supplier annually. According to the FDA’s Guide to Inspections of Foreign Medical Device Manufacturers:

It is recommended that the time between audits not exceed a 12-month period. Audits more frequently than 12 months may be needed if the firm has GMP problems.

If your first GMP audit finds the supplier to be compliant with few or no violations and the supplier has a history of GMP compliance, then annual auditing should be sufficient.

But you should determine the appropriate auditing schedule based on your specific concerns and situation. For instance, if a supplier is a sole source of an API with a complex manufacturing process, then experts suggest an assessment every six months.

How pre-audit results can help importers assess GMP compliance

Pre-audits are typically broken into step-by-step assessments of compliance with each requirement under an international standard. The findings for the factory’s compliance will often be categorized as:

  • Compliant
  • Needs improvement
  • Not compliant

Then the auditors will compile a final score of compliance from the number of each finding. Below is an excerpt from a pre-audit report for a medical device facility, showing a summary of all observations by requirement:Report_excerpt_pg_23

If a pre-audit reveals nonconformances, there are several steps you can take to ensure compliance before a potential official FDA inspection:

  1. Educate your supplier on the legal requirements and your expectations
  2. If serious issues are found, hold shipments until your supplier takes corrective actions
  3. Request a written plan for immediate correction of all issues found
  4. Re-audit after a reasonable period of time to assess if your supplier has implemented corrective actions
  5. If the factory is willfully uncooperative, consider finding a new supplier

Not all suppliers who fail a GMP pre-audit are willfully noncompliant or uncooperative. In fact, many suppliers are eager to learn so they can better meet your requirements and increase their sales. In this way, GMP pre-audits can and do help foreign suppliers as much as they can help importers.

⇑ Back to Top


If you’re manufacturing abroad, chances are you don’t want to be traveling overseas every few months to monitor and maintain FDA inspection readiness. But you don’t want to fail an FDA inspection and face the consequences for noncompliance either. Now you know the consequences for importers with GMP violations are just as high as for domestic manufacturers.

With the help of pre-audits, you can identify issues at your suppliers’ facilities and proactively address them before an official GMP audit. Any supplier, whether in the United States, China, India or elsewhere, can pass a GMP audit and produce safe and high-quality products.

Ensuring GMP compliance at foreign facilities simply requires the time, effort and personnel to develop, implement and regularly audit a compliant quality management system.

More resources

Download InTouch's service guide below to find out how InTouch can help your importing business assess your foreign suppliers and become GMP compliant!

AQF service guide