GMP Audits for Food Manufacturers: The Complete Guide

If you run a food manufacturing facility in the United States, GMP audits are part of your reality. Whether you're preparing for a third-party certification audit, responding to a customer requirement, or getting your facility ready for an FDA inspection, understanding how Good Manufacturing Practice (GMP) audits work gives you a serious advantage.

Most of the GMP audit guides you'll find online are written for pharmaceutical companies. They reference 21 CFR Parts 210 and 211, which apply to drug manufacturers. That's not your world. Food manufacturers operate under a different set of rules, primarily 21 CFR Part 117, which covers Current Good Manufacturing Practice for food production, packing, and holding.

This guide is built specifically for food manufacturers, processors, and distributors. It covers what GMP audits involve, the different types you'll encounter, how to prepare, where GMP fits within GFSI certification schemes, and the most common non-conformances that trip up food facilities.

What Is a GMP Audit for Food Manufacturers?

A GMP audit is a systematic evaluation of your facility's manufacturing practices against established Good Manufacturing Practice standards. In the food industry, GMP audits assess whether your facility meets the baseline conditions and practices required to produce safe food.

For food manufacturers in the U.S., GMPs are codified under 21 CFR Part 117, Subpart B. These regulations cover everything from personnel hygiene and building construction to equipment design and process controls. Internationally, the Codex Alimentarius General Principles of Food Hygiene (CXC 1-1969) and WHO GMP standards provide a similar framework.

The distinction matters because pharmaceutical GMP audits and food GMP audits are fundamentally different exercises. Pharma audits focus on sterile environments, batch release testing, and validation protocols under 21 CFR Parts 210/211. Food GMP audits focus on sanitation, allergen controls, pest management, and process monitoring. If you're reading a GMP guide and it mentions "batch release to market" or "stability testing," that content was written for drug manufacturers, not food producers.

Who needs GMP audits? Any facility that manufactures, processes, packs, or holds food for sale in the United States. This includes snack producers, beverage manufacturers, frozen food processors, dairy operations, meat and poultry plants (which also fall under USDA jurisdiction), bakeries, and contract manufacturers.

Want a ready-to-use checklist covering all nine audit areas below? Download our free GMP audit checklist and start scoring your facility today.

Types of GMP Audits in Food Manufacturing

Not every GMP audit looks the same. The type of audit you're facing determines how you prepare, who conducts it, and what the consequences look like.

Internal GMP Audits (Self-Inspections)

Internal GMP audits are the ones you control. Your quality team (or a trained internal auditor) walks the facility, reviews documentation, and scores your practices against your own GMP standards or a recognized checklist.

The goal is simple: find the gaps before an external auditor does. Most GFSI-benchmarked standards require internal audits at a defined frequency. Best practice for GMP-specific internal audits is monthly or quarterly, depending on your facility's risk profile. The auditor should be independent of the area being audited. Your sanitation manager shouldn't be auditing their own sanitation program.

Second-Party GMP Audits (Customer/Supplier Audits)

Second-party audits are driven by your customers. A retailer, brand owner, or food service company sends their own auditor (or a contracted auditor) to evaluate your facility against their supplier requirements.

These are increasingly common. Large retailers have proprietary supplier approval programs that include GMP evaluation. The USDA Good Manufacturing Practices audit program provides a standardized GMP audit for produce distributors and handlers. If you supply to major food service distributors, you've likely encountered a second-party GMP audit as part of the supplier approval process.

Third-Party GMP Audits (Certification Body Audits)

Third-party audits are conducted by accredited certification bodies (CBs). These are the audits that feed into formal certifications like SQF, BRCGS, and FSSC 22000. The CB sends an independent auditor to evaluate your facility against the certification standard, and GMP is a core component of every GFSI-benchmarked audit.

Third-party audits can be announced or unannounced. Unannounced audits are becoming the norm under GFSI schemes. BRCGS, for example, offers an announced/unannounced audit option, and SQF requires at least one unannounced audit within the certification cycle.

FDA Regulatory GMP Inspections vs. Third-Party GMP Audits

It's worth understanding the difference between a third-party food safety audit and an FDA inspection. Third-party GMP audits are voluntary. You hire a certification body, schedule the audit, and work toward certification. An FDA GMP inspection is a regulatory enforcement action. The FDA doesn't need your permission, and they don't schedule around your convenience.

FDA inspections can be triggered by routine surveillance, a consumer complaint, a recall event, or an import alert. During a GMP inspection, FDA investigators evaluate your facility against 21 CFR Part 117 and can issue observations (Form 483), warning letters, or in serious cases, initiate enforcement actions.

If an FDA investigator shows up unannounced, you're legally required to provide access. Having strong GMP practices already in place through your internal and third-party audit program is the best preparation for that scenario.

Our GMP audit checklist breaks down every category auditors evaluate into a downloadable, scoreable format you can use for internal self-inspections or pre-audit prep.

What Does a GMP Audit Cover? (The Checklist for GMP Audit)

A thorough GMP audit for a food facility covers nine core areas. This is what auditors are actually evaluating when they walk your floor and review your records.

Personnel Practices and Training

Auditors assess whether your employees follow documented hygiene practices. This includes handwashing procedures, use of protective clothing (hairnets, gloves, smocks), illness reporting policies, and jewelry/personal item restrictions. They'll also review training records to verify that employees received GMP training at hire and at regular intervals.

Facility and Grounds

The physical condition of your building matters. Auditors evaluate the building exterior (pest entry points, standing water, waste storage), interior construction (walls, floors, ceilings in production areas), lighting adequacy, ventilation, and the overall facility layout. They're looking for conditions that could lead to product contamination.

Equipment and Maintenance

All food-contact equipment should be designed for sanitary use, properly maintained, and calibrated where applicable. Auditors review preventive maintenance schedules, calibration records for measuring instruments (thermometers, scales, pH meters), and the condition of food-contact surfaces. Damaged or deteriorating equipment is a common finding.

Sanitation and Cleaning Programs

Your master sanitation schedule, pre-operational inspection records, and chemical storage practices all get reviewed. Auditors verify that cleaning procedures are documented as SOPs, that sanitation chemicals are stored separately from food products, and that cleaning verification (ATP testing, visual inspections) is performed and recorded.

Process Controls and Monitoring

This area covers your critical control points (CCPs), critical limits, monitoring frequency, and deviation procedures. If your HACCP plan identifies a cooking step at 165 degrees F as a CCP, the auditor will review your temperature monitoring logs, check that deviations were documented, and confirm that corrective actions were taken when limits were exceeded.

Allergen Management

Allergen controls are a high-priority area in food GMP audits. Auditors evaluate your allergen labeling accuracy, ingredient segregation practices, cleaning validation between allergen changeovers, and your written allergen control program. Poor allergen management is one of the leading causes of food recalls in the United States.

Documentation and Record-Keeping

GMP audits are paper-intensive (or digital-record-intensive, depending on your system). Auditors review your SOPs, batch production records, corrective action logs, and record retention practices. Documents need to be current, approved, and accessible. Outdated SOPs still sitting in binders on the production floor are a red flag.

Supplier Verification and Receiving

Your incoming materials affect your finished product. Auditors review your approved supplier management list, receiving inspection procedures, certificate of analysis (COA) verification, and how you handle non-conforming incoming materials. If you receive ingredients from high-risk suppliers, auditors expect to see a more rigorous verification program.

Traceability and Recall Readiness

Auditors assess your ability to trace ingredients from receiving through production to finished goods (and vice versa). This includes lot coding systems, one-up/one-down traceability records, and mock recall exercises. With FSMA 204 requirements now in effect for certain food categories, traceability recordkeeping standards have become more specific and more heavily scrutinized during audits.

How to Prepare for a GMP Audit: Step-by-Step

Preparation is what separates a smooth audit from a painful one. Here's a structured approach to getting your facility ready.

Step 1: Conduct a Pre-Audit Gap Assessment

Before the auditor arrives, audit yourself. Use a GMP audit checklist aligned with the standard you're being audited against (SQF Module 2, BRCGS Issue 9, or 21 CFR Part 117). Walk the facility with fresh eyes. Score each area and document every gap you find. This is your baseline.

Step 2: Review and Update Documentation

Pull every SOP, cleaning log, training record, and corrective action file that an auditor might request. Verify that all documents are current, signed, and dated. Replace any outdated SOPs with current versions and make sure your document control for compliance system reflects the changes. Auditors will check document revision histories, so make sure your version control is clean.

Step 3: Train Your Team

Your production floor staff will interact with auditors. They need to know basic GMP practices and be able to explain their daily responsibilities. Run a brief GMP refresher training session focused on hygiene practices, allergen controls, and what to do when an auditor asks them a question. Document this training with sign-in sheets and training content records.

Step 4: Perform a Facility Walk-Through

Walk the production floor as an auditor would. Enter through the employee entrance, check handwashing stations, observe personnel practices, inspect equipment condition, review chemical storage, and look at the building's physical state. Take notes on anything that doesn't look right. Peel back ceiling tiles, check behind equipment, and look at floor-wall junctions. Auditors do.

Step 5: Prepare Your Audit-Day Logistics

Set up a clean, quiet room for the auditor to use as a base. Stage your documentation binders or ensure your digital records system is accessible. Assign an escort for each area of the facility. Brief your management team on the audit schedule. Small logistical details signal that your facility takes audits seriously.

Need to digitize your GMP audit preparation? See how AlleraTech helps food manufacturers centralize documentation, corrective actions, and audit readiness in one platform.

Where GMP Audits Fit Within GFSI Certification Schemes

If your facility holds (or is pursuing) a GFSI-benchmarked certification, GMP audits are not a standalone exercise. GMP forms the foundation that every GFSI certification scheme builds on. Understanding where GMP sits within each standard helps you prepare more effectively.

How SQF Audits Evaluate GMP Compliance

Under the SQF Food Safety Code Edition 10, GMP requirements are addressed in Module 2 (Food Safety Fundamentals). This module covers site standards, personnel practices, process controls, and sanitation. Your GMP score directly impacts your overall SQF audit result. A facility can have a strong HACCP plan (Module 10+) but still receive a poor audit score if GMP fundamentals in Module 2 are weak. If you're working toward SQF, check out our SQF audit checklist and guide on how to pass an SQF audit.

GMP Within BRCGS Audits

The BRCGS Global Standard for Food Safety Issue 9 evaluates GMP through its site standards clauses. These cover fabric and maintenance of the site (Section 4), product control (Section 5), process control (Section 6), and personnel (Section 7). GMP non-conformances can result in major or critical findings that affect your overall grade (AA, A, B, C, or D). If you're pursuing BRCGS certification, your GMP program needs to be airtight. Our BRC audit preparation guide covers the specifics.

GMP Within FSSC 22000 / ISO 22000 Audits

FSSC 22000 Scheme Version 6 is built on ISO 22000 and adds prerequisite programme (PRP) requirements through ISO/TS 22002-1. The PRP requirements are essentially GMP requirements covering building design, utilities, waste disposal, equipment suitability, cleaning and sanitation, pest control, personnel hygiene, and more. Your food safety management system needs to integrate these PRPs to pass an FSSC 22000 version 6 audit.

Using GMP Audits as a Stepping Stone to GFSI Certification

Not every facility is ready to jump straight to full GFSI certification. The GFSI Global Markets Programme (GMaP) provides a pathway for smaller or developing facilities to build their food safety systems incrementally. GMP audits are the starting point. You demonstrate GMP compliance first, then build up to a full GFSI-benchmarked certification. If you're a smaller facility working with limited resources, this stepped approach keeps the process manageable.

GMP Audits and FSMA: What Food Manufacturers Must Know

The Food Safety Modernization Act changed how GMP audits work for U.S. food manufacturers. If you produce food sold in the United States, FSMA affects your GMP program.

GMP Audits and FSMA Preventive Controls (21 CFR Part 117)

FSMA didn't create new GMP requirements from scratch. It updated and codified the existing GMPs under 21 CFR Part 117, Subpart B. The HACCP principles and preventive controls framework under Subpart C build on top of those GMP requirements. Think of it this way: GMP (Subpart B) is the foundation. Preventive Controls (Subpart C) are the structure built on that foundation. Your food safety plan ties both together.

During a GMP audit, auditors evaluate your compliance with Subpart B. During a food safety audit or FDA inspection, they also evaluate your preventive controls under Subpart C. If your GMPs are weak, your preventive controls can't function properly. A poorly maintained facility with inadequate sanitation will produce hazard analysis results that don't reflect reality.

FSMA 204 Traceability Requirements in GMP Audits

FSMA Section 204 introduced additional traceability recordkeeping requirements for certain high-risk foods (the Food Traceability List). If your facility handles foods on this list, auditors will now look for Key Data Elements (KDEs) at Critical Tracking Events (CTEs) throughout your supply chain. This means your receiving, production, and shipping records need to capture more specific traceability data than what was previously required. FSMA 204 requirements should be integrated into your GMP audit checklist if your products are on the Food Traceability List.

The 10 Most Common GMP Non-Conformances in Food Facilities

Knowing what auditors find most often helps you focus your preparation. These are the GMP non-conformances that show up repeatedly across food manufacturing audits, listed with their typical severity classification.

1. Inadequate Pest Control Documentation (Major)
Pest control logs with gaps, missing pest sighting reports, or no documented corrective actions when pest activity is detected. Your pest management provider should be generating detailed reports, and your team should be documenting any pest-related observations between service visits.

2. Missing or Expired Calibration Records (Major)
Thermometers, scales, pH meters, and other measuring instruments without current calibration certificates. Calibration should follow a defined schedule with documented results. If a device fails calibration, you need a documented assessment of any product affected since the last successful calibration.

3. Employees Not Following Hygiene SOPs (Minor to Major)
Auditors observe the floor. If they see employees skipping handwashing, wearing jewelry, or not wearing required protective clothing, that's a finding. The severity depends on the contamination risk. Hygiene violations in a ready-to-eat area are more serious than in a raw receiving area.

4. Incomplete Cleaning Verification Records (Major)
Pre-operational inspection checklists with blanks, missing ATP swab results, or cleaning records that don't match the master sanitation schedule. If your schedule says you clean the filler head every shift, auditors expect a record for every shift.

5. Poor Allergen Segregation Controls (Critical)
Allergen-containing ingredients stored above non-allergen ingredients, shared equipment without validated cleaning procedures between allergen changeovers, or inaccurate allergen labeling. Allergen findings often receive a critical severity because of the direct health risk.

6. Temperature Monitoring Gaps in Cold Chain (Critical)
Gaps in cold storage temperature logs, refrigeration units without alarm systems, or no documented corrective actions when temperatures exceed critical limits. Temperature control failures directly affect food safety and are treated as critical findings.

7. Supplier Approval Program Not Up to Date (Minor to Major)
Approved supplier lists that haven't been reviewed in over a year, missing or expired COAs, or no risk-based assessment of suppliers. Auditors expect to see a current, documented supplier verification program.

8. Corrective Actions Without Root Cause Analysis (Major)
Corrective action records that address the symptom but not the cause. If your corrective action for a foreign material finding is "removed object from product" without investigating how it got there, auditors will flag it. Root cause analysis should be proportional to the severity of the non-conformance.

9. Training Records Missing for New Employees (Minor to Major)
New hires on the production floor without documented GMP training. Training records should show the date, content covered, trainer name, and employee signature. If you can't produce training records for employees currently working in production, that's a gap auditors will catch.

10. Facility Maintenance Issues: Damaged Walls, Floors, Ceilings (Minor to Major)
Cracked floor tiles, peeling paint, damaged ceiling tiles, or rusted equipment. These create harborage points for pests and bacteria. The severity depends on location. Damaged surfaces in a production area are more serious than in a dry storage room.

Digital GMP Audit Management vs. Paper-Based Systems

Your GMP audit program generates a significant amount of documentation. How you manage that documentation affects your audit readiness and your team's efficiency.

Where Paper Checklists and Spreadsheets Break Down

Paper-based GMP systems work for a single, small facility. They start breaking down when you add complexity. Multi-site operations struggle to maintain consistency across locations. Version control becomes a problem when SOPs are updated but old copies remain in circulation. Real-time visibility into audit findings is nonexistent when data lives in binders. And pulling together records for an auditor takes hours of searching through filing cabinets.

Spreadsheets are a step up from paper but carry their own issues. They lack audit trails (who changed what, when), don't support automated alerts for overdue tasks, and make corrective action tracking difficult across multiple findings.

What to Look for in GMP Audit Software

If you're evaluating digital tools to manage your GMP audit program, look for these capabilities: configurable audit forms and checklists that match your specific standard (SQF, BRCGS, FSSC 22000), automated task assignment and escalation for corrective actions, built-in CAPA workflows that enforce root cause analysis, a complete audit trail for every record change, real-time dashboards showing audit status and open findings, and multi-site support if you operate more than one facility.

The right tool should make your existing GMP audit process faster and more consistent without forcing you to change how you work.

Managing GMP compliance across multiple facilities? Allera's digital FSQA forms replaces spreadsheets with real-time audit tracking and automated alerts.

Bringing It All Together

GMP audits are foundational to food safety. They're required by regulation, expected by customers, and embedded in every GFSI certification scheme. The food facilities that perform well in GMP audits are the ones that treat GMP as a daily operating standard, not a once-a-year audit event.

Start with your internal audit program. Identify your gaps. Fix the documentation, train your team, and build a system that keeps your facility audit-ready year-round. Whether your next audit is from a certification body, a customer, or the FDA, the preparation process is the same.

Ready to simplify your next GMP audit? Schedule a demo to speak with a software expert about how Allera can help.