Most Common GMP+ Audit Nonconformities and How to Avoid Them

Minor versus major nonconformity — the basic difference

Before looking at examples, it helps to define the term itself. A minor nonconformity is usually a single, isolated deviation from a requirement — a missing operator signature on a control record, or one entry filled in incompletely. It does not mean the system as a whole is failing; one execution element has, not the system itself.

A major nonconformity is different — an entire system element is not functioning as required, or there is a real risk to feed safety: no control at all of a critical process point over an extended period, a HACCP analysis never updated after a significant product change, or a systemic lack of traceability. A major demands a faster response and closer verification of closure, because a structural gap is at stake, not a single error.

In practice, the line between the two is often judged case by case — the same finding, such as a missing record entry, can be assessed differently depending on whether it looks systemic or one-off.

Documentation that is out of date compared with the real process

This is the most common nonconformity we see in practice — not because companies lack procedures, but because their procedures describe a process that has moved on. A plant changes a supplier, adds a control step, reconfigures a line, or changes who is responsible for an area, while the documentation stays a year or two behind. An auditor spots the gap quickly on the shop floor: they ask how something is done, and the employee's answer does not match the procedure.

The gap usually builds gradually — one quick change rarely looks risky on its own. After several, though, the documentation stops reflecting reality, undermining confidence in the whole system. The simplest safeguard: every lasting change triggers a review of the relevant procedure.

Gaps in process control records

A second, equally common area is records — temperature, humidity and line-cleanliness logs, mixing parameters, or raw material intake. Typical nonconformities include time gaps, missing signatures, incomplete data (a value with no time recorded), or entries filled in "in advance", visible from uniform handwriting or dating.

Auditors check not just whether a record is filled in, but whether the values sit within set limits and whether an exceedance triggers a visible reaction — a note on the corrective action taken. A record with no deviation for months can be as much a warning sign as one full of gaps.

HACCP analysis not updated after changes

The HACCP analysis is a living document, not a one-off attachment from implementation day. The most common error is carrying out a full hazard and critical-point analysis once, then never returning to it despite new products, raw materials, a new line, or a new supplier. Every such change can introduce a new hazard or shift an existing risk — an analysis that ignores this stops being reliable.

Good practice is a fixed review cycle (once a year, say) and, more importantly, a clear rule that any significant process change triggers an immediate HACCP review. A separate knowledge base article covers how HACCP fits into the standard's requirements in more depth.

Batch traceability problems

Traceability is a foundation of GMP+, and an area where auditors regularly find gaps — usually not in a single link but in the connection between links. A company can show where a raw material came from and who received the finished product, but cannot clearly join the two ends of the chain — a raw-material batch is not linked to a production batch, or batch numbering changes between stages without a clear key.

The practical test auditors apply is asking for the full history of a randomly chosen batch — from raw material through production to dispatch date and destination — to be reconstructed within a reasonable time. If it needs manual searching across unconnected sources, the traceability system is working only in fragments, not as a whole.

Training-related nonconformities

Training is another recurring area. Carrying out training is not enough on its own — auditors expect evidence of effectiveness, confirmation that an employee understood and applies what was taught, not just a signed attendance sheet. Typical nonconformities: no such verification (a test, on-the-job observation, a follow-up conversation), no refresher training for long-serving staff, and no role-specific induction for new hires before they work unsupervised.

Treat the training programme as part of the quality management system, on a par with procedures and records — an annual plan, content matched to each role, and a documented way of checking results. Certified training from an external partner also makes it easier to demonstrate quality during an audit; see the GMP+ training page.

Supplier management and certificate verification

Feed companies answer not only for their own process but for the safety of incoming raw materials. A frequent nonconformity is outdated supplier-certificate verification — a certificate underpinning a supplier's approval expires unnoticed, so the register is never updated. Sometimes an approved list exists, but purchases still happen from suppliers outside it, without formal approval or a risk assessment.

An effective fix is a simple, consistently applied verification schedule — a named owner and set review dates for every key supplier's certificates, and a clear separation between approving a new supplier and routine purchasing, so an "urgent" order never bypasses the formal assessment path.

Pest control and plant hygiene

Plant hygiene is where auditors raise the most observations, though not all become formal nonconformities — some land in the report as recommendations. Typical points: gaps in the building fabric that let pests in, incomplete pest-control contractor reports, no monitoring-point map matching the real layout, and neglected cleaning of transitional and storage zones, which rarely get the same daily attention as the production hall.

Pest control is more than a contract with an external firm — it means analysing trends in the reports: is the number of signs found in one spot rising, and do corrective actions actually follow what is observed.

Change management without a safety impact assessment

The last recurring group concerns changing a process or recipe without a documented safety-impact assessment. A substitute raw material, a parameter change, a new packaging supplier, a recipe tweak — each should go through a formal change-management procedure covering a risk assessment, any HACCP update needed, and a decision on who approves it. In practice, changes are often made operationally "because it was quicker", with the formal assessment arriving late, if at all.

A missing procedure — or one that exists only on paper — is judged more strictly, because it undermines the very mechanism meant to keep unforeseen risk out of the feed chain, not just a single record.

What the process of closing a nonconformity looks like

A nonconformity found during an audit does not end the process — it starts it. The company must submit a corrective action plan, known as CAPA: not just fixing the effect (filling in a missing entry) but analysing the root cause and acting to stop it recurring. A CAPA plan typically covers the nonconformity, its root cause, the corrective action, the person responsible, and a deadline.

The certification body sets the deadline based on severity. Once actions are implemented, the company presents evidence — an updated procedure, a training record, a corrected register — and the body checks whether the cause was genuinely removed, not just addressed on paper. Only then is it formally closed.

How to systematically reduce the risk of future nonconformities

The most effective way to cut nonconformities in future audits is not last-minute preparation before the auditor arrives, but building control mechanisms into day-to-day operation of the system. Regular internal audits are key — run by someone sufficiently independent of the area's daily work — catching the documentation-practice gap before the certification auditor does.

The second pillar is management review — a regular leadership meeting analysing audit results, nonconformity status and complaints. Done rigorously, it catches recurring patterns early. See the GMP+ requirements page, and how to prepare for your first GMP+ audit.

Summary

Most nonconformities found in GMP+ audits do not come from a lack of knowledge or bad intent, but from the natural gap that builds up over time between documentation and everyday practice — in procedures, records, HACCP, traceability, training and supplier management. Awareness of these risk areas, regular internal audits and a rigorous management review all help cut their number before they become a problem at the certification audit. If you want to check how your company handles these areas in practice, book a free consultation with our team.

Glossary

Minor nonconformity

An isolated deviation from a requirement that does not create a direct risk to feed safety.

Major nonconformity

A deviation affecting an entire element of the quality management system, or a real risk to product safety, requiring a faster response.

CAPA

A corrective and preventive action plan — describing the cause of a nonconformity, the remedial action, the person responsible, and the deadline.

Traceability

The ability to reconstruct a batch's full history — from raw material, through production, to the finished product and its recipient.

Management review

A regular leadership meeting assessing the quality management system's effectiveness based on audits, nonconformities, complaints and process control results.

Internal audit

A review of the quality management system by someone from within the organisation, independent of the area being assessed, ahead of the certification audit.