Receiving, and identity testing

Of everything 21 CFR 111 asks for, establishing the identity of incoming components is the requirement small manufacturers most often miss, and it is the one everything else rests on.

The step the rule is most insistent about

If you do not know what a material is, nothing downstream means anything: not the blend, not the assay, not the label.

Supplement raw materials, botanicals in particular, are substitutable, adulterable and frequently mislabeled somewhere in a long supply chain. The risk is real rather than theoretical.

What to check on arrival

That the delivery matches the order and the paperwork. That the lot number on the container matches the certificate of analysis. Appearance and odor against the last accepted lot. Packaging integrity, because a split bag is a moisture and contamination event. And a visible date.

Then quarantine it until it is released rather than putting it straight on the shelf, which is the practice that separates a controlled operation from a careful one.

Identity is not a certificate

A supplier's certificate is evidence of what the supplier believes. The rule expects you to establish identity, and it allows verification approaches rather than requiring you to test everything yourself.

What it does not allow is assuming. The workable program for a small manufacturer: full testing at supplier qualification, identity testing on incoming lots on a written schedule, and a documented justification for whatever reduced verification you rely on afterwards.

Write the program down. An undocumented reasonable approach is indistinguishable from no approach.

Recording it

Date, supplier, their lot, your assigned lot, quantity, the certificate, the identity result, and who released it.

That record is what turns a customer's tub code into an answer about which supplier lot was involved, and it is impossible to reconstruct later.

References