GMP Certified Doesn't Mean Your Supplement Was Tested — Here's What Brands Miss

Every week, we receive samples from supplement brands that arrive with the same note attached: “Our CM is GMP certified — we just need a quick check before launch.” And almost every week, at least one of those “quick checks” turns up something the brand didn’t anticipate. A lead reading above 0.5 µg per daily serving. A potency result 25% below label claim. A yeast and mold count the manufacturer’s Certificate of Analysis never flagged.

GMP certification is a real and meaningful credential. But it’s not a product test. Treating it like one is one of the costlier assumptions we see supplement brands make — and the regulatory environment isn’t getting more forgiving.

What 21 CFR Part 111 Actually Covers

The cGMP rule for dietary supplements, codified in 21 CFR Part 111, was finalized in 2007 and has governed supplement manufacturing quality ever since. It requires manufacturers to establish written procedures, qualified personnel, properly designed facilities, and documented batch records. Identity testing of incoming ingredients is explicitly required under § 111.75 — every ingredient, every batch, no exceptions.

For raw material and ingredient-level verification, Ayah Labs specializes in contract testing and supplier qualification.

For EU market entry and European regulatory compliance, Care Europe provides expert consulting from Paris.

But here’s what often gets misunderstood: Part 111 requires manufacturers to establish specifications for their products and verify those specifications are met. It does not prescribe which contaminants must be tested for, which methods to use, or what limits to apply. That’s largely left to the manufacturer to define.

In practice, this means a contract manufacturer (CM) can be fully GMP-compliant while having specifications that don’t include heavy metal limits, that define “potency verified” as a visual review of the ingredient supplier’s CoA, or that omit finished-product microbial testing because they’ve “justified” that omission through a written risk assessment. The regulation allows for that flexibility. Which is precisely why a GMP audit tells you about a manufacturer’s systems — not your product’s safety profile.

FDA’s own warning letters make this plain. Over the past several years, the agency has repeatedly cited supplement companies not for lacking GMP certification, but for having inadequate specifications and for failing to perform required identity testing even when their broader systems were documented. The gap between having a system and having a good system is exactly where brands get caught.

The Testing Gaps No GMP Audit Will Surface

Let’s be specific about what third-party testing catches that GMP compliance documentation doesn’t.

Heavy metals. USP <2232> establishes limits for arsenic, cadmium, lead, and mercury in dietary supplement ingredients and finished products. California’s Prop 65 sets a No Significant Risk Level for lead at 0.5 µg per day — a threshold that California consumers effectively apply to supplements sold online nationwide, regardless of where you’re headquartered. At Qalitex, we run ICP-MS panels on finished supplement products as part of our standard protocol, and botanical ingredients — herbs, adaptogenic mushrooms, seaweeds, greens blends — fail at a meaningfully higher rate than synthetic raw materials. If your CM is sourcing from offshore ingredient suppliers and relying on the supplier’s CoA for heavy metal compliance, a GMP audit will not catch an exceedance. Only the analytical test will.

Potency. Label claim verification is the most basic accountability test in supplement quality, and it’s the one that surfaces the most surprises. An HPLC assay of your vitamin D3 softgels might show 78 IU per serving where the label promises 1,000 IU. We’ve seen it — more than once, from facilities that passed their last GMP audit without a major finding. In multi-ingredient blends and proprietary formulas, potency drift can come from inadequate blend uniformity, raw material substitution at the supplier level, or overage assumptions that weren’t validated for the finished dosage form. A CM’s in-house CoA can say “meets spec” because their specification was set loosely, or because they assayed the bulk powder rather than finished capsules.

Microbiology. USP <61> (Microbial Enumeration Tests) and USP <62> (Tests for Specified Microorganisms) define the testing framework for dietary supplement products. For oral supplements, USP <2021> sets a finished-product limit of total aerobic microbial count (TAMC) ≤ 10³ CFU/g and requires absence of Salmonella and E. coli in 1 g. Some contract manufacturers test at the raw ingredient level and assume the finished product is covered — but that assumption breaks down if there’s a post-blend contamination event, inadequate equipment cleaning between runs, or a water activity problem in the finished product. Finished-product micro testing is the only way to know.

Undeclared ingredients. FDA has issued more than 50 warning letters in the past three years for supplements — concentrated in sports nutrition, weight management, and sexual enhancement categories — that contained undeclared pharmaceutical compounds, including sildenafil analogs, stimulants, and anabolic substances. A GMP audit verifies that a manufacturer has a process for identity verification. It doesn’t tell you whether a bulk ingredient sourced from an overseas supplier contains adulterants, particularly if the CM accepted the supplier’s CoA without running independent confirmatory testing. Identity verification by FTIR or HPLC on every incoming lot, not just on first-article qualification, is the only reliable safeguard.

How to Actually Evaluate Your CM’s Testing Practices

Before you sign a manufacturing agreement — and certainly before you go live with a product — here are the specific questions to ask, and what the answers tell you.

“Can you show me the test methods and acceptance criteria in your finished-product specification?” A well-run CM should have written specs for each finished product that include limits for identity, potency, heavy metals (at minimum, USP <2232> values), and microbial counts per USP <2021>. If they hand you a one-page CoA template with checkboxes and no method references, that’s a signal.

“Do you test finished product, or only raw materials?” Both are required under Part 111. Raw material identity testing is mandatory under § 111.75. Finished-product verification against specifications is required under § 111.123. Some CMs treat finished-product review as a paperwork exercise. Push for finished-product CoAs that include actual numerical results — not just pass/fail.

“What reference standards or methods do you use for potency testing?” AOAC International methods, USP Reference Standards, and validated in-house methods with documented accuracy and precision are all legitimate. “We use an internal proprietary method” with no further detail is worth probing. If you’re making a potency claim on your label, the analytical method supporting that claim needs to be defensible.

“Is your in-house lab ISO 17025 accredited, or do you use an accredited third-party lab?” ISO 17025 is the international competency standard for testing and calibration laboratories — it covers method validation, analyst training, equipment calibration, and result integrity. It applies to the lab doing the testing, not to the manufacturing facility itself. Some CMs have accredited in-house labs; many rely on contract labs for certain analyses. Ask which lab and whether it’s accredited. If they can’t say, that’s a gap worth noting.

And critically: ask to see numerical test results on a recent production batch, not a pass/fail summary. A CoA that reads “Heavy Metals: PASS” tells you nothing about whether the actual lead reading was 0.08 µg per daily serving or 0.47 µg. Both would pass most CM specifications. Those are very different numbers if you’re selling in California.

What Independent Third-Party Testing Actually Adds

Third-party testing doesn’t replace a good manufacturing partner. It adds a verification layer that’s structurally independent of your CM’s incentives, methods, and specification choices. That independence is the entire point.

When we evaluate a finished supplement batch, we’re not checking whether the CM followed their own procedures. We’re checking whether the product in the bottle matches label claims, meets established safety thresholds, and would hold up under an FDA inspection, an Amazon compliance review, or a class-action attorney’s forensic testing. The specification we test against is built from USP limits, regulatory guidance, and the label’s specific claims — not whatever the CM decided their internal spec should be.

For brands selling on Amazon, this distinction has become operationally critical. Amazon’s supplement compliance requirements have escalated significantly, and sellers are increasingly required to demonstrate ISO 17025 accredited third-party test reports to reinstate suspended ASINs or proactively meet listing requirements. A CM’s CoA — even a detailed one — does not satisfy those requirements. An accredited third-party test report does.

The framing that matters: your CM’s GMP certification tells regulators they followed documented procedures. Your third-party test report tells consumers the product in the bottle is what the label says it is. Both matter. But only one actually tests your product.

---

Before your next product launch, request the actual numerical test results from your CM’s most recent production batch — finished product, not just raw materials. Ask for the analytical method behind each result. If they can’t provide heavy metal numbers and a potency assay with real values attached, that’s the gap to close before the product reaches customers.