The FDA’s Current Good Manufacturing Practice regulations for dietary supplements — codified at 21 CFR Part 111 — have been in effect since 2008. Yet FDA warning letters and 483 observations continue to cite the same categories of violations year after year. Identity testing. Finished product specifications. Batch production records. These aren’t obscure requirements buried in regulatory guidance; they’re core obligations that every supplement manufacturer should have systems to meet.
If you’re a dietary supplement manufacturer — whether you make finished products, contract manufacture for brands, or supply raw ingredients — 21 CFR Part 111 defines your baseline compliance obligations. Understanding what it actually requires, not just what it says, is the difference between a functional quality system and a paper one.
The regulation is organized into subparts that cover the full manufacturing lifecycle. Subpart B covers personnel — qualifications, training, and hygiene requirements. Subpart C covers physical plant and grounds. Subpart D covers equipment and utensils. Subpart E covers production and process controls. Subpart F covers quality control operations. Subpart G covers components, packaging, and labels. Subpart H covers master manufacturing records and batch production records. Subpart I covers laboratory operations. Subpart J covers manufacturing operations. Subpart K covers packaging and labeling. Subpart L covers holding and distributing. Subpart M covers returned dietary supplements.
For most manufacturers, the highest-risk areas from a compliance standpoint are Subparts F, G, H, and I — quality control, component management, records, and laboratory operations. These are where FDA investigators focus during inspections, and where warning letters most frequently originate.
Under 21 CFR Part 111.75, manufacturers must establish specifications for each component used in manufacturing, and must conduct at least one test or examination to verify the identity of each component. For botanical ingredients, identity testing is particularly important — and particularly complex. The regulation doesn’t specify which test method to use, but FDA expects the method to be appropriate for the ingredient and capable of distinguishing the ingredient from adulterants or substitutes.
The common mistake is relying solely on a Certificate of Analysis from the supplier. A COA is documentation of the supplier’s testing, not your testing. Under 21 CFR Part 111.75(a)(1), you must conduct your own identity test unless you’ve established a qualified supplier program under 21 CFR Part 111.75(a)(2) — and even then, the requirements for qualifying a supplier are substantial. You need documented evidence that the supplier’s testing is reliable, which typically means auditing the supplier’s laboratory, reviewing their test methods, and periodically verifying their results with your own testing.
For botanical ingredients, identity testing methods that are commonly used include macroscopic and microscopic examination, HPTLC (High-Performance Thin-Layer Chromatography), DNA barcoding, and near-infrared spectroscopy. Each method has strengths and limitations for specific ingredients. The appropriate method depends on the ingredient, the form (whole, powdered, extract), and the potential adulterants of concern. Requirements vary by ingredient and product category — consult a qualified regulatory expert for your specific situation.
Under 21 CFR Part 111.70, manufacturers must establish specifications for finished dietary supplements. Those specifications must include identity, purity, strength, and composition. Under 21 CFR Part 111.75(c), manufacturers must conduct testing to verify that finished products meet those specifications before releasing them for distribution.
The regulation doesn’t mandate specific test methods or specific analytes beyond what’s necessary to verify your own specifications. But FDA expects your specifications to be meaningful — not so broad that any product would pass. If your specification for a probiotic supplement says only “meets label claim,” FDA will ask how you’re verifying that, and what “meets label claim” means in testable terms.
For supplements with label claims — potency claims, CFU counts, specific nutrient levels — your finished product testing program needs to be able to verify those claims. That typically means working with an ISO 17025-accredited laboratory that has validated methods for your specific product matrix. The testing program should be documented in your master manufacturing record, and results should be captured in batch production records.
Subpart I (21 CFR Part 111.303 through 111.330) covers laboratory operations specifically. It requires that laboratory controls include the use of criteria for sampling and testing, the use of appropriate test methods, and the documentation of laboratory results. It also requires that laboratory instruments be calibrated and maintained, and that laboratory personnel be qualified for the tests they perform.
Many supplement manufacturers use contract laboratories for testing rather than maintaining in-house labs. That’s entirely permissible under 21 CFR Part 111, but it doesn’t transfer your compliance obligations to the contract lab. You remain responsible for ensuring that the laboratory you use is capable of performing the required tests, that the methods are appropriate, and that the results are documented in your batch records. Your supplier qualification program for contract laboratories should document how you’ve verified their competence.
A compliant 21 CFR Part 111 testing program has four components that need to work together: specifications (what you’re testing against), methods (how you’re testing), records (documenting what you did and found), and a qualified laboratory (who’s doing the testing).
The specifications drive everything else. Before you can build a testing program, you need finished product specifications that are specific enough to be testable, and component specifications that cover identity, purity, and any relevant contaminant limits. FDA doesn’t prescribe specific limits for most contaminants — you’re expected to set limits that are appropriate for your product and supported by safety data.
At Aurora TIC, we help supplement manufacturers design testing programs that address 21 CFR Part 111 requirements without over-testing or under-testing. The goal is a program that’s defensible under FDA scrutiny and operationally sustainable. That means right-sizing the testing scope, selecting appropriate methods, and building the documentation infrastructure that ties it all together.
The regulation is the floor, not the ceiling. A well-designed testing program does more than satisfy 21 CFR Part 111 — it gives you genuine confidence in your products and the documentation to defend that confidence if FDA comes knocking.