How to Audit a Supplement Factory Remotely

Ask for six things before anyone gets on a call: business licence, GMP certificate with its scope annex, the three most recent certificates for products similar to yours, an organisation chart that names who owns quality, the allergen and pest-control policy, and two COAs from commercial batches. A real factory sends these in a day because they already exist. A trading company posing as a factory takes a week, sends a licence for a different address, and cannot produce a COA that matches its own batch numbering.

Read the scope annex, not just the certificate cover. GMP and ISO certificates list the product categories and processes the site is actually certified for. A plant certified for capsules and tablets is not automatically certified for gummies or effervescents, even if the sales team says they can run them. Compare the certified address with the address on the business licence and on the COA. If three documents show three addresses, ask which one the batch was made in.

A recorded walkthrough is marketing. A live call where you choose the route is evidence. Tell them you want to start at goods-in and follow the material, not start at the showroom. Ask to see the receiving log and the quarantine area, then the weighing booth with the scale calibration sticker visible, then the production room in operation with people dressed for it, then the packaging line, then the finished-goods quarantine, then the retained-sample room, then the QC lab with instruments switched on.

Three details separate a working plant from a staged one. First, ask them to open a random bin in the warehouse and read the lot number and expiry out loud — then ask for the matching record later. Second, ask what the room pressure and humidity are right now, and whether anyone logs it. Third, ask to see the cleaning status board and a changeover in progress. Anyone can film clean equipment; only a running factory can show you the paperwork that goes with it.

The batch record is the only document that proves the product was made the way the certificate says. Ask for one complete record — not a summary page — and read it in this order: batch number and date, every ingredient with its supplier lot, the actual weights against the theoretical, each in-process check with the result and the initials, the yield against the expected range, the QC release signature, and any deviation with its investigation and disposition.

Two things are worth more than the rest. Deviations: a factory with zero deviations in a year is either perfect or not recording them, and the second is more likely. Ask to see one deviation report and how it was closed. Yield: if the actual yield sits outside the stated range and the batch was released anyway, the record tells you how seriously the site treats its own specification. If they will not send a full record before you place an order, that is your answer.

Every certificate has an identity beyond its logo: a certificate number, an issuing body, a scope, a facility address and an expiry date. Copy the number, then look it up in the issuing body's public registry, or email the address on their own website — never the address printed on the certificate. Registrar Corp, NSF, SGS, Bureau Veritas and Intertek all publish verification routes. A CQC certificate can be checked through CQC's own query service.

Watch the dates. A certificate that expired eight months ago is still a valid PDF. A scope that covers dry blending but not tablet compression is a real certificate describing a smaller capability than the sales deck claims. And a certificate issued to a different legal entity at the same address is normal in China — group structures are common — but you should ask for the relationship in writing, because your contract needs to be with the entity that actually holds the licence.

A COA is a claim about one lot. It proves the lot was tested against a specification; it does not prove the specification is right, that the method was suitable, or that the sample came from the material you will receive. Check that the COA names the lot, the test methods, the specification limits and the actual results, and that the report was issued by a laboratory with an accreditation number you can look up.

If a result is reported as less than a limit, ask for the limit of quantification. A heavy-metal result written as less than 10 ppm tells you almost nothing; less than 0.5 ppm with a named method tells you the lab can actually see the number. For a first order, pay for one independent test on the finished product from a lab you chose, and compare it to the factory's COA. If the two disagree, you have learned something important before the pallet ships, not after.

Any one of these is a reason to stop: they will not send a full batch record before an order; the certificate address does not match the production address and nobody can explain it; the video call is a scripted tour with a fixed camera; the COA has no lot number or no method; they quote a lead time shorter than the drying or stability step physically allows; they offer to print a certificate or COA from another factory; they cannot name their QC manager.

None of this requires hostility. Ask plainly, write down the answers, and compare them with the documents two days later. Consistency across a licence, a certificate, a batch record and a live camera is hard to fake and easy to check — which is exactly why it is the cheapest audit you can run.