GMP Certification Renewal and Ongoing Compliance for Established Gummy Supplement Facilities

Why GMP Certification Renewal Is a Different Challenge Than Initial Certification

When a gummy supplement facility earns its initial GMP certification — whether from NSF International, UL, or another accredited body — the team often exhales. The gap assessment is behind them, the corrective actions are closed, and the audit certificate is framed on the wall. What happens next is where many operations quietly drift out of compliance.

Renewal and ongoing compliance present a fundamentally different challenge than initial certification. During the first certification cycle, your team is building systems from scratch: writing SOPs, establishing your approved supplier list, validating your depositing lines, and documenting your water activity controls for the first time. During renewal, the question is whether those systems have held up under real production conditions — with actual batch failures, personnel turnover, equipment changes, and the inevitable shortcuts that creep into daily operations when no auditor is watching.

Under 21 CFR Part 111, the FDA expects your quality system to function continuously, not just during audit windows. NSF GMP certification surveillance audits are specifically designed to catch the gap between what your SOPs say and what your floor is actually doing. Understanding how renewal works — and what auditors focus on the second and third time around — is essential for any established gummy manufacturer that wants to keep its certification current without scrambling every time an audit notice arrives.

The Renewal Audit Cycle: What Gummy Facilities Must Know

NSF GMP certification for dietary supplement facilities typically operates on an annual surveillance audit schedule, with full recertification audits occurring every three years. For gummy-specific operations, this means auditors will visit your facility at least once per year to verify that your quality system is functioning as documented. These surveillance audits are not abbreviated walkthroughs — they are targeted reviews of the areas most likely to have drifted since your last audit.

For gummy manufacturers specifically, surveillance auditors consistently focus on the following areas:

• Water activity records: Your water activity targets for finished gummies should be documented in your Master Manufacturing Record (MMR), and your in-process and finished product test logs should show consistent compliance. Auditors will pull batch records from the past twelve months and cross-reference them against your specifications. If your aw limit is 0.60 and several batches show readings at 0.62 or 0.63 with no documented deviation, that is an immediate finding.
• Bloom strength controls: If your formulas use gelatin, your incoming material specifications should include Bloom strength requirements (commonly 200–250 Bloom for standard gummy production). Auditors will check whether your approved suppliers are still delivering material within spec and whether your incoming testing program is actually capturing Bloom data — not just relying on COA review.
• Depositing and cooking temperature logs: Cook temperature, depositing temperature, and mold cooling parameters should appear in your batch records with actual values, not just a checkbox confirming they were met. Surveillance auditors look for missing data fields, blanked-out entries, and batch records that appear identical across multiple production runs — a sign that operators are completing paperwork by rote rather than actual observation.
• CAPA closure rates: Any CAPA opened since the last audit should be documented, root-caused, corrected, and effectiveness-verified. Auditors will specifically check whether CAPAs opened in response to the last audit's findings were actually closed with objective evidence — not just a corrective action description with no follow-up verification.
• Training records: Personnel turnover in gummy production is high. Surveillance auditors will ask to see training records for any employees hired since the last audit, particularly for roles that perform in-process testing, cook operations, or finished product release.

The most important preparation step for any surveillance audit is a structured internal audit conducted six to eight weeks before your expected audit window. Do not wait for the auditor to find what your own team should have already caught.

System Updates That Trigger Mandatory Documentation Reviews

One of the most common ways established gummy facilities fall out of GMP compliance between audits is by making operational changes without updating the quality system documentation that governs those operations. Under 21 CFR Part 111 and NSF GMP requirements, any change to a formula, process, equipment, or supplier that could affect product identity, purity, strength, or composition must be managed through a formal change control process.

For gummy manufacturers, the following operational changes are particularly high-risk if handled informally:

Ingredient Supplier Changes

Switching gelatin or pectin suppliers mid-cycle is one of the most common changes that bypasses change control at gummy facilities. When a procurement team shifts to a new gelatin supplier because of pricing or availability, the QA team must be involved before the first delivery arrives — not after. The new supplier must be qualified against your approved supplier program, the new material must be tested against your incoming specifications (including Bloom strength, mesh size, and moisture content for gelatin), and your MMR must be updated to reflect the new supplier's material if there are any specification differences. If the switch affects your cook or depositing parameters, process revalidation may also be required.

Equipment Upgrades and Line Changes

Replacing a depositing head, upgrading a mogul system, or adding inline coating equipment are all changes that require documented equipment qualification before the modified line is used for commercial production. Your IQ/OQ/PQ documentation must be updated, and your SOPs must reflect any new operating parameters introduced by the upgraded equipment. Surveillance auditors will ask whether any equipment changes occurred since the last audit — and if you cannot produce change control records and updated qualification documentation, the finding will be significant.

Formula Modifications

Even minor formula changes — adjusting citric acid concentration, switching from sucrose to a sugar alcohol base, or modifying your coating formula to address stickiness complaints — trigger documentation requirements. Your product specifications, MMR, and stability program must all be reviewed and updated as part of a formal change control process. If your pectin-based gummy formula is modified to address texture failures at high humidity, your water activity limits and in-process controls may also need to be revisited and revalidated.

Maintaining a change control log that captures every operational modification — with QA sign-off, affected document revision numbers, and implementation dates — is the single most effective way to demonstrate continuous GMP compliance between audit cycles.

Building a Continuous Compliance Program That Survives Personnel Turnover

The most fragile element of any gummy facility's GMP certification is the people who execute the quality system on the floor. High turnover in production roles, changes in QA management, and the departure of institutional knowledge holders can quietly erode a compliance program that looked excellent on audit day. Building a continuous compliance program requires designing your quality system so that it functions correctly regardless of who is filling a given role on any given day.

For gummy-specific operations, this means several things in practice:

• Role-specific SOP design: Your SOPs for cook operations, depositing, demolding, coating, and finished product testing should be written at the operator level — meaning any trained employee in that role can execute the procedure correctly without needing to ask a supervisor for clarification. If your gummy cook SOP requires a supervisor to interpret what "proper viscosity" means before depositing, the SOP is not adequately written.
• Documented onboarding training with competency verification: Every new hire in a GMP-relevant role should complete a documented training program that includes reading the applicable SOPs, observing the procedure performed correctly, and demonstrating competency under supervision before working independently. Your training records should show not just that the training happened, but that the employee demonstrated the required skill.
• Internal audit program with rotating auditors: A QA manager who performs all internal audits personally will inevitably develop blind spots. Cross-training a production supervisor or lead technician to conduct audits in departments outside their own adds a layer of objectivity and distributes compliance ownership across the facility.
• Annual SOP review cycle: Every SOP governing gummy production should be reviewed at least annually — and more frequently when a related process, equipment, or material changes. Your document control system should flag SOPs that are approaching their review date so that reviews happen proactively, not in response to an auditor asking why a procedure hasn't been reviewed in 26 months.

It is also worth noting that Amazon's supplement compliance requirements have added an external layer of ongoing accountability for gummy brands selling through that channel. Amazon may request current GMP certification documentation, COAs, and manufacturing facility records at any time — and an expired or lapsed certification can trigger listing suspension independent of any FDA enforcement action. Maintaining active certification is not just a regulatory obligation; it is a business continuity requirement for brands with significant Amazon volume.

Preparing for Recertification: The Three-Year Full Audit

Every three years, NSF-certified gummy facilities undergo a full recertification audit rather than a surveillance review. This is a comprehensive assessment of your entire quality system — not a targeted spot-check of last year's findings. Preparing for recertification requires a more thorough internal review than your annual surveillance prep, and it should begin at least three to four months before your certification expiration date.

Key areas to audit internally before a recertification review include:

1. Master Manufacturing Records: Pull MMRs for your top five to ten active SKUs and verify that every field is current, that specification ranges reflect your validated process parameters, and that the document revision history is complete and traceable.
2. Batch record completeness: Sample batch records from each production line across the past twelve months. Look for missing data, correction errors (corrections should be single-line with initials and date, not white-out or black-out), and any entries that appear inconsistent with your process parameters.
3. Supplier qualification file review: Every supplier on your approved supplier list should have a current qualification file that includes your supplier questionnaire or audit results, current COAs with your incoming test data, and a signed quality agreement. Files that are more than two to three years old without a re-qualification review are a recertification risk.
4. CAPA trend analysis: Review all CAPAs opened and closed over the three-year certification period. Identify any recurring root causes — particularly those tied to gummy-specific process controls like water activity exceedances, Bloom strength variability, or coating adhesion failures. If the same root cause has appeared multiple times, your corrective action has not been effective, and you should address that gap before the auditor identifies it.
5. Label compliance review: FDA's enforcement posture on dietary supplement labeling continues to evolve. Conduct an internal label review for each active SKU to verify that your Supplement Facts panels, net quantity statements, and structure/function claims comply with current regulatory requirements. Gummy products are particularly susceptible to net quantity accuracy issues because moisture loss during shelf life can reduce individual gummy weight below the declared net quantity.

The goal of recertification preparation is not to perform a surface-level polish of your quality system. It is to genuinely assess whether the systems you built three years ago are still functioning as designed — and to make meaningful corrections before an outside auditor identifies the gaps that your team has learned to work around.

GummyGMP LLC works exclusively with gummy supplement manufacturers navigating every stage of the certification lifecycle — from initial readiness through surveillance audits and full recertification. If your facility is approaching a renewal window or struggling to maintain compliance between audits, contact our team for a structured gap assessment built specifically for gummy production operations.