FDA GMP Compliance Consultant: 21 CFR Parts 110, 111, and 210/211

If you've ever tried to read 21 CFR Part 211 from beginning to end, you already know the feeling. The language is dense, the cross-references multiply quickly, and somewhere around subpart J you start wondering whether you're reading a regulation or a logic puzzle. Most manufacturers don't fail audits because they're careless — they fail because the requirements are genuinely complex, and translating them into daily operations is harder than any checklist makes it look.

I've spent more than eight years helping companies do exactly that translation. At Certify Consulting, I've worked with 200+ clients across food, dietary supplements, and pharmaceutical manufacturing — and in my view, the single biggest gap I see isn't in intent. It's in implementation. Companies want to comply. They often just don't know how the regulation actually expects their SOPs, training records, and equipment logs to connect to each other.

This article is a practical map of the three regulatory frameworks I work in most: 21 CFR Part 110 (current Good Manufacturing Practice for food), 21 CFR Part 111 (dietary supplements), and 21 CFR Parts 210/211 (pharmaceuticals). Each has its own logic, its own audit pressure points, and its own common failure patterns. If you're trying to figure out which one applies to you — or how to prepare for an inspection under any of them — this is where I'd start.

Which Regulation Applies to Your Product?

This is the first question every client asks, and the honest answer is that product category determines your regulatory universe. The FDA draws hard lines between these frameworks, and crossing them without knowing it is one of the more common sources of audit exposure.

Here's a practical comparison:

One thing worth noting: Part 110 has been substantially supplemented — and in some cases operationally replaced — by 21 CFR Part 117, which came in under the Food Safety Modernization Act (FSMA). If you're a conventional food manufacturer operating under Part 110, you almost certainly also have obligations under Part 117. I'll touch on that distinction below.

For dietary supplement manufacturers, Part 111 is your primary regulation, full stop. But if your product contains both a dietary supplement and a drug claim — which happens more often than you'd think, especially with sports nutrition and condition-specific products — you may find yourself under dual scrutiny from CDER and CFSAN simultaneously. That's a situation worth flagging early.

Understanding 21 CFR Part 110: Food GMP Baseline

Part 110 has been on the books since 1986, and its age shows in places. The requirements cover the basics: buildings and facilities must be constructed to prevent contamination, equipment must be maintained in sanitary condition, and personnel must follow hygiene practices that don't introduce adulterants into the product. For most FDA investigators, a Part 110 inspection of a food facility will look at these areas plus pest control programs, water quality, and temperature controls.

What I see most often in Part 110 inspections is not a failure to understand the regulation — it's a failure to document that the practices required by the regulation are actually happening. The FDA doesn't take your word for it. If your cleaning and sanitation program isn't generating records, it might as well not exist in the eyes of an investigator.

A few Part 110 areas that get cited frequently:

• Personnel practices (§110.10): Inadequate exclusion of employees with illness, poor hair restraint compliance in production areas
• Plant and grounds (§110.20): Condensate drips in processing areas, inadequate floor-wall juncture sealing
• Sanitation operations (§110.35): Cleaning frequency not documented, sanitizer concentration logs missing
• Equipment and utensils (§110.40): Hollow rollers and dead legs in equipment not addressed in cleaning protocols

If you're preparing for an FDA food inspection, my starting point is always the same: pull your last 12 months of cleaning and sanitation records and look for gaps. Investigators do the same thing within the first hour.

Understanding 21 CFR Part 111: The Dietary Supplement Standard

Part 111 is where I spend a significant portion of my consulting work, and in my view it is the most underestimated regulation in FDA's portfolio. The dietary supplement industry generates roughly $50 billion in annual U.S. retail sales, according to the Council for Responsible Nutrition, and yet the GMP compliance rate — as measured by FDA warning letter activity and 483 issuances — remains troublingly low. The FDA issued 483 observations to dietary supplement manufacturers in the hundreds annually, with identity testing failures and batch record deficiencies consistently ranking among the top citations.

The core logic of Part 111 is traceability and verification. The regulation wants you to be able to prove, at every point in manufacturing, that what you intended to put in the bottle is actually in the bottle — at the right identity, purity, strength, and composition. That sounds simple until you realize it requires:

• A complete specification system for every component and finished product (§111.70)
• An identity test on every incoming component (§111.75) — not just your finished product
• Batch production records that link every step of manufacturing to a master manufacturing record (§111.255 and §111.260)
• A qualified laboratory, either in-house or third-party, with the analytical methods to back up every specification you've set

The identity testing requirement is the one that surprises manufacturers most. Part 111 does not allow you to rely solely on your supplier's certificate of analysis for identity. You must test. There are limited exceptions for highly characterized suppliers under §111.75(a)(1), but they require a documented, systematic supplier qualification program that most companies don't have in place when I arrive.

Common Part 111 Audit Findings

Based on the FDA's own published 483 data and my eight-plus years of client work, the citations that come up most consistently are:

1. Failure to establish product specifications — You can't demonstrate conformance to a specification you haven't written
2. Inadequate identity testing — Relying on COAs without in-house or contract testing
3. Batch production record deficiencies — Missing review signatures, undocumented deviations, no reconciliation of yield
4. Out-of-specification (OOS) procedure gaps — No formal OOS procedure, or an OOS procedure that doesn't require investigation
5. Supplier qualification deficiencies — No qualification records, no approved supplier list, no requalification program

If I had to pick one area to address first for a dietary supplement company preparing for an FDA inspection, it would be identity testing. It's the foundational requirement, and getting it right opens up the rest of the compliance program.

Understanding 21 CFR Parts 210 and 211: Pharmaceutical GMP

Parts 210 and 211 are the most demanding GMP framework in FDA's portfolio, and they apply to any finished pharmaceutical product intended for human use. Part 210 covers general requirements and definitions; Part 211 is the operational standard — and it is thorough in a way that Parts 110 and 111 simply are not.

The pharmaceutical GMP framework is built on a few core concepts that run through almost every subpart of Part 211:

Validated processes. Under §211.100, all production and process controls must be written and followed, and under established FDA guidance (the 2011 Process Validation Guidance for Industry), validation is an ongoing lifecycle activity — not a one-time exercise. This is a significant operational commitment for most manufacturers.

Laboratory controls. Subpart I of Part 211 (§§211.160–211.194) covers laboratory controls, and this is where pharmaceutical inspections frequently generate observations. Out-of-specification results must be investigated under a formal procedure (§211.192). Stability programs must be ongoing and representative. Method validation must be documented. In 2023 and 2024, the FDA significantly increased its scrutiny of laboratory data integrity — particularly at foreign drug manufacturing sites — making this an area of heightened inspection focus heading into 2025 and beyond.

Change control. Pharmaceutical manufacturers are expected to evaluate and document any change to a validated process, formula, method, or system. The absence of a functioning change control program is one of the clearest signs to an FDA investigator that a quality system is not actually working.

Annual product review. §211.180(e) requires an annual review of each drug product to assess the quality standards and the need for changes. This is routinely overlooked by smaller manufacturers, and it generates citations.

The Data Integrity Issue Is Not Going Away

The FDA's emphasis on data integrity — rooted in ALCOA+ principles (Attributable, Legible, Contemporaneous, Original, Accurate, plus Complete, Consistent, Enduring, and Available) — has accelerated since roughly 2019 and shows no sign of slowing. Between 2022 and 2024, data integrity observations appeared in a significant majority of warning letters issued to drug manufacturers. If your laboratory is still using paper-based systems with manual data entry, or if your electronic records system doesn't have audit trail functionality enabled, that gap will be found.

I've helped companies work through data integrity remediation, and it's genuinely one of the more involved compliance projects — not because the standard is unclear, but because the remediation requires looking at systems, procedures, and culture simultaneously. It's not just a SOP problem.

How an FDA GMP Compliance Consultant Adds Value

There's a version of consulting that I don't do: flying in with a thick binder of generic SOPs, handing them over, and calling it a compliance program. That approach generates paperwork, not compliance. And it tends to fall apart the moment an investigator asks an employee to walk them through a procedure.

What I actually do — and what I think a good GMP consultant should do — is work from the inside out. That means:

Starting with a gap assessment. Before recommending anything, I want to understand what the current state is. That means reviewing existing SOPs and records, walking the floor, talking to the people who actually run production and QC. The gap between what the SOPs say and what people actually do is almost always the most useful thing to know.

Building a compliance program that fits the operation. A dietary supplement contract manufacturer running 50-person batches has different documentation needs than a pharmaceutical manufacturer running computer-controlled granulation lines. Compliance programs need to fit the scale, the workflow, and the people — otherwise they don't get followed.

Preparing for the actual inspection experience. Paper compliance and inspection readiness are related but not identical. I do mock inspections with clients before FDA visits — walking the facility the way an investigator would, reviewing records the way an investigator would, asking the questions an investigator will ask. This is where 100% first-time audit pass rates actually come from. Not from better paperwork, but from teams that know what to expect and how to respond.

Staying current on FDA priorities. The FDA's inspection priorities shift. In recent years, data integrity, supply chain transparency, and FSMA implementation have all moved up the agency's priority list. What generated a warning letter in 2020 may have generated an import alert in 2024. Part of what a consultant brings is situational awareness about where the agency is focused right now — not just where it was focused when a regulation was written.

Part 110 vs. Part 111 vs. Part 211: Key Compliance Differences

Understanding where these frameworks differ matters as much as knowing what each one requires. Here's a comparison of the most consequential operational differences:

The gap between Part 110 and Part 211 compliance is, honestly, enormous. Companies that migrate from food manufacturing into dietary supplements or pharmaceuticals consistently underestimate how much more the regulatory framework demands. That transition is one of the most common inflection points where having an outside consultant pays for itself quickly.

What to Look for in a GMP Consultant

Not every GMP consultant has the same background, and the credentials matter more than the title. Here's what I'd look for if I were hiring someone:

Regulatory breadth. A consultant who only knows pharmaceuticals may misread a dietary supplement requirement. The frameworks are related but distinct, and real-world experience with multiple frameworks is genuinely useful.

Credentials that reflect the discipline. Relevant credentials in this space include the Certified Professional in Good Manufacturing Practices (CPGP), the Certified Quality Auditor (CQA), and the Regulatory Affairs Certification (RAC). I hold all three, along with a JD, MBA, PMP, and CMQ-OE — because GMP compliance doesn't exist in isolation from legal, project management, and quality system considerations.

A documented track record. Ask for references. Ask about audit outcomes. Any consultant worth hiring should be able to point to specific results — not general experience.

Practical floor-level knowledge. The consultants who generate the best outcomes are the ones who are as comfortable on the production floor as they are in the boardroom. SOPs don't manufacture products — people do, and a compliance program that works has to be designed around how work actually happens.

Getting Started: What the First 90 Days Look Like

When a new client engages Certify Consulting, the first 90 days follow a consistent pattern:

1. Regulatory determination — Confirm which frameworks apply and identify any dual-regulation exposure
2. Gap assessment — Systematic review of current SOPs, records, facilities, and quality system structure against applicable regulations
3. Prioritized remediation plan — Ranked by audit risk and operational impact, not alphabetical order
4. SOP development and revision — Written to the specific operation, not pulled from a generic library
5. Training — Not a one-time event; built into the operational calendar
6. Mock inspection — Before any FDA visit, walk the facility and the records the way an investigator will

The goal is not to pass one inspection. The goal is to build a quality system that doesn't need heroics to survive the next one.

If you're trying to figure out where your operation stands against 21 CFR Parts 110, 111, or 210/211 — or if you have an FDA inspection on the horizon — I'm genuinely happy to talk through it. You can reach Certify Consulting at certify.consulting.

Frequently Asked Questions

What's the difference between 21 CFR Part 110 and Part 111? Part 110 applies to conventional food manufacturers and covers basic sanitation, facility, personnel, and process controls. Part 111 applies specifically to dietary supplement manufacturers and adds substantially more rigorous requirements, including mandatory batch records, component identity testing, and a formal specification system. If you make dietary supplements, Part 111 is your primary regulation — though Part 110's sanitation principles still inform best practices.

Do I need a GMP consultant if I already have a quality manager? Not always — but a quality manager and an outside consultant serve different functions. A quality manager runs the day-to-day quality system; a consultant brings external audit experience, current regulatory intelligence, and the ability to see gaps that internal teams become blind to over time. Most of the clients I work with have quality managers. What they're bringing me in for is perspective, inspection readiness, and help with specific remediation projects the internal team doesn't have bandwidth to tackle alone.

How long does it take to become FDA GMP compliant? It depends heavily on your starting point. A facility that has good operational discipline but poor documentation can often be brought to inspection readiness in 90 to 180 days. A facility with systemic quality system gaps, data integrity issues, or process validation deficiencies may require 12 to 24 months of sustained work. The honest answer is that compliance is an ongoing state, not a finish line — but first-time inspection readiness is a achievable goal with a clear timeline.

What are the most common reasons dietary supplement companies fail FDA audits? Based on FDA 483 data and my own client experience, the most common citations are: failure to establish written product specifications, inadequate component identity testing, deficient batch production records, no formal OOS investigation procedure, and incomplete supplier qualification programs. Identity testing in particular catches companies off-guard — the regulation requires it on every incoming component, not just finished product, and relying solely on supplier COAs is not compliant.

What does 21 CFR Part 211 require for pharmaceutical process validation? Under §211.100 and the FDA's 2011 Process Validation Guidance for Industry, process validation is a three-stage lifecycle approach: Stage 1 (Process Design), Stage 2 (Process Qualification), and Stage 3 (Continued Process Verification). This means validation is not a one-time exercise — it requires ongoing monitoring and data collection to demonstrate that a process remains in a state of control. Changes to a validated process trigger formal change control and may require revalidation of affected steps.

Last updated: 2026-04-24

Jared Clark, JD, MBA, PMP, CMQ-OE, CQA, CPGP, RAC is the founder of Certify Consulting and has served 200+ clients across FDA-regulated food, dietary supplement, and pharmaceutical industries with a 100% first-time audit pass rate.