The GMP+ certification process — from decision to certificate, and maintaining it in the years that follow

Below we walk through, in order, every stage of the road to a GMP+ certificate — from the first assessment of the company's status, through choosing a certification body and implementing the requirements, to the certification audit itself, resolving any nonconformities, and maintaining the certificate in the following years. We describe each step from an advisory practice perspective, pointing out what auditors really focus on and where delays most often occur.

Step 1: Assessing the current status (gap analysis)

Before a company embarks on actual implementation, it's worth carrying out an initial audit comparing its current status against the full list of GMP+ requirements relevant to its scope of activity. The gap analysis can be carried out by an internal quality team or an external adviser — what matters is that the assessment is honest and specific: not "we have that in place", but a precise statement of which elements of the system already exist and work, and which still need to be built or documented.

The output of the gap analysis should be a list of concrete tasks with an assigned owner and an approximate deadline — not a general descriptive report, but a practical action plan on which a realistic timeline for the whole implementation, and an approximate date for applying to the certification body, can be based.

A well-conducted gap analysis covers not just a review of existing documents but also conversations with the staff responsible for individual processes, and observation of how the company actually works day to day. It often turns out that some requirements are already met informally — for example, a warehouse worker runs their own sensible batch-marking system — but it isn't documented in a way an auditor could verify. In such cases, the task isn't to build a process from scratch, but to describe and formalise what is already working.

Step 2: Choosing a certification body

Not every auditing firm is authorised to issue GMP+ certificates — it must hold GMP+ International accreditation covering the specific scope of activity (e.g. production, trade, transport). When choosing a body, it's worth checking whether its accreditation actually covers the company's business profile, what experience it has in the relevant feed sector, and how audit-date availability looks — during periods of heightened interest in certification (e.g. ahead of a seasonal peak in customer orders) dates can be far off, which is worth factoring into the schedule at an early stage of planning the whole implementation.

The register of certification bodies accredited under the GMP+ system is published by GMP+ International, allowing anyone to independently verify the status and scope of accreditation of a given auditing firm before signing an agreement with it.

Beyond accreditation itself, it's worth comparing several bodies in terms of working style — some run a more formal audit, sticking closely to a checklist, while others place more weight on conversation and understanding the context of the company's activity. Neither style is inherently "better" — what matters is that it suits the character and organisational culture of the certified company, since the relationship with the certification body lasts through the entire three-year cycle, not just one audit.

Step 3: Implementing the requirements and preparing documentation

This is usually the longest stage of the whole process — it covers drafting or completing the quality manual, operational procedures, the HACCP analysis, the contaminant monitoring plan, supplier management procedures, and procedures for handling nonconformities and recalls. In parallel with the documentation, the company should implement the practices it describes — training staff, launching new records, testing traceability procedures — so that by the time of the certification audit the system is actually functioning, not existing purely on paper prepared for the inspection.

Good practice is to run an internal mock audit toward the end of this stage — simulating the course of the actual certification audit — which helps catch and fix obvious gaps before an external auditor sees them. We describe the detailed scope of documentation requirements on the page GMP+ standard requirements.

At this stage it's crucial to involve people from different departments of the company, not just the quality officer. Procedures drafted in isolation from the real work of production, the warehouse or transport usually need revising the moment they meet day-to-day practice — it's more efficient to involve area managers from the start in describing how they actually work than to rewrite finished documentation later that doesn't match reality.

Step 4: Applying to the certification body

Once implementation is complete, the company formally applies to the chosen certification body, specifying the scope of certification — the locations, processes and types of activity to be covered by the audit. At this stage, audit dates are also agreed, along with the range of documents the company should prepare and make available to the auditor before the visit.

The typical set of documents provided to the certification body ahead of the audit includes: the quality manual, key operational procedures, the HACCP analysis, the contaminant monitoring plan, the list of approved suppliers, plus basic formal company data — registration in the relevant business register, contact details for all locations covered by the certification scope, and information on any other certificates already held. The certification body usually provides its own checklist of documents required before the audit, which makes it easier to assemble everything ahead of the set deadline.

Step 5: Certification audit — documentation stage

The first stage of the certification audit (often carried out remotely, based on the submitted documentation) checks whether the system is complete "on paper" — whether all required procedures, the HACCP analysis and the monitoring plan have been drafted and correspond to the declared certification scope. Any gaps found at this stage are addressed by the company before moving on to the on-site visit, which avoids a situation where the auditor travels to the site already knowing the documentation is incomplete.

The documentation stage tends to be underestimated by companies going through certification for the first time — treated as a formality before the "real" on-site audit. In practice, this is exactly where most structural gaps are caught: missing procedures, inconsistencies between the certification scope and the actual description of the business, or an incomplete HACCP analysis. Taking this stage seriously genuinely shortens the time needed for the whole certification, because it avoids postponing the site visit due to gaps that could have been caught earlier, without involving the auditor in a trip to the site.

Step 6: Certification audit — the on-site visit

The second stage is the auditor's visit to the site, during which actual application of the implemented procedures in practice is verified. The auditor usually starts with an opening meeting, at which the scope and plan of the visit are discussed, then moves on to reviewing individual areas of the business — receipt of raw materials, the production process or warehousing, transport conditions, HACCP documentation and traceability — talking to the staff responsible for each process and checking records from recent months of operation. A typical element of the visit is also a traceability test (mock recall) checking how quickly and completely the company can reconstruct the history of a selected product batch. The audit ends with a closing meeting, at which the auditor presents preliminary findings, including any nonconformities.

It's worth being prepared for the auditor to talk not only to management but also to frontline staff — a line operator, warehouse worker or driver — asking them about specific actions rather than the content of a procedure. A gap between what the documentation says and what an employee actually does at their workstation is one of the fastest ways an auditor checks whether a system is genuinely implemented or mainly exists on paper. That's why preparing for the audit should include not just documents, but also a brief refresher for staff on the key rules and procedures relevant to their role.

Step 7: Classifying and resolving nonconformities

If the auditor identifies nonconformities, they are usually classified by severity — minor nonconformities (small deviations from a procedure that don't directly affect feed safety) and major nonconformities (more serious systemic gaps, e.g. no risk analysis for a significant hazard). For each nonconformity the company prepares a corrective action plan (CAPA) — identifying the root cause of the problem, the planned corrective action, and its deadline. The certification body verifies the implementation of this plan, and for major nonconformities it usually requires additional proof that the correction has been implemented (e.g. photos, updated documentation, or — in more serious cases — an additional short verification visit) before the certificate is issued.

The mere fact of a nonconformity being found during the certification audit is nothing unusual or a cause for concern — most companies going through certification for the first time receive at least one finding. Far more important than avoiding all nonconformities is closing them efficiently and with proper documentation: a clear statement of the cause, a concrete corrective action, and proof that it has actually been implemented, not just planned.

Step 8: Issuing the certificate

Once all nonconformities have been closed satisfactorily and formal verification by the certification body is complete, the GMP+ certificate is issued, usually valid for three years, covering a precisely defined scope of the company's activity. Information about the certificate is entered into the public GMP+ International register, where it can be verified by current and prospective business partners.

It's worth carefully checking, when receiving the certificate, that the scope of activity recorded in it matches reality — the name and address of the location, the type of activity, and any exclusions. Discrepancies between the certificate's content and the company's actual profile are best clarified right away with the certification body, before the document enters the register and starts being presented to business partners — corrections at a later stage tend to be more time-consuming.

Step 9: Surveillance audits and recertification

Certification doesn't end with the issuing of the document — during the three-year cycle, the certification body carries out annual surveillance audits, checking that the system continues to be maintained in line with the requirements. Before the three years are up, the company goes through a full recertification audit, similar in scope to the original certification audit. We describe practices that help maintain compliance between audits — regular internal audits, management review, ongoing updates to documentation — in more detail on the page GMP+ standard requirements.

Surveillance audits tend to be shorter than the original certification audit, but no less important — it's precisely during them that the effects of a system "loosening up" after first certification most often show up, once the pressure of getting certified has eased and ongoing documentation starts being kept less carefully. Keeping up the regularity of internal audits and management reviews in the period between external audits is the most effective way to avoid an unpleasant surprise during the certification body's next visit.

First certification versus extending an existing one

It's worth distinguishing two situations that, in advisory practice, look quite different. The first is the first certification of a company that previously had no formal feed quality system — this usually requires the most time and work, since the entire documentation structure has to be built from scratch. The second is extending an already-held certificate to a new scope — for example, a company certified so far only for trade launches its own production and wants to bring it under certification too. In this second case, a significant part of the quality management system (quality policy, organisational structure, some general procedures) already exists and only needs supplementing with elements specific to the new scope of activity, which usually shortens the whole process considerably compared with certifying from zero.

What really affects how long the process takes

The time needed for certification depends above all on the company's starting point. A business that already has HACCP implemented and basic quality documentation in place (e.g. for another standard or for legal requirements) can focus mainly on completing the elements specific to GMP+ — full-scope traceability, the contaminant monitoring plan and supplier management procedures — which shortens the whole process. A company building its quality system from scratch needs more time for implementation itself before it's even ready to apply to a certification body. A second important factor is date availability at the chosen certification body, and a third is how engaged the team within the company is: a project run purely "alongside" other duties usually takes considerably longer than one given clearly allocated time and responsibility.

Companies starting certification with a specific commercial deadline in mind — e.g. an upcoming agreement with a customer that requires certification — should build in a time buffer for unforeseen delays (a distant audit date at the chosen body, extra time needed to close nonconformities). Starting the certification process only once the certificate has already become a formal condition of a specific transaction significantly narrows the safety margin and increases time pressure on the whole team.

It's also worth remembering that certification isn't just time spent working on documentation, but also the time needed for new procedures to "settle" into the company's everyday practice — staff need several weeks of regularly using a new record or procedure before it becomes a natural part of the job rather than an extra duty that's easy to forget. Building such a "bedding-in" period into the schedule before the certification audit usually makes for a calmer course of the auditor's actual visit.

Cost of the certification process

The total cost of GMP+ certification is made up of several elements: fees charged by the certification body (for the audit itself and the annual fee for participating in the GMP+ International system), any costs of advisory support in preparing documentation, laboratory testing costs required under the monitoring plan, and sometimes also organisational or technical investments needed to meet the requirements (e.g. improvements to line-washing procedures). We describe the approximate cost ranges for individual elements, and the factors that most affect the final amount, in detail on the page Certification costs.

The adviser's role in the certification process

An external adviser doesn't replace the certification body — they cannot issue a certificate themselves, nor act as auditor for the same company they're advising (that's a conflict of interest that reputable certification bodies and advisers alike deliberately avoid). The adviser's role instead is to prepare the company for the audit: carrying out the gap analysis, helping draft documentation matched to the real scale and specifics of the business, training the team, and — often the most valuable element — running a mock audit that allows the company to be seen through an external auditor's eyes before the certification body does so.

A good adviser tailors the scope of support to the company's actual needs — from running the whole implementation project, through support in specific, harder areas (e.g. the HACCP analysis or the monitoring plan), to a one-off review of finished documentation before it's submitted to the certification body. The scope of cooperation is worth settling at the outset, along with a clear division of responsibility — the documentation and substantive decisions about how the company operates always remain with the company itself; the adviser supplies knowledge and structure but doesn't take on responsibility for the actual functioning of the quality system.

Most common causes of delay

From advisory experience, delays in the certification process most often arise not from substantive difficulties but from organisational ones: no clearly designated person responsible for the project within the company, too narrow a group of people involved in preparing the documentation (without input from production or logistics), and also putting off the application to the certification body "until everything is perfect" — which in practice means no hard deadline and a project that stretches on indefinitely. Setting an approximate audit date early on, even if it later shifts slightly, usually disciplines the whole process far more effectively than an open-ended schedule with no target date.

A second common cause of delay is underestimating the time needed for suppliers and external partners to respond — for example, when a company is waiting on documentation confirming a key supplier's certification, or on laboratory test results commissioned for the monitoring plan. It's worth building a realistic waiting time for this kind of material into the schedule, rather than assuming it will be available "right away" the moment the company needs it to finalise the documentation.

Glossary

Gap analysis

An initial audit comparing the company's current status against the full list of GMP+ requirements, carried out before actual implementation begins.

Certification audit

The formal audit carried out by an accredited certification body, whose positive outcome is a condition for issuing a GMP+ certificate.

Minor / major nonconformity

Classification of deviations found during an audit by severity — from small procedural shortcomings to serious systemic gaps affecting feed safety.

Corrective action plan (CAPA)

A document describing the root cause of an identified nonconformity, the planned corrective action and its deadline, verified by the certification body.

Certification body

An independent auditing firm accredited by GMP+ International, authorised to carry out audits and issue GMP+ certificates within a defined scope.

Surveillance audit

An annual audit carried out during the three-year certification cycle, verifying that the company continues to meet the standard's requirements.

Recertification audit

A full audit carried out before the three-year certification cycle expires, a condition for renewing the certificate for a further period.

Mock recall

An exercise simulating a product withdrawal from the market, carried out among other things during the certification audit as a test of the traceability system's effectiveness.

Certification scope

The precise definition of the locations, processes and types of activity covered by a given GMP+ certificate, set when applying to the certification body.