One Audit, Several Standards: Combining cGMP with ISO and HACCP

If your site already holds ISO 9001, ISO 22000 or HACCP certification, most of the management-system work behind a cGMP certificate is already done. Combining cGMP with ISO and HACCP as one coordinated programme rather than running three separate exercises removes duplicated audit effort, duplicated document sets and three separate visits a year.

The saving from combining cGMP with ISO and HACCP is real, but it is not automatic. It depends on which schemes are involved and how your documentation is organised.

At a glance

• What overlaps: document control, management review, corrective action, internal audit, training records.
• What does not: the technical requirements specific to each scheme.
• Where the saving comes from: shared audit time and combined surveillance, not from a shorter assessment of the technical content.
• What to bring: your existing certificates, their scopes and their surveillance dates.
• What to avoid: three parallel document sets describing the same processes.

Where the schemes genuinely overlap

Every management-system standard asks a version of the same structural questions. Who owns this process. Where is it documented. How do you know it is being followed. What happens when it is not. How does management see the result.

Sites that maintain three separate versions of those elements are paying three times for one control. Consolidating them is usually the single largest efficiency available.

Where they do not overlap

The technical content is scheme-specific, and no amount of coordination merges it.

A food-safety scheme such as ISO 22000 asks about hazard analysis, critical control points and verification of those points — as does HACCP. A quality management standard asks about customer requirements and process performance. A cGMP assessment asks about manufacturing controls, contemporaneous records, validated ranges and whether the documented system still describes current operation.

Those are different questions. A combined programme reduces how many times you answer the shared ones, not whether you answer the specific ones.

This is worth being clear about internally before the budget conversation, because the expectation that three schemes will cost roughly what one costs is where disappointment starts. What genuinely shrinks is duplicated effort. What does not shrink is the technical assessment each scheme requires, and no coordination arrangement changes that.

How combining cGMP with ISO and HACCP actually works

Coverage depends on the schemes involved. If one framework covers several of your product lines and your documentation reaches across them, a single certificate can sometimes carry them all. Where categories rely on materially different schemes, IAS scopes and certifies each separately — but the audit visits can still be planned together, which is where most of the practical saving sits.

The mechanics are simple enough: align the surveillance dates, share the opening and closing meetings, and audit the shared management-system elements once rather than three times. Technical areas are then assessed against each applicable scheme in turn.

What Malaysian sites typically combine

Malaysia’s manufacturing base spans halal food ingredients, palm-oil-derived cosmetics, nutraceutical contract manufacturing, medical devices and electronics. The combinations that come up most often reflect that mix.

• A halal food ingredient exporter holding a food-safety certification, adding cGMP for a pharmaceutical-grade customer.
• A cosmetics formulator holding a quality management certificate, adding cGMP because a distributor asked for it.
• A nutraceutical contract manufacturer running several client-specific systems, consolidating them into one.
• A packaging converter supplying pharmaceutical clients, certifying to cGMP alongside an existing quality standard.

In each case the question is the same: which controls already exist under another name, and which are genuinely new?

The document-set question

The most common obstacle is not technical. It is that a site has built a separate manual, a separate CAPA log and a separate audit schedule for each scheme, usually because each was added at a different time by a different person.

Consolidating them takes work, but it is the work that makes everything afterwards cheaper. One register. One CAPA system with one closure standard. One internal audit programme covering every area, with the applicable scheme noted against each. One management review agenda.

That consolidation is also what internal auditors need in order to be useful across schemes. Training people once, to one method, and pointing them at a single system is considerably more efficient than training three groups. The self-paced online cGMP internal auditor training suits sites training several people around shift patterns, and IAS publishes a training schedule for Malaysia for groups that would rather book a scheduled session.

A worked example: three document sets becoming one

The abstract case for integration is easy to accept and hard to act on. Here is what the work actually looks like at a mid-sized Selangor site holding two certificates and adding cGMP.

Starting position

A quality manual written for the first scheme. A separate food-safety manual added two years later by a different consultant. Two corrective action logs, kept in different spreadsheets by different people. Two internal audit schedules that between them miss the warehouse entirely. Training records held in personnel files for one scheme and in a quality folder for the other.

Step one — one register

Every controlled document listed once, with its revision, owner and the schemes it serves noted against it. This exercise alone usually finds duplicates: two procedures describing the same activity, written for different auditors, that have quietly diverged.

Step two — one corrective action system

A single log, one numbering series, one closure standard. The standard is the part worth arguing about: agree what evidence counts as closure and apply it to every finding regardless of which scheme raised it.

Step three — one audit programme

A single schedule covering every area on a cycle, with the applicable schemes noted per area. This is where the warehouse gap gets found, because a combined schedule makes coverage visible in a way two separate ones never do.

Step four — one management review

One meeting, one agenda, covering performance, findings, complaints, changes and objectives across every scheme. Two reviews a year discussing overlapping content is a duplication most sites do not notice they are paying for.

Step five — training records in one place

One file per person, showing what they were trained on, when, and against which revision.

What it costs. Two to three months of part-time work for one person who knows the site, usually alongside a quality manager. It is not glamorous work and it produces no certificate of its own.

What it returns. Less audit time, fewer duplicate documents to maintain, one set of records to keep current, and a system that new staff can learn once rather than three times. Sites that do this before adding a third scheme find the addition straightforward. Sites that add the third scheme first usually end up doing the consolidation anyway, under more pressure.

Quick definitions

• Combined audit: one visit assessing more than one scheme.
• Integrated management system: one document set serving several standards.
• Shared elements: the controls common to most management-system standards.
• Scheme-specific content: the technical requirements unique to one standard.
• Surveillance alignment: matching the periodic visit dates so they can share a trip.
• Certification cycle: initial assessment, certificate, surveillance, recertification.
• Scope: what each certificate actually covers, stated per scheme.
• Internal audit programme: the schedule that covers every area between assessments.

Why Malaysian manufacturers work with IAS

• Several schemes assessed under one coordinated programme, with surveillance dates aligned.
• The certificate for each scheme names its own framework and scope, so nothing is blurred.
• One written quotation covering the combined cycle, issued after scoping.
• Internal auditor training available alongside certification, so one team can audit against every scheme you hold.
• Open to any manufacturer wanting to demonstrate process control, from food ingredients to packaging converters.

One clarification worth making: IAS certifies management systems and delivers training. Product registration and permission to manufacture rest with regulatory authorities, and no certificate changes that.

The certification process page walks through the stages in order, IAS accreditation explains what underpins the certificate, frequently asked questions covers what tends to come up next, and the Malaysian service index lists the other services available here.