Eurofins Assurance Audit and Certification Services US, LLC
Policies and Procedures for Good Manufacturing Practices (GMPs) and Management Systems Certification

ASUS QA 39-01-P01
Effective Date: 10/08/2025
Version: 02

I. Introduction

1. About Eurofins Assurance

Eurofins Assurance is a global, leading quality and regulatory compliance expert helping companies identify and mitigate risks and verify quality and compliance along their supply chain by providing a wide range of auditing and certifications to the Food, Consumer Product and Healthcare & Cosmetics industries. Eurofins Assurance’s vast network of experts work with industry, standards developers, and certification programs, worldwide to develop and offer the most current and rigorous certification and auditing services globally, delivered by our local teams. To learn more, visit our global website: https://www.eurofins.com/en/assurance-inspection-services/.

2. About these Policies and Procedures

These policies and procedures apply to all Good Manufacturing Practices (GMP) processes and management systems certification services offered by Eurofins Assurance Audit and Certification Services US, LLC, and together with the General Terms and Conditions for Certification Services represents the certification Agreement. Where a conflict exists between the requirements set by the applicable certification standard,
regulation, or external scheme owner policies and the terms set by this document, the language of the standard, regulation or external scheme owner policies take precedence over these policies.

Contents

I. Introduction 
1. About Eurofins Assurance 
2. About these Policies and Procedures 
II. Definitions 
III. Program Policies
P-1: PROGRAM ELIGIBILITY AND NONDISCRIMINATION 
P-2: CERTIFICATION AGREEMENT 
P-3: PREPAREDNESS 
P-4: ACCESS 
P-5: WITNESSED AUDITS 
P-6: UNANNOUNCED AUDITS 
P-7: HARRASSMENT/INTIMIDATION 
P-8: CERTIFICATION NOTIFICATION 
P-9: CLAIMS OF CERTIFICATION
P-10: USE OF CERTIFICATION MARKS 
P-11: MISUSE OF CERTIFICATION MARKS 
P-12: MODIFICATION, SUSPENSION, WITHDRAWAL, OR TERMINATION OF  CERTIFICATION
P-13: CERTIFICATION DOCUMENTATION 
P-14: CHANGES TO THE CERTIFIED PROCESS OR SYSTEM 
P-15: REVISIONS TO THE CERTIFICATION AGREEMENT 
P-16: NONCOMPLYING PROCESSES AND SYSTEMS 
P-17: GENERAL NONCONFORMANCE TO THE AGREEMENT 
P-18: RECERTIFICATION 
P-19: COMPLAINTS 
P-20: APPEALS 
P-21: RECALLS AND REGULATORY ACTION 
P-22: PUBLICLY AVAILABLE INFORMATION 
P-23: CONFIDENTIALITY 
IV. Certification Procedures 
1: SCOPE OF CERTIFICATION 
2: PREASSESSMENT 
3: CERTIFICATION APPLICATION 
3: AUDIT PLANNING 
4: THE AUDIT
5: AUDIT REPORT 
6: NONCONFORMANCE REPORTING AND RESOLUTION 
7: REPEAT AUDIT NONCONFORMANCES 
8: MONITORING AUDITS 
9: CERTIFICATION DECISION 
10: RECERTIFICATION AUDITS 
V. Annex 1: Eurofins Certification GMP Mark 
About GMP Marks
Color Palette of the Eurofins GMP Certification Mark
Content on the GMP Certification Mark 
Where you can use the GMP Certification Mark

II. Definitions

Company: The legal entity which has entered into the certification agreement and any company responsible to fulfill any terms under this agreement, including subcontracted entities, shall be referred to as the “Company” within this policy.

Certification Program Owner (CPO): Where Eurofins delivers certification services on behalf of a program owner other than Eurofins, these entities are referred to as the CPO. All CPO policies are policies included within the terms of this certification Agreement.

Requirements: The requirements against which the products of a client are evaluated shall be those contained in specified standards and other normative documents. Examples of Requirements include public consensus standards, regulations, CPO addendum, or proprietary Eurofins protocols.

Suspension: Suspension of certification is a withdrawal of certification as a result of nonconformance to any aspect of the certification Agreement. The Company may exit Suspension by resolving the nonconformance to the Agreement.

Withdrawal: Withdrawal of certification is a final status for a certified process whereby the certification is dropped as a result of nonconformance to any aspect of the certification Agreement and Requirements. The Company must reapply for recertification to regain certified status.

Termination: Termination of certification is a withdrawal of certification that includes termination of the certification Agreement.

III. Program Policies

P-1: PROGRAM ELIGIBILITY AND NONDISCRIMINATION

P-1: Program
Processes and services included under the scope of a product certification program offered by Eurofins are eligible for certification, providing the Client complies with the terms of the certification Agreement and its processes or services meet all certification requirements.

Eurofins will not use its procedures to impede or inhibit access by applicants to the certification process, which is not conditional upon the size of the Client or membership of any association or group, nor upon the number of certifications already issued.

Only when fundamental or demonstrated reasons exist, such as the client participating in illegal activities, having a history of repeated non-compliances with certification/product requirements, or similar issues may Eurofins decline to engage with the Client.

Eurofins otherwise confines its requirements, evaluation, review, decision and surveillance to those matters specifically related to the scope of certification.

P-2: CERTIFICATION AGREEMENT

All certification services are rendered under the terms of the Agreement, which shall consist of the Terms and Conditions and Eurofins certification policies and are contingent upon continued compliance with the certification scheme specific Requirements. From time-to-time Eurofins will notify the Company of changes to program documents and implementation of new versions, and the content of these notifications is included under this Agreement.

P-3: PREPAREDNESS

The facility shall be prepared for the audit. Eurofins will contact the facility to arrange a mutually agreeable date for the audit. If at any time during the audit the Eurofins makes the determination that the site is unprepared, the audit may be aborted.

P-4: ACCESS

The Company shall facilitate the necessary access and documentation needed for Eurofins to complete the full scope of the certification evaluation, complaint investigation, or investigations or surveillance being conducted in response to a regulatory action notice or to maintain compliance with the scheme requirements. If the Company fails to provide this access, the GMP process or management system will not be certified, or certification may be withdrawn. Specifically:

Access for audits: Failure to provide access to any part of the location/s, to disclose all locations, including subcontractors, where the manufacturing process are conducted, or failure to provide access to relevant personnel, or equipment, shall result in termination of the audit.

Access to documentation and records: All documentation, records, and product  information relevant to the scope of certification shall be made available to Eurofins upon request. Where copies are provided, they shall be copies of original documents.

Failure to provide all necessary access as required for the certification evaluation to be completed, or to verify compliance to Eurofins or CPO policies, shall result in the process or system not being certified.

P-5: WITNESSED AUDITS

The Company shall cooperate and facilitate witnessed audits for the purpose of training, assessment or calibration purposes. This activity may include the training of new auditors, routine witness audits of auditors, witness audits by accreditation bodies, witness audits by external CPOs, or witness audits by a certification specifier where a specifier
specific audit module is included.

Witness audits by external CPOs, accreditation bodies and for the purposes of calibration and training are an essential requirement for certification compliance and accreditations, and so reasonable cooperation is required.

P-6: UNANNOUNCED AUDITS

Unannounced audits may be conducted as part of general scheme requirements, as part of an investigation into a complaint, or to investigate other potential nonconformance to the certification Agreement.

External CPOs may also conduct audits or site visits in response to complaints or as part of routine compliance activity to ensure the integrity of compliance with the standard. Such visits may be announced or unannounced.

For planned unannounced audits that are required as part of a certification scheme, the Company will be provided with an opportunity to request blackout dates within a provided audit window in advance of the audit.

Access shall be provided for unannounced audits and are required by the certification Agreement regardless of the cause.

P-7: HARRASSMENT/INTIMIDATION

Eurofins has zero tolerance for harassment or intimidation. Harassment, intimidation, or failure to cooperate at any point in the certification process shall result in termination of the certification process.

Eurofins auditors may abort an audit at any time if they feel unsafe, experience harassment, intimidation, or lack of cooperation, making a complete certification evaluation unfeasible. The Company is responsible for the full cost of the terminated audit.

P-8: CERTIFICATION NOTIFICATION

Eurofins shall provide written notification upon awarding certification. The Company shall not make public statements regarding certification, make use of a Eurofins certification Mark, make claims of certification in advance of such notification, or in any way imply that certification is imminent or has been achieved before receipt of written notification by Eurofins.

P-9: CLAIMS OF CERTIFICATION

After notification of certification by Eurofins, the Company shall make claims regarding certification consistent with the scope of certification. The Company shall not claim or imply the certification is inclusive of processes or products that are not certified. Companies with management system certification shall not make claims or allow reference to it’s certification that might imply that the certification pertains to a product or process. The Company shall make no claims regarding its certification that are misleading or unauthorized by the scheme, to the sole discretion of Eurofins.

In all references to its certification in communication media such as documents, brochures or advertising, the Company shall comply with the requirements outlined in these policies, or as specified within the certification scheme or standard, if applicable.

P-10: USE OF CERTIFICATION MARKS

Certification marks shall be used on websites, brochures, marketing documents and advertising only as explicitly authorized by Eurofins or the relevant certification scheme. Process and management system certification Marks shall not be applied to product labeling at any time and shall not be displayed on physical or digital media in close association with advertising related to any product.

P-11: MISUSE OF CERTIFICATION MARKS

Eurofins shall investigate any reports of misuse of its certification Marks, or of unauthorized, incorrect or misleading claims of certification, display or misuse of certification documents.

Marks shall not be modified, cropped, or displayed so as to render them illegible.

P-12: MODIFICATION, SUSPENSION, WITHDRAWAL, OR TERMINATION OF CERTIFICATION

Eurofins may withdraw certification at any time for any reason without prior notice. After voluntary or involuntary modification of the scope, voluntary or involuntary withdrawal, suspension, or termination of certification, the Company shall immediately amend claims of certification to match the amended scope, or cease claims of certification, discontinue use of the certification Mark, modify or discontinue use of all advertising material or references to certification, and any other actions or measures that are required by Eurofins or the applicable certification scheme.

P-13: CERTIFICATION DOCUMENTATION

The Company shall reproduce only in their entirety any certification documentation, and when this documentation is shared externally it shall be complete and accurately represented, or as specified by Eurofins or by the relevant certification scheme. The Company shall permit use of its certification documentation only as specified by the
certification scheme.

P-14: CHANGES TO THE CERTIFIED PROCESS OR SYSTEM

The Company shall notify Eurofins prior to implementing changes to any certified process or management system relevant to the certification scope. Eurofins will review the changes and determine if further evaluation is required to maintain the certification and will conduct such evaluation as applicable prior to implementation of the changes by the
Company.

Some changes may require a monitoring audit prior to certification, at Eurofins determination. Changes to the scope of certification may change the duration of the annual certification or surveillance audits.

Unauthorized changes to certified process relevant to the scope of certification invalidate the certification and such processes and systems are not certified.

Eurofins shall re-evaluate certified organizations to assess compliance with the Certification Program normative documents in the event of:

• Significant changes which could affect the safety of product;
• Changes to the normative documents of the Certification Program;
• Changes of ownership or management of the certified organizations;

or if the Eurofins has reason to believe there could be compliance issues in relation to certification.

P-15: REVISIONS TO THE CERTIFICATION AGREEMENT

The certification Agreement documents, including policies and procedures, are revised from time to time. Eurofins shall notify the Company prior to implementation of revised and updated versions of program documents. Where appropriate, Eurofins will make every effort to provide an implementation period adequate in length to ensure the
Company is reasonably able to execute such changes within the implementation period.
The Company shall implement any changes required to maintain compliance to the certification Agreement within the implementation period.

P-16: NONCOMPLYING PROCESSES AND SYSTEMS

The certified process or system is required to comply with the certification Agreement at all times. If the process or system does not comply with the certification requirements, then it is not certified. The Company shall ensure the process or system is compliant with the Requirements and notify Eurofins promptly should it become aware the process or system no longer complies and cease marketing the process or system as certified.

P-17: GENERAL NONCONFORMANCE TO THE AGREEMENT

Eurofins shall notify the Company of nonconformance to any requirement and upon notification of the nonconformance, the Company shall investigate, and provide written response to Eurofins with the results of its investigation and its corrective and preventive actions within a maximum of 30 calendar days. Requests for an extension to this timeframe shall be submitted to Eurofins in writing.

Eurofins shall review the response to determine if the actions adequately resolve the nonconformance.

P-18: RECERTIFICATION

Eurofins reserves the right to require written corrective and preventive action plans (CAPAs) for any prior, unresolved nonconformances previously observed, prior to any recertification activities.

P-19: COMPLAINTS

Both the Company and Eurofins shall keep records of complaints.

The Company shall:

• keep record of all complaints made known to it relating to compliance with certification requirements,
• take appropriate action with respect to such complaints and any deficiencies found that affect compliance with the requirements for certification,
• document the actions taken,
• inform Eurofins promptly if an issue is discovered that affects the ability of the Company to conform with the certification scheme Requirements,
• make records of these investigations available to Eurofins upon request.

Eurofins shall:

• investigate as complaints all reports of deficiencies of certified processes or systems related to the scope of certification, reports of misuse of certification Marks, certification documents and claims of certification.
• acknowledge receipt of all complaints received regarding certified processes,
• keep all information obtained through this process as confidential,
• determine whether the complaint pertains to the scope of the certification Agreement,
• investigate the compliant to the extent feasible,
• take appropriate remedial action as is feasible up to and including withdrawal of certification or publicnotice,
• notify the complainant with the result of the investigation.

The Company shall cooperate with complaint investigations upon notification by Eurofins with a request for information. Failure to cooperate with a complaint investigation may result in Withdrawal or Termination of certification.

P-20: APPEALS

The Company has the right to Appeal any final decision made by Eurofins regarding its certification evaluation. The Company shall follow applicable dispute resolution procedures by notifying Eurofins in writing of the specific dispute and supporting evidence. If the dispute procedure does not resolve the matter to the Company’s satisfaction, it’s Appeal shall be submitted in writing to Eurofins.

Appeals shall be reviewed and adjudicated by an individual not involved in the original decision making process. A written response to the request for Appeal shall be provided to the Company within 30 calendar days of receipt.

Where a program is an accredited program, the Company has the right to dispute Eurofins’ final Appeal decision with the accreditation body.

P-21: RECALLS AND REGULATORY ACTION

The Company shall notify Eurofins within 24 hours in the event of a product safety incident (recall/withdrawal), any adverse publicity, or Government intervention such 483’s and FDA Warning Letters or any other regulatory action in writing to recalls@cpt.eurofinsus.com.

The Company shall make any records, including all communications between the Company and the regulator, available to Eurofins upon request.

Eurofins will review each action on a case-by-case basis. Depending on the severity of the issue and the adequacy of the Company’s response the duration or frequency of the Company’s audits may be increased, or certification may be suspended or withdrawn.

All recalls, 483s, or Warning Letters will be reviewed as part of the next audit. If analysis of the event or if any other information indicates that the certified organization no longer conforms with the certification Agreement or Requirements, Eurofins reserves the right to Suspend or Withdraw certification.

P-22: PUBLICLY AVAILABLE INFORMATION

Eurofins shall maintain and provide for a public directory or make available upon request specific information related to the certification. Publicly available information made accessible via the Eurofins or scheme owner website is as required by the certification scheme but include as applicable:

• Customer/retailer name,
• Supplier name,
• State/province and country,
• Certificate type and number,
• Certification expiry date,
• Company representative name and contact details,
• Certification scope: (e.g. product types and technologies, Level Food Sector Category(s), etc.)
• Modules implemented,
• Audit rating,
• Name of Certification Body,
• Auditor name,
• Audit frequency,
• Date of last Audit and date of next Audit

All other information related to the certification and the Company shall be held as confidential as described per the Agreement.

P-23: CONFIDENTIALITY

Ownership of the audit report, determination of details made available to outside parties, and authorization for access belongs with the Client. Eurofins will hold all Client information as confidential, except for as otherwise described in this Agreement, including release of publicly available certification details as described in these policies, or as applicable, to external CPOs, and to GFSI in the case of all GFSI benchmarked programs.

IV. Certification Procedures

1: SCOPE OF CERTIFICATION

The Company must indicate the requested scope of certification on the certification application. The Company shall provide all information sufficient for Eurofins to determine the scope and duration of the audit, which includes, but is not limited to:

Facility address for each location to be included in the scope of the certification,
The applicable certification standards to which certification is sought,
Types of products and manufacturing processes active at each site, and
Requests for eligible exclusions from certification.

The Company shall promptly notify Eurofins in writing of any changes to the requested scope of certification.

2: PREASSESSMENT

The Company is responsible to conduct a self assessment prior to initiation of certification assessments to ensure it is prepared and ready for a certification audit.

At the Company’s option, Eurofins can perform a preassessment audit on behalf of the client, however this will involve no CAPA resolution process. Pre assessment audits cannot be converted in to certification assessments, do not meet most retailer requirements, and are for Company information only.

3: CERTIFICATION APPLICATION

In addition to the scope, Eurofins shall collect all additional documentation as required to conduct the certification process in accordance with the relevant certification scheme.
This information shall include, as required by the certification scheme or standard, information such as prior audit reports and certificates, FDA Warning letters or 483s.

All documentation shall be reviewed by Eurofins to ensure that:

• the information about the client and the processes or system is sufficient for the conduct of the certification process,
• known differences in understanding between the certification body and the Company is resolved, including agreement regarding certification standards or other normative documents,
• The certification scope is agreed, defined, and understood,
• The audit duration is appropriate per the certification scheme requirements and current state of compliance at the facility,
  Eurofins has the necessary resources and competencies to perform the requested certification activity, and
• If a prior evaluation or certification is used to meet any part of the certification Requirements, Eurofins will accept this only to the extend it meets scheme Requirements, make record of this, and document the justification of omission of any certification activities. Eurofins reserves the right to reject all prior evaluations where the evaluation does not meet the relevant ISO conformity assessment standard or the requirements of the applicable certification scheme. Eurofins reserves the right to perform additional evaluation as necessary for Eurofins to document conformity to any or all certification Requirements.

3: AUDIT PLANNING

Eurofins scheduling will typically contact the Company within two business days of receipt of an executed Agreement to arrange a mutually agreeable audit date.

Prior to the audit, the Company shall ensure that a minimum of three commercial batches for all processes included in the requested scope have been produced.

The Company is responsible to ensure that each process or a technically representative process as included within the requested scope of certification will be in production at the time of audit. Failure to ensure this will result in an incomplete audit unless the inactive processes are eligible for exclusion based on the scheme. If certification will not be
awarded the audit is incomplete. A follow up audit for scope completion will be required before certification will be achieved.

The Company is responsible for all costs related to changes to audit duration and for scope completions.

The Eurofins auditor will provide the Company with an audit plan and agenda prior to the audit date. The Company should review the planned scope, including any planned exclusions, and acknowledge acceptance, to ensure alignment prior to the assessment.

4: THE AUDIT

The audit will initiate with an opening meeting. During the opening meeting, the auditor will review with the Company audit team the following:

• The scope of the audit and any exclusions
• The names and titles of the Company audit team who will be facilitating the audit
• General information on the audit schedule
• The general procedures to dispute and Appeal a finding

A thorough tour of the facility is conducted, followed by assessment of the quality management system and the individual requirements of the applicable certification standard, regulation, or scheme.

A closing meeting will be conducted prior to the conclusion of the audit. All nonconformances will be conveyed at this time. Severity (minor, major, critical) of individual nonconformances is not provided at this time, as this is not considered final until after the report has undergone technical review. Official classifications will be provided in the final audit report.

A draft summary nonconformance report will be provided.

5: AUDIT REPORT

All audit findings are subject to technical review prior to issuance of the final report. A final audit report will typically be provided within 10 business days of the completion of the audit.

Where the scheme is graded, the grade is based on the criteria defined in the applicable certification Requirements.

6: NONCONFORMANCE REPORTING AND RESOLUTION

The Company shall provide CAPA plans for all non-conformances within 10 business days or within the timeframe specified by the external scheme.

Unless otherwise specified in the Requirements, objective evidence of implementation (e.g. procedural updates, purchase orders, training records, etc.) is required for Major or Critical nonconformities.

7: REPEAT AUDIT NONCONFORMANCES

Repeat nonconformances of findings from prior certification audits require objective evidence of resolution prior to approval of the CAPA. Failure to implement effective corrective and preventive action for a nonconformance may result in elevation of the nonconformance in severity, application of a monitoring audit within 6 months of the audit date, or other action up to facility Suspension or Withdrawal of certification.

8: MONITORING AUDITS

Monitoring audits are required based on the determination of Eurofins, but are required in all cases where the certification audit is a grade C. At initial certification, if required, this audit must be conducted prior to certification and can occur after all nonconformances are closed, including objective evidence having been provided for any Major or
Critical nonconformities.

Where a certified location has a grade C, the monitoring audit is scheduled 5-7 months from the prior certification audit date.

Monitoring audits may also conducted due to multiple repeat nonconformances, regulatory actions such as 483s and Warning Letters, complaint investigations, or similar.

The Company is responsible for all costs associated with monitoring audits, regardless of cause.

9: CERTIFICATION DECISION

Upon completion of all certification requirements, a Eurofins certification manager will conduct a review of the certification documentation. If the requirements are met, Eurofins will issue a Certificate of Conformity for the applicable scope of certification.

10: RECERTIFICATION AUDITS

Certification is an ongoing process that is maintained by periodic re-evaluation. Recertification is required annually or at the frequency defined by the applicable scheme. Eurofins will contact the Company to schedule recertification about 90 days prior to the certificate expiration to facilitate continuity of the certification. This cycle will continue until the Company ends their participation in the program or terminates their contract.

V. Annex 1: Eurofins Certification GMP Mark

About GMP Marks:

The standard Mark is in full color on white background. Mono black and mono white versions are also available. When designing, the certification Mark should not be smaller than 50 dpi for digital materials, and 14mm or 0.5 inch (height of the GMP Mark) on printed materials.

Color Palette of the Eurofins GMP Certification Mark:

Content on the GMP Certification Mark:

Upon achievement of GMP process certification with Eurofins, customers will be provided the relevant GMP Certification Mark which contains the scope of technical requirements to which the Company’s processes have been successfully certified as compliant.

Where you can use the GMP Certification Mark:

The GMP Certification Mark can be used on marketing materials referring to your facility or business, which includes websites, company brochures or flyers, presentation files, name cards, email signatures as well as physical installations such as company vehicles, banners and posters, to demonstrate the achievement. For website marketing of GMP
certification, it is typically acceptable to place the GMP Mark on a separate page for information related to company quality assurance, for example.

The GMP Certification Mark may not be printed or applied to bulk or finished product labels, packaging, product promotional materials, or placed next to product information on websites.

Any placement of a GMP Certification Mark that can could cause a reasonable person to infer that the product itself is Eurofins certified, to Eurofins sole determination, is not permitted. When in doubt please inquire with your Eurofins representative to vet marketing and communication material prior to use.

For more information about the Certification Entity, please contact:

Eurofins Assurance Audit and Certification Services US, LLC
2120 Rittenhouse St. Des Moines, IA 50321, USA
Phone: +1 800 398-1510
Email: auditing@cpt.eurofinsus.com