GMP+ standard requirements — a complete overview for feed companies

The sections below cover, in turn, every area addressed by the GMP+ requirements — from quality management system documentation, through HACCP analysis and traceability, to contaminant monitoring, supplier management, incident procedures, staff training, and the practical aspects of internal audits and change management.

Quality management system

The starting point is a documented quality management system comprising a quality policy, an organisational structure with clearly assigned responsibilities, and operating procedures describing the company's key processes — from goods-in, through production or trading activity, to the release of the finished product. The system has to be more than written down — it has to be actually applied: the auditor checks both the documentation itself and how well it is reflected in the site's everyday practice.

In practice, quality management system documentation is usually organised in layers. At the top level sits the quality manual — a document describing the company's overall policy, certification scope and process map. Below that are the operating procedures, which describe in detail how specific activities are carried out (e.g. receiving a delivery, washing a means of transport, handling a non-conforming batch). At the lowest level are work instructions and forms — the concrete records that staff fill in during their daily work, and which provide evidence that a procedure is actually applied rather than existing only on paper.

An important, though often underrated, element of the system is the management review — a periodic (usually annual) meeting of company management dedicated to assessing the effectiveness of the quality system: analysing the results of internal and external audits, complaints and incidents, as well as planned changes in the company that could affect feed safety. A documented management review is one of the elements auditors flag as missing relatively often — especially in smaller companies, where responsibility for quality rests with a single person, so the formal review meeting tends to get skipped.

HACCP — hazard analysis and critical control points

GMP+ requires the implementation of a HACCP system tailored to the specifics of feed operations. This means identifying the biological, chemical and physical hazards that could occur at every stage of the process, determining critical control points, setting critical limits, and defining how these limits are monitored and how deviations are handled. The HACCP analysis must be reviewed and updated whenever there is a significant change to the process, product range or suppliers.

The HACCP team should be cross-functional — leaving the analysis to a single person (e.g. the quality manager, without input from production or logistics) often results in overlooking hazards that only become visible from an operational perspective, such as the specifics of a particular production line or how tankers are unloaded. In audit practice, a well-documented HACCP analysis includes not just a list of hazards and control points, but also the reasoning for why a given point was — or was not — treated as critical, which makes it easier for the auditor (and for the company itself) to understand the system's logic at subsequent reviews.

Typical hazards analysed in the feed chain include cross-contamination between batches of different products (particularly relevant where production lines or means of transport are shared), the presence of undesirable substances in raw materials of plant or animal origin, and physical hazards from foreign bodies introduced during the process. For each of these hazards, the HACCP system should point to a specific control mechanism — not a general statement such as "we control quality", but a described step, a responsible person and a way of recording the control result.

Traceability

A company must be able to trace the path of a raw material or product both "backward" (who a given batch of raw material came from) and "forward" (who received the finished product made from that batch). In practice, this requires a batch numbering system, links between goods-in and goods-out documents, and — increasingly — electronic recording of this data, so that if a product recall is ever needed, the affected batches and recipients can be identified quickly.

In practice, the quality of traceability is tested through an exercise called a mock recall — a simulated withdrawal of a specific product batch, in which the company has to establish, within a limited time (typically up to a few hours), where the raw material used to make it came from and which recipients received the finished product. The result of such an exercise — both the time it takes and the completeness of the data established — is one of the harder, more easily measurable pieces of evidence for whether the traceability system actually works in practice, and not only in the theory described in the procedure.

A common source of problems is traceability at the interface between two systems — for example, when a company receives goods into a warehouse system but keeps its batch register in parallel in a spreadsheet that is not automatically linked to the goods-in documents. Discrepancies between these data sources usually only come to light during a traceability test — which is why one element of preparing for the certification audit should be running such a test internally, as a trial, beforehand.

Contaminant monitoring

The standard requires systematic monitoring of undesirable substances in raw materials and finished products — including heavy metals, mycotoxins, dioxins and pesticide residues, depending on the risk profile of the raw material concerned. The company sets the scope and frequency of testing based on a risk analysis, drawing among other things on the guidelines and knowledge databases published by GMP+ International as part of the GMP+ FRA pillar (see the page What is GMP+).

The most commonly monitored groups of contaminants in feed include mycotoxins (produced by mould growth on plant raw materials, particularly cereals), heavy metals, dioxins and polychlorinated biphenyls (PCBs), and pesticide residues. A company does not have to test every one of these parameters in every batch — but it should be able to show that it has consciously assessed which hazards are relevant to the specific raw materials it uses, and has planned a testing schedule — whether in-house or outsourced to an external laboratory — on that basis.

The monitoring plan should be a living document — updated as suppliers or the product range change, or as new risk information emerges (for example, an alert issued through an early-warning system). Auditors look not only at whether testing is carried out, but also at whether the company actually analyses the results and responds to deviations — for instance by stepping up checks on a specific supplier after an elevated level of a substance is detected in its raw material.

Supplier management

GMP+ places heavy emphasis on control of the supply chain — a company must have a documented process for approving suppliers of raw materials and services, covering verification of their quality systems (for example, their own certificates recognised under the GMP+ system) and ongoing evaluation based on the history of the relationship and the test results of the batches supplied.

The process of qualifying a new supplier usually involves several stages: gathering basic information about the supplier and the raw material offered, verifying any certificates or other evidence of compliance the supplier holds, assessing the risk associated with the origin and type of the raw material, and, where warranted, additional testing of the first deliveries before the supplier is added to the standing approved list. The list of approved suppliers should be kept as a living register rather than a one-off document — reviewed regularly, with the option of suspending a supplier in the event of repeated non-conformities.

For suppliers that already hold their own GMP+ certificate or another standard recognised within the system, the scope of the company's own verification can be narrower — the supplier's certificate serves as part of the evidence of compliance. This does not, however, remove the obligation to monitor the relationship entirely, since a supplier's certificate, just like the company's own, can be suspended or withdrawn while the business relationship continues.

Incident and recall management

The standard requires a procedure for responding to a detected non-conformity, hazard, or the need to withdraw a product from the market — including designated responsible persons, a method for notifying recipients, and, where warranted, notification to the GMP+ International early-warning system. Companies usually test this procedure periodically through a simulated exercise (a mock recall).

A well-designed incident management procedure should answer several specific questions: who decides to hold a batch or withdraw a product, how and within what timeframe recipients and suppliers are informed, how the entire process is documented, and when and how a situation is reported to the GMP+ International early-warning system. The lack of a clearly designated decision-maker is one of the more frequent reasons why, in a real situation, a company's response ends up slower than the procedure written "on paper" assumed.

It is worth distinguishing between an incident and a minor non-conformity. Not every deviation requires triggering the full recall procedure — the standard instead expects a documented assessment of the severity of the event (for example, whether the contamination exceeds permitted limits and poses a real risk to animal health or the safety of the food chain) and a proportionate response — ranging from a simple process correction, through holding a batch pending clarification, to a full market withdrawal in the most serious cases.

Staff training

Everyone whose work affects feed safety should receive appropriate training — from the basics of hygiene and HACCP principles to detailed workstation procedures. Training should be documented and refreshed periodically, with its scope tailored to each person's role in the process. Find out more about our training offer on the page GMP+ training.

The scope of training should vary by role — a production line operator mainly needs practical knowledge of the workstation procedures and critical control points on their section of the process, while a driver collecting feed loads needs to know the rules for checking tanker cleanliness and the procedure to follow if an earlier load incompatible with feed is discovered. Training records should include not only an attendance list, but also confirmation that the person actually understood the material — for example in the form of a short knowledge test or a competence assessment carried out by a supervisor once the training is complete.

Records — what actually needs to be kept

Beyond the procedures themselves, the standard requires specific records that demonstrate they are actually applied. In practice, this most often means: a register of goods received and dispatched with batch numbers linked, a register of raw material and finished product test results, a register of cleaning and cleanliness checks for means of transport or production lines shared between different products, a staff training register, a register of complaints and non-conformities together with the corrective actions taken, and a register of internal audits and management reviews. The form these records take — paper, an electronic spreadsheet, or a dedicated IT system — is not prescribed, as long as it ensures the records are legible, complete and can be quickly reconstructed if there is an inspection or an incident.

A common mistake is keeping records "in parallel" in several places without clearly stating which source is authoritative — for example, when data on goods received exists simultaneously in the warehouse system and in a separate notebook kept by the shift supervisor. If such sources diverge, an auditor may question the reliability of the entire traceability system, even where the underlying data is actually consistent.

Internal audit

GMP+ requires a certified company to run its own internal audits of the quality system — independently of the external audits carried out by the certification body. Over an annual cycle, the internal audit should cover all key areas of the system (HACCP, traceability, supplier management, contaminant monitoring), and it should be carried out by someone sufficiently independent of the day-to-day running of the process being audited to be able to assess its compliance objectively — in smaller companies, this is often someone responsible for a different department than the one being audited.

The results of the internal audit should be documented in a report indicating the non-conformities found, their causes, and the corrective actions planned, together with completion deadlines. Systematically run internal audits are one of the most effective tools for reducing the number of non-conformities that only surface during the certification audit — they make it possible to catch and fix deviations before an external auditor ever sees them.

Most common non-conformities during an audit

From audit experience, the most frequently recurring findings concern: an outdated HACCP analysis following a change to the process or product range, gaps in traceability documentation (an incomplete link between the received batch and the dispatched batch), incomplete verification of new suppliers before starting a relationship, and a lack of documented training for newly hired staff. Deliberately addressing these areas before the audit significantly shortens the certification process.

Less frequently mentioned, but still regularly recurring, findings include: inconsistency between the certification scope declared to the certification body and the company's actual scope of activity (for example, carrying out additional operations on site that were not included in the application), a lack of a documented annual management review, and an incomplete risk assessment of new raw materials added to the range after the first certification. This last point matters particularly for trading companies that regularly expand their product range — every new raw material should undergo the same initial risk assessment as the raw materials that have been in the system since the start of implementation.

Change management

The GMP+ system assumes that a company does not only maintain its existing procedures, but also consciously manages changes that could affect feed safety — a new supplier, a new product line, a change in production technology, a move to a different location, or bringing in a subcontractor for part of the process. Every such change should undergo a risk assessment before it is implemented, rather than being analysed only retrospectively once a problem appears. In practice this means a simple but consistently applied rule: before anything changes in the process, someone in the company responsible for quality should look at it and, if needed, update the HACCP analysis, the procedures or the monitoring plan.

A lack of documented change management is particularly visible in companies that are growing quickly or frequently changing their product range — documentation prepared at the first-certification stage stops reflecting operational reality after a year or two if it is not systematically updated alongside changes in the company. An auditor comparing the actual state of the site against the documentation tends to catch such discrepancies fairly easily.

A practical tool for keeping change management in order is a simple change log — a list of recorded decisions (a new supplier, a recipe change, a new warehouse location) together with the date, the person responsible, and a note on whether and how the related documentation was updated. Such a log, even kept in a simple spreadsheet, makes it easy to demonstrate to an auditor that the company manages changes deliberately, rather than introducing them "quietly", without any trace in the quality system.

Documentation and company size

The standard's substantive requirements are the same regardless of company size, but how they are met can differ depending on the scale of the business. A small family company, where the owner personally oversees most processes, can have shorter, more condensed documentation than a large production plant with multiple shifts and an extensive management structure — as long as it substantively covers every required element. The key point is that the documentation should reflect the company's actual structure and processes, rather than being a copy of a template borrowed from a completely different organisation, which is a common temptation when trying to prepare for an audit quickly on your own.

How to prepare

A good starting point is a preliminary audit (gap analysis) comparing the company's current status against the full list of GMP+ requirements relevant to its scope of activity. This makes it possible to set a realistic implementation timeline and avoid a situation where gaps only come to light during the actual certification audit. We describe how the certification process itself unfolds — from applying to a certification body through to the certificate being issued — on the page GMP+ certification process.

It is worth planning the preparation with enough lead time — in advisory practice, a realistic timeline from gap analysis to the certification audit usually takes from a few weeks to a few months, depending on how many elements of the quality system the company already has in place, and on the complexity of its business. A company that already has, for example, a functioning HACCP system implemented for other requirements can focus mainly on filling in the elements specific to GMP+ (full-scope traceability, supplier management, the monitoring plan) rather than building the whole system from scratch. We describe indicative costs of the implementation and certification itself, broken down by component, in detail on the page Certification costs.

Glossary

HACCP

Hazard Analysis and Critical Control Points — a systematic method for analysing hazards and determining critical control points in a production process, forming part of the GMP+ requirements.

Traceability

The ability to trace the path of a raw material or product through the supply chain, both back to the supplier and forward to the recipient.

Approved supplier

A supplier of raw materials or services that has been verified by the company against GMP+ requirements, for example through its own recognised certificate or documentation confirming compliance.

Mock recall

An exercise simulating a product withdrawal from the market, carried out periodically to test the effectiveness of the incident management procedure.

Gap analysis

A preliminary audit comparing the company's current status against the full list of the standard's requirements, usually carried out before the actual implementation begins.

Management review

A periodic, documented meeting of company management assessing the effectiveness of the quality system based on the results of audits, complaints and incidents from the period concerned.

Change management

A documented process for assessing the risk associated with planned changes in the company (e.g. a new supplier, a new product line) before they are implemented, required as part of the GMP+ system.