GMP+ audit: how is the assessment carried out?
A GMP+ audit is an on-site assessment by an accredited certification body. The auditor checks whether your company applies the requirements of the GMP+ scheme (GMP+-regeling, GMP+ scheme) in practice, not only on paper. You can find which bodies are authorised on the GMP+ page for certification bodies . The rules for the audit itself, such as the findings and deadlines, are set out in the GMP+ document CR 2.0 .
An audit is one part of the process. You can read which requirements you must meet on the page requirements per module. For how long a certificate stays valid and when the next audit takes place, see GMP+ validity.
In short: the auditor visits, checks your evidence and writes down findings. You close those findings within fixed deadlines. Only after that does the certification decision follow.
What happens during a GMP+ audit?
An audit consists of preparation, a visit on site and a report. The auditor assesses how your company works for each requirement. They ask for evidence, such as records, procedures and the actual process on the shop floor or in the warehouse.
For a company without technical staff, the main thing to know is that the auditor does not carry out tests. They check whether your agreements work and whether you record them. A procedure that is correct but not followed results in a finding.
A fictional example: Veevoerhandel Dijkstra BV trades in animal feed and has its warehouse and administration audited in one visit. The auditor asks for the purchase records of the last three months, looks at how separated products are stored in the warehouse, and asks how the driver accepts the load. For each part, they ask for the evidence that belongs to it.
How do you prepare?
Preparation largely determines the result. Start with an internal check of your own system. Work through the requirements and note where you cannot show the evidence directly.
Put your documentation in one place
Collect procedures, records and work instructions. Make sure the versions are correct and that everyone uses the same version.
Go through the requirements per module
Ask yourself for each requirement: can I show that I do this? If the answer is no, fix it before the audit.
Arrange your staff
Decide who will speak to the auditor. These people must be able to explain the processes, even without the document in front of them.
Prepare the site
Make sure the storage, loading area and administration are tidy and accessible. An auditor also looks at day-to-day practice.
Note: the auditor does not only check whether the system exists. They also check whether it works. An internal audit beforehand is therefore the best preparation.
What does the auditor assess?
The auditor works through the requirements of your modules. Think of the purchase of raw materials, the traceability of products, the cleaning of installations, transport and the handling of deviations. The requirements per module are on the page requirements per module.
Part of the work is the HACCP analysis. GMP+ expects you to have your risks in view and to record your measures. The auditor therefore often asks for your risk analysis and for the records that show you carry out the measures.
The GMP+ database also plays a role. The company must have correct details, and the certification body updates the database after a positive decision.
What findings are there?
After the audit, the auditor records the findings. GMP+ uses three categories in CR 2.0 (annex 1). The category determines how quickly you must act and whether your certificate can go ahead.
| Category | What it means | Deadline to close | Effect on certification |
|---|---|---|---|
| Minor | Non-compliance with a requirement that does not affect feed safety | If there are fewer than ten minors, you close them at the next on-site audit. If there are ten or more, within 6 weeks | If there are fewer than ten minors, the certificate can be issued |
| Major | Non-compliance that could affect safety, or failure to comply with legislation | Within 6 weeks | The certificate cannot be issued yet |
| Critical | Non-compliance that affects safety, or suspicion of fraud or gross negligence | Within 2 weeks | The certificate cannot be issued yet, and this can lead to suspension or withdrawal |
A finding that you do not close can have more serious consequences. If you are unsure, ask your certification body what it means for you.
The full overview of deadlines and effects is in annex 1 of CR 2.0. That annex is complex, so if you are unsure, ask your certification body which category applies.
How do you follow up on findings?
After the audit, you receive the report. CR 2.0 requires the certification body to send the report to the company within eight weeks of the audit.
For each finding, you write a corrective action plan. It answers three questions: what is wrong, what you do to fix it immediately, and what you do to prevent it from happening again. Send that plan to the certification body with evidence. Evidence can be a new procedure, a recorded training or a photo of an adjusted storage area.
Example: Veevoerhandel Dijkstra receives one major finding about the registration of suppliers. The company completes the supplier register, has the buyer explain the new way of working and sends a copy of the updated form. Within six weeks, the finding is closed.
Common mistake: a company closes a finding with a promise instead of evidence. Always send a record, a document or a photo.
What if the audit does not go well?
With a major or critical finding, the certification decision can be delayed. A critical finding can lead to suspension of the certificate, for a maximum of three months. If you do not manage to close the finding, the certificate is withdrawn. After withdrawal, you are excluded from the scheme for at least one year. You can read more about these consequences on GMP+ validity.
How long does an audit take?
The duration depends on the size of your company and the number of sites. The exact number of hours is in the scheme documents. Ask your certification body in advance, so you can plan the right day.
Frequently asked questions
Who may carry out a GMP+ audit?
A certification body recognised by GMP+ International. You can find an overview of these bodies on the GMP+ page .
Do I need to report anything to GMP+ after the audit?
Ask your certification body which reports apply after the audit. Check the status yourself after the audit in the GMP+ database.
What is the difference between an internal audit and a GMP+ audit?
You carry out an internal audit yourself, to test your own system. A certification body recognised by GMP+ carries out a GMP+ audit. Only the latter leads to a certificate.