GMP in the Food Industry: Good Manufacturing Practices, Requirements and Examples

Good manufacturing practices (GMP) in the food industry are the baseline conditions every food plant must keep: clean, trained people, a sanitary building and equipment, controlled processes and proper storage. In the US they are law, not guidance: FDA's current GMPs are in 21 CFR 117 Subpart B, and inspectors cite those sections when a plant falls short.

For getting written GMP procedures in front of operators at the point of use, see our guide to digital SOPs and work instructions.

‍

GMP requirements in 21 CFR 117 Subpart B

Subpart B is the part of FDA's human food rule that sets the GMPs. Each section covers one area of the plant, and each is something an inspector can check on a walkthrough. Qualifications and training for people who work with food (21 CFR 117.4) sit in Subpart A, so they are listed in the first row.

‍

Examples of GMP in food manufacturing

GMP is easiest to understand through the daily controls it produces. Each example below has a record an auditor or inspector can ask to see.

‍

What GMP Means In Food Manufacturing

Good Manufacturing Practices describe the methods, equipment, facilities, and controls required to produce food under sanitary conditions. In practical terms, GMP in the food industry is the operating discipline that keeps the production environment under control before product-specific hazards are addressed.

FDA describes food GMPs as the minimum sanitary and processing requirements for producing safe and wholesome food. That word minimum matters. GMP is the floor, not the ceiling. A facility that cannot meet GMP expectations is not ready to rely on a HACCP plan, SQF system, BRCGS certification program, or FSSC 22000 food safety management system.

The term Current Good Manufacturing Practices, or cGMP, adds another important point. The “current” part means the facility is expected to use methods, controls, and evidence that reflect today’s understanding of food safety risk. A sanitation procedure written years ago may not be enough if the equipment has changed, allergen profiles have changed, product risk has changed, or verification methods have improved.

The rule was finalized as part of FDA’s FSMA Preventive Controls for Human Food rule, which shifted food safety regulation further toward prevention.

In Canada, similar expectations sit inside the Preventive Control Plan framework under the Safe Food for Canadians Regulations. The terminology is different, but the operating logic is the same: identify hazards, control them, document the controls, and prove that the system works.

Under GFSI-recognized schemes such as SQF, BRCGS, and FSSC 22000, GMP requirements appear as prerequisite programs. The scheme names differ, but auditors still look for the same evidence: documented programs, trained personnel, monitoring records, corrective actions, verification, and consistency between written procedures and what happens on the floor.

For teams trying to track changing rules across FDA, CFIA, SQF, BRCGS, and FSSC, regulatory intelligence for food manufacturers becomes part of GMP discipline. The facility needs to know when the baseline has changed, not only when a customer asks during an audit.

‍

The 5 Ps Of GMP

A common way to explain good manufacturing practices in food industry training is the 5 Ps framework. It is not the structure used in 21 CFR Part 117, and it is not how every certification scheme is written. But it is useful because it shows how GMP areas work together.

1. People: Personnel hygiene, health controls, training, visitor rules, contractor controls, protective clothing, and behavior in food handling areas.
2. Premises: Facility layout, construction, drainage, walls, floors, ceilings, lighting, ventilation, traffic flow, pest entry points, and the condition of buildings and grounds.
3. Processes: Manufacturing practices, sanitation procedures, equipment use, product changeovers, pre-operational inspections, operational checks, and production controls.
4. Products: Raw material approval, specifications, incoming inspection, allergen status, storage conditions, labeling, lot coding, and finished product release.
5. Procedures: Written SOPs that define how GMP controls are implemented, monitored, verified, and corrected when something goes wrong.

The 5 Ps are easy to remember, but they should not be treated as separate silos. A weak procedure creates inconsistent behavior. Poor premises make sanitation harder. Untrained people can break allergen controls. Uncontrolled products can introduce hazards that the process was never designed to manage.

In a real audit, GMP is evaluated as a connected system. The auditor is not only asking whether a procedure exists. They are asking whether the procedure reflects the facility, whether people understand it, whether records prove it was followed, and whether corrective actions happen when the system fails.

‍

GMP Requirements Under 21 CFR Part 117, Subpart B: Detail By Area

FDA’s GMP regulation for human food is organized into several major areas. Each area has its own compliance expectations, but auditors and inspectors usually evaluate them together during a walkthrough, record review, and employee interviews.

Personnel (§ 117.10)

Personnel requirements address who can work in food production areas and what practices they must follow.

The regulation requires disease control. Any person with illness, open wounds, infections, or any other condition that could contaminate food must be excluded from operations where contamination could occur until the condition is corrected.

Cleanliness requirements include suitable outer garments, hand washing before work and after contamination events, hair restraints, removal or control of jewelry and unsecured objects, and restrictions on eating, drinking, chewing gum, and tobacco use in production areas.

Allergen cross-contact is also part of personnel control. Employees must take precautions to prevent both microbial contamination and allergen cross-contact. This is where GMP connects directly to an allergen management control plan. If employees do not understand allergen movement through tools, gloves, uniforms, rework, or shared equipment, the written allergen plan will not protect the product.

Training is required for every individual engaged in manufacturing, processing, packing, or holding food. That includes temporary, seasonal, agency, and contractor personnel. Attendance sheets alone are usually not enough. Auditors want to see that training is relevant to the person’s role and that the facility has some way to confirm understanding.

What auditors check: training records for all active personnel, including temporary workers; hygiene and illness policies; hand washing behavior during the walkthrough; protective clothing practices; visitor and contractor controls; evidence that allergen cross-contact prevention is included in training.

Common violations: training records that cover permanent employees only; no documented return-to-work criteria after illness; jewelry or phones visible in production areas; employees moving between allergen and non-allergen areas without controls; training records signed but not supported by interviews or observed behavior.

Plant And Grounds (§ 117.20)

Plant and grounds requirements address the physical environment around and inside the facility.

Grounds must be maintained in a way that prevents pest harborage, contamination, standing water, waste accumulation, and poor drainage. Stored equipment, weeds, refuse, and unmanaged exterior areas can all become pest or contamination risks.

The facility itself must be designed and maintained to reduce contamination. This includes suitable construction, enough space for operations and cleaning, separation of incompatible activities, adequate lighting, ventilation, drainage, and protection against pest entry.

For auditors, the walkthrough often starts here because facility condition quickly reveals whether the GMP program is alive. A procedure may say doors are sealed, but a visible gap under the receiving door says something else.

What auditors check: pest control records, bait station maps, service reports, corrective actions, maintenance logs, drainage condition, condensation control, door seals, wall penetrations, lighting protection, waste handling, and physical separation between incompatible activities.

Common violations: bait station maps that do not match the facility; gaps around pipes or utility penetrations; standing water in production or receiving areas; condensation above exposed product; damaged walls or floors that cannot be cleaned; unused equipment stored near production areas without control.

Sanitary Operations (§ 117.35)

Sanitary operations cover cleaning and sanitizing of the facility, equipment, utensils, and food-contact surfaces.

The regulation requires buildings, fixtures, equipment, and utensils to be kept clean and in good repair. Cleaning compounds and sanitizers must be safe and suitable for the intended use. The facility must define how cleaning is performed, how often it is performed, and how effectiveness is checked.

For food manufacturers, sanitation is one of the clearest areas where “documented” and “effective” are not the same thing. A sanitation record proves that someone signed a form. It does not prove that the line was clean. That proof usually comes from pre-operational inspection, ATP testing, allergen swabs, microbiological verification, chemical concentration checks, or another verification method appropriate to the risk.

Where sanitation is used to control allergens, verification becomes more important. If the facility runs multiple allergen profiles on shared equipment, the cleaning program must show that residues are removed or reduced to a safe and defined level before the next product is produced.

Effective sanitation programs at this stage typically rely on written procedures covering cleaning frequency, methods, chemical concentrations, and verification steps for every food-contact surface. See our guide to ATP testing and cleaning verification for one common verification method.

What auditors check: Master Sanitation Schedule, cleaning frequencies, equipment lists, SSOPs, pre-operational inspection records, ATP or allergen swab results, sanitizer concentration records, chemical contact times, corrective actions, and records showing who cleaned what and when.

Common violations: equipment missing from the Master Sanitation Schedule; records completed with no findings for months; no verification after allergen changeover; sanitizer concentrations not measured; cleaning tools not controlled by area; worn brushes or squeegees stored in production areas; corrective actions missing after failed pre-op checks.

Sanitary Facilities And Controls (§ 117.37)

This section covers water supply, plumbing, sewage disposal, toilet facilities, hand washing facilities, rubbish disposal, and related facility controls.

Water used in food production must be safe and adequate for its intended use. Plumbing must be designed to prevent contamination, including backflow, cross-connections, and improper drainage. Hand washing facilities must be accessible, properly supplied, and placed where employees actually need them.

This area is sometimes underestimated because it feels basic. But basic failures can create serious risk. A missing hand wash station near a high-care area, a poorly labeled non-potable water line, or compressed air that contacts product without testing can become a major audit issue.

What auditors check: water testing records, potable and non-potable water controls, plumbing diagrams, backflow prevention, hand washing station condition, toilet facility condition, waste disposal, and compressed air quality testing where compressed air contacts food, packaging, or food-contact surfaces.

Common violations: hand washing stations blocked or undersupplied; no water testing records; non-potable lines not clearly identified; no compressed air testing; hoses left on the floor; drains not maintained; waste containers uncovered or not removed at defined frequency.

Equipment And Utensils (§ 117.40)

Equipment and utensils must be designed, constructed, and maintained so they can be cleaned and do not contaminate food.

Food-contact surfaces should be smooth, non-absorbent, corrosion-resistant, non-toxic, and able to withstand the production environment. Equipment should allow cleaning, inspection, and maintenance. Dead ends, hollow rollers, inaccessible joints, worn gaskets, and cracked surfaces can all create microbial or allergen harborage points.

This is where GMP intersects with capital planning. A facility may buy equipment for throughput, price, or availability, but auditors evaluate whether the equipment can be cleaned, maintained, and verified. Hygienic design is not only an engineering issue. It is a food safety control.

What auditors check: equipment condition during the walkthrough, preventive maintenance records, calibration records, food-grade lubricant controls, repair logs, hygienic design review for new equipment, and evidence that temporary repairs are controlled.

Common violations: rust or pitting on food-contact surfaces; cracked belts or worn gaskets; temporary tape repairs in production areas; equipment not included in preventive maintenance; thermometers or scales overdue for calibration; equipment that cannot be disassembled for cleaning; lubricants not confirmed as food-grade.

Processes And Controls (§§ 117.80, 117.93, 117.110)

Processes and controls cover raw materials, ingredients, manufacturing operations, warehousing, distribution, and defect action levels.

Raw materials and ingredients must be inspected on receipt, stored under conditions that prevent contamination and deterioration, and rejected if they are unsuitable. This includes temperature control, moisture control, allergen segregation, pest protection, and lot identification.

Manufacturing operations must prevent contamination during production. That includes control of raw and ready-to-eat traffic, allergen changeovers, rework, work-in-process exposure, foreign material risk, and coding. Warehousing and distribution must maintain product safety after production, not only while the product is on the line.

This is one of the areas where supplier data, ingredient specifications, COAs, and internal controls need to connect. If your raw material records, allergen data, supplier approvals, and product specifications live in different places, gaps are easy to miss.

See how IONI Ingredients Intelligence helps teams connect supplier documents, ingredient data, allergen status, specifications, COAs, and compliance evidence before they become audit findings.

What auditors check: incoming inspection records, supplier approval evidence, ingredient specifications, allergen storage controls, temperature logs, lot coding, traceability records, work-in-process controls, warehouse condition, finished product release, and corrective actions for rejected or nonconforming materials.

Common violations: raw materials used before approval; allergen-containing and allergen-free materials stored without adequate separation; missing incoming inspection records; lot codes not carried through production; refrigerated ingredients staged too long at ambient temperature; rework used without defined limits; finished products released before required checks are complete.

‍

How GMP Appears In GFSI Certification Standards

GMP requirements appear in all major GFSI-recognized certification schemes, but the terminology and clause structure differ. The practical expectation is consistent: the site must maintain clean, controlled, documented, and verified operating conditions.

GMP In SQF

Under SQF, GMP requirements appear through the applicable Food Safety Code and sector-specific GMP module. For audits conducted today, manufacturers should still confirm the audit basis with their certification body, because SQF Edition 10 has been published but audits to Edition 10 are not expected to begin before January 2027 and remain linked to the GFSI benchmarking process. SQFI states that Edition 10 audits will not begin earlier than January 2027.

In practice, SQF auditors evaluate GMP through facility observation, record review, employee interviews, corrective actions, and consistency between the food safety plan and actual operations. A clean binder is not enough. If the auditor sees poor hygiene practices, missing sanitation verification, pest activity, uncontrolled product flow, or incomplete training records, the GMP system will be challenged.

For a practical pre-audit structure, use our SQF audit checklist for small food manufacturers to review GMP records, HACCP evidence, supplier approval, CAPA, traceability, training, and management review before the certification audit.

GMP In BRCGS

BRCGS Issue 9 addresses GMP requirements across several areas, especially site standards and personnel controls. Facility design, cleaning, pest control, waste management, equipment standards, maintenance, medical screening, protective clothing, and hygiene practices all sit inside the GMP expectation. For a broader preparation view, see our BRCGS certification guide for food manufacturers.

Allergen management is especially important under BRCGS because it is treated as a fundamental requirement. A serious failure in allergen control can affect certification even if other areas appear strong. Since allergen control depends heavily on GMP-level practices, such as cleaning verification, personnel movement, storage segregation, and changeover discipline, GMP failures can quickly become certification failures.

In practice, BRCGS auditors often test the system by following a risk through the facility. They may start with an allergen ingredient in storage, follow it to staging, observe production practices, review the changeover record, and then check whether cleaning verification supports the release of the next product.

GMP In FSSC 22000

FSSC 22000 uses ISO 22000 as the food safety management system standard and sector-specific prerequisite programs such as ISO/TS 22002-1 for food manufacturing. FSSC 22000 Version 7 was published in May 2026, while audits against Version 6 remain permitted until 30 April 2027. Upgrade audits against Version 7 are scheduled from 1 May 2027 to 30 April 2028.

For food manufacturers, ISO/TS 22002-1 covers GMP-style areas such as facility layout, utilities, waste disposal, equipment suitability, cleaning and sanitation, pest control, personnel hygiene, rework, warehousing, and prevention of cross-contamination.

Because Version 7 has already been released, manufacturers preparing for certification or recertification should not treat Version 6 as the only reference point. Existing certificates may still operate under the transition timeline, but new preparation work should account for Version 7 expectations and the planned upgrade period. For a deeper preparation view, see our guide to FSSC 22000 certification for food manufacturers

Preparing for SQF, BRCGS, FSSC 22000, or FSMA alignment? See how IONI supports FSMA, BRCGS, and SQF readiness by connecting requirements, records, corrective actions, and audit evidence.

‍

GMP vs HACCP vs prerequisite programs

These three terms are often mixed up. They sit at different levels of the same food safety system.

‍

GMP And HACCP: Where The Line Is

GMP and HACCP are often discussed together, but they control different levels of risk.

GMP operates at the facility level. It controls the background conditions that apply across products, shifts, lines, and production activities. Pest control, hand washing, sanitation, equipment maintenance, drainage, raw material storage, and personnel hygiene are GMP controls because they shape the general production environment.

HACCP operates at the process level. A Critical Control Point is a specific step where a specific hazard is controlled for a specific product or process. Cooking poultry to a defined internal temperature is a CCP because it controls Salmonella at a defined step. Metal detection can be a CCP because it controls physical contamination at the point where product passes through the detector.

GMP must be working before HACCP can work. If employees do not wash hands properly, if drains are dirty, if shared equipment is not cleaned between allergen profiles, or if raw and ready-to-eat flows cross without control, hazards can enter the product through routes the HACCP plan may not address.

This is also where the broader hazard analysis needs to stay realistic. For example, microbial growth risk does not depend only on one CCP. It can be affected by time, temperature, moisture, acidity, oxygen, and product characteristics. Our guide to FATTOM in food safety explains how these factors connect to HACCP decisions.

A common HACCP weakness is assuming GMP controls are effective without verification. The hazard analysis says sanitation controls allergen carryover, but there are no swab results. The plan assumes refrigerated ingredients stay cold, but staging logs are incomplete. The procedure says pest inspections happen weekly, but records show no findings for a year.

Auditors notice these gaps quickly. If they see condensation above exposed product, allergen residue on shared equipment, pest activity near raw materials, or employees bypassing hand washing, they will question whether the HACCP plan was built on reliable assumptions.

‍

GMP Violations Most Often Found During Audits

Across FDA inspections and GFSI audits, many GMP failures are not dramatic at first glance. They are often ordinary gaps that repeat: a missing record, an outdated equipment list, an employee not trained, a sanitizer concentration not checked, a corrective action not closed.

The risk is cumulative. One weak record may be a minor nonconformity. A pattern of weak records tells the auditor the system is not under control.

Training Records That Exclude Temporary Workers

Food manufacturers often train permanent staff well and miss temporary, seasonal, agency, or contractor workers. That creates a clear compliance gap because GMP requirements apply to anyone who manufactures, processes, packs, or holds food.

Auditors may ask temporary workers basic questions during the walkthrough: when to wash hands, where allergens are stored, what to do if a product spills, how to report illness, or how to identify a restricted area. If the answers do not match the SOP, the training record loses credibility.

Pest Control Records Without Activity Findings

A pest control program that never records findings can look suspicious. Real inspections usually find something over time: damaged bait stations, insect activity, exterior gaps, housekeeping issues, or corrective actions.

If records show no activity for months, auditors may question whether inspections are being conducted properly or whether the records are being completed from habit. The issue is not that findings exist. The issue is whether the site sees them, investigates them, and responds.

Allergen Changeover Cleaning That Is Documented But Not Verified

A sanitation record may show that cleaning happened. It does not prove that allergen residue was removed.

If a facility runs products with different allergen profiles on the same line, auditors expect evidence that changeover cleaning is effective. Depending on risk, that may include allergen swabs, visual inspection, ATP, validated cleaning procedures, defined sequencing, or a combination of controls.

This is one of the most common places where GMP and allergen management overlap. The allergen program says cross-contact is controlled, but the sanitation evidence has to prove it.

Equipment Maintenance Logs That Do Not Match The Equipment Present

Facilities change over time. New equipment is installed. Old equipment is removed. Lines are modified. Temporary equipment becomes permanent.

If the preventive maintenance schedule does not match the current equipment inventory, auditors will question the whole maintenance program. Missing equipment may also mean missing sanitation tasks, missing calibration, missing spare parts controls, and missing hygienic design review. For a practical maintenance and calibration setup, see our guide to preventive maintenance and equipment calibration logs.

Pre-Operational Inspection Records With No Findings

Pre-op records should reflect actual inspection. If a facility operates six days per week and records show no findings for months, that may look less like excellence and more like forms being completed without meaningful inspection.

Auditors do not expect perfection. They expect the site to find issues before production starts and to show what happened next. A strong pre-op system includes findings, decisions, corrections, rechecks, and release.

Cleaning Chemical Concentrations Not Measured

A sanitizer procedure may specify a concentration range, but the site still needs evidence that the chemical is used at the right strength.

Training records and chemical labels are not enough. Auditors look for titration records, test strip checks, concentration logs, contact time controls, and corrective actions when the concentration is outside range.

This matters because both under-concentration and over-concentration create problems. Too weak may not sanitize effectively. Too strong may create chemical residue risk or damage surfaces.

Compressed Air Testing Not Conducted

Compressed air is easy to miss because it is often treated as a utility, not an ingredient or food-contact input. But if compressed air contacts food, packaging, or food-contact surfaces, its quality needs to be controlled.

Auditors may ask where compressed air is used, whether it contacts product, what specifications apply, how often it is tested, and what happens if results fail. If the facility has no answer, the gap can become significant.

‍

How to Prepare for a GMP Audit

A GMP program becomes audit-ready when it can survive three tests: the document test, the walkthrough test, and the records test.

The document test asks whether procedures exist and whether they match the facility. A sanitation SOP that describes equipment no longer in use will not help. A hygiene policy that ignores temporary workers will not satisfy the requirement. A pest control program without an updated site map will raise questions.

The walkthrough test asks whether the facility behaves the way the procedures say it behaves. If the SOP says hair restraints are required, the auditor expects to see them worn correctly. If the allergen procedure says ingredients are segregated, the auditor expects to see clear segregation in storage and staging. If the maintenance program says food-contact surfaces are inspected, the auditor expects surfaces to be in good condition.

The records test asks whether the site can prove the system works over time. This is where many facilities struggle. They may have the right procedure and acceptable floor practices, but the record trail is incomplete. Missing pre-op checks, incomplete training records, open corrective actions, and inconsistent sanitation verification can all weaken the audit position.

If an inspector leaves a list of Form 483 observations after a visit, log each one as a corrective action with an owner and a due date.

Prepare in five steps:

1. Walk the plant against the Subpart B table above, section by section, and note every gap.
2. Check the training records (21 CFR 117.4) for everyone who works in production, including temporary and agency workers. Our guide to GMP training covers what those records should show.
3. Check cleaning, pest control and calibration logs for gaps, and for records that never show a finding.
4. Review the last FDA Form 483 or audit findings and close the open corrective actions.
5. Run a mock inspection with someone from outside the area, and fix what they find before the real one.

If your GMP records live across spreadsheets, binders, shared drives, ERP exports, and email, IONI custom integrations can help connect evidence from the systems your team already uses.

‍

GMPs are the backbone of your prerequisite programs, and our guide to prerequisite programs (PRPs) in food safety shows how they differ from OPRPs and CCPs.

Run GMP checks in IONI. Set up operational checks for sanitation, calibration and verification tasks that run on a schedule or on a trigger. Operators complete them from a To-Do list with pass or fail results and photos, a second person reviews the logs, failed checks lead to deviations and CAPA, and training records are tracked against your documents and SOPs. Book a demo to see it with your own checks.

Walk the plant against the same list every month. This free GMP self-inspection checklist follows 21 CFR Part 117, Subpart B: 63 plain-English items across personnel, plant and grounds, sanitary operations, facilities, equipment, processes and controls, warehousing and defect action levels. Mark Pass, Fail or N/A, then log a corrective action, an owner and a due date for every Fail. Made by IONI.

Free download: GMP self-inspection checklist (PDF) and editable Excel version.

Site | Inspection date | Inspector | Reviewed by

Based on: 21 CFR Part 117, Subpart B (Current Good Manufacturing Practice), eCFR, accessed Nov 2026. Rows paraphrase the rule in plain English; the regulation text controls. 117.95 (human food by-products held for animal food) is not covered here; add it if you sell by-products. This template is a starting point. Adapt it to your own food safety plan, your product risks and your certification body or customer requirements. It does not make a facility compliant or certified.

FAQ

What is GMP in the food industry?

Good manufacturing practices (GMP) in the food industry are the minimum sanitary and operating conditions a food plant must keep: hygienic people, a clean and well-built plant, cleanable equipment, controlled processes and safe storage. In the US they are set out in 21 CFR 117 Subpart B.

What are examples of GMP in the food industry?

Examples include hand washing and hair restraints, pest-proofed doors with a pest control log, a master cleaning schedule with pre-operational inspection, equipment calibration, allergen line clearance at changeover, a temperature check at receiving, FIFO or FEFO storage, and a register for glass and brittle plastic.

Is GMP certification required for food manufacturers in the US?

Compliance with the GMPs in 21 CFR 117 is mandatory for covered facilities, but Part 117 does not set up a GMP certificate. Third-party GMP audits and GFSI certification such as SQF, BRCGS and FSSC 22000 are usually customer requirements rather than legal ones.

What is the difference between GMP and HACCP?

GMP covers the baseline conditions for the whole plant, such as hygiene, sanitation, pest control and equipment. HACCP controls specific hazards at specific steps in a process. GMP has to work first, because a HACCP plan assumes the baseline is under control.

What are the 5 Ps of GMP?

People, premises, processes, products and procedures. This is a common industry training framework, not a regulation, and it is not how 21 CFR 117 is organized.