What Delays a cGMP Certification — and How to Avoid It

Most cGMP certification delays are not caused by failing an audit. They are caused by scope changing mid-process, documentation that describes a different plant from the one the auditor walks into, and corrective actions that get raised quickly and closed slowly.

  • Realistic stage-by-stage plan agreed up front
  • Written quotation before any work begins
  • A named contact through the whole cycle
  • Certification under IAS’s UQAS accreditation

None of the three is difficult to avoid. All three are easier to avoid before the application than after it.

Want a realistic timeline for your site? Send IAS your product categories, site count and current documentation position and you will get a stage-by-stage plan with the quotation — talk to IAS Australia.

What Delays a cGMP Certification — and How to Avoid It
Most delays are settled before the auditor arrives, not during the audit itself.

At a glance

  • The five common cGMP certification delays: unsettled scope, stale documentation, records completed after the fact, slow corrective action, and untrained staff who cannot explain their own work.
  • Where time is really lost: between the audit and the certification decision, not during the audit.
  • The cheapest fix: a two-hour self-check before you apply.
  • What has no effect: perfect documentation. Demonstrable practice matters more.
  • What shortens everything: having people inside the business who already audit it.

Delay one: scope that keeps moving

Scope is agreed at application. When it changes afterwards — a product family added, a second site remembered, a contract-packed line discovered — the audit plan changes with it, and so does the quotation.

The fix costs nothing. Before applying, list every product family, every activity and every physical location, including the ones you are not sure count. Send the whole list. It is far quicker to remove something from a draft scope than to add it after an audit has been planned around a narrower one.

Delay two: documentation that describes a different plant

The most common finding in a first audit is not a missing procedure. It is a procedure that exists, is approved, and no longer matches what people actually do.

What the auditor checksWhat causes the delayThe pre-audit fix
Procedure version at the workstationThe floor copy is two revisions behindWalk the line and compare against the register
Training records against revision datesPeople trained on the old versionCheck the last three revisions were retrained
Batch or production recordsCompleted at shift end from memoryWatch one being filled in real time
Equipment status at time of useCalibration current, but not linked to batchesTrace one batch back to its equipment records
Change recordsThe change happened; the assessment did notList every change in the last six months

An hour spent on that table before you apply prevents more cGMP certification delay than any amount of document tidying.

Delay three: corrective actions that stall

Findings are normal. A first assessment that raises nothing is unusual, and it is not the finding that costs time — it is the gap between raising it and closing it with evidence.

Two things slow closure. The first is a corrective action written as an intention (“staff will be reminded”) rather than a change (“the line clearance form now requires a second signature, effective from the date below”). The second is evidence gathered too early: an action implemented on Monday and evidenced on Tuesday has not yet been shown to work.

Sites that close findings quickly tend to have decided in advance who owns the response and who verifies it. Sites that stall usually have not.

Already been audited and stuck on corrective actions? IAS can review your responses before you resubmit them — contact the team.

Delay four: nobody can explain their own work

Auditors interview the people doing the job. Not to catch anyone out, but because what an operator says reveals whether the system was communicated or merely issued.

An operator who can explain why a step exists demonstrates a functioning quality system more convincingly than any document. One who says “because that’s the form” leaves the auditor with a question to pursue, and pursuing questions takes audit time.

This is the delay that training removes, which is why GMP internal auditor training in Australia tends to be bought before a first assessment rather than after it. Dates for open sessions are published on the IAS Australia training schedule. Background on what a GMP programme involves is set out in the IAS piece on navigating pharma quality with GMP certification.

What does not actually cause cGMP certification delays

Two beliefs are behind a good share of Australian cGMP certification delays.

“Documentation must be perfect before we apply”

It does not. Gaps found during documentation review are carried into the audit plan and addressed through corrective action. Waiting to present a polished but untested system usually takes longer than applying with an honest picture of where you are.

“A small site takes less time by definition”

Size matters less than readiness. A well-run twelve-person operation with contemporaneous records moves faster than a two-hundred-person plant whose procedures were last reviewed three years ago.

GMP audit preparation: a two-hour self-check before you apply

  • Pull three recent production records at random and trace each to raw materials, equipment status and personnel sign-off.
  • Compare the procedure version at two workstations against the master register.
  • Check training records for the last two procedure revisions.
  • List every change made in the last six months and find the assessment for each.
  • Ask two operators why one step in their job exists.
  • Write down every product family, activity and site you might want covered.

Anything that fails those six checks is a finding you would rather raise yourself than have raised for you.

Reviewing quality records during GMP audit preparation
A two-hour self-check finds the gaps an assessor would otherwise find for you.

Delay five: evidence that exists but cannot be found

The fifth delay is the quietest, because nothing is actually wrong. The record exists, the control worked, the process was followed — and nobody can produce the document inside the audit.

An auditor asks for the calibration certificate for the balance used on a particular batch. It is in a folder, in an office, in a filing system that made sense to someone who has since left. Twenty minutes pass. The auditor moves on and returns to it later, which means the same ground is covered twice.

Multiply that by six requests across a day and you have lost an afternoon of audit time you are paying for, plus an impression of disorganisation that colours everything else.

The retrieval test

The fix is a retrieval test rather than a filing project. Pick five things at random and time how long each takes to produce. Choose a training record, a calibration certificate and a deviation from eight months ago. Add a supplier approval and a batch record from the far end of your retention period. Anything over five minutes needs attention before an audit, not after one.

What a realistic timeline actually looks like

There is no standard number of weeks, and any provider offering one before seeing your scope is guessing. What is predictable is the shape.

StageWhat happensWhat controls its length
Application and scopingScheme, products and sites are settled in writingHow completely you listed everything first time
Documentation reviewA desk review of your quality documentationWhether documents match current practice
Readiness stageConfirmation the system is developed enough to proceedThe gap found at documentation review
On-site assessmentThe audit itself, scaled to scopeNumber of sites, product families, scheme complexity
Corrective actionFindings closed with evidenceHow the actions are written, and who owns them
Certification decisionIndependent technical review of the evidenceCompleteness of the corrective action pack

Which stages you actually control

Two of those six rows are inside your control before you ever apply: how completely you scope, and whether your documents match practice. A third — how corrective actions are written — is inside your control during the process. Sites that treat those three deliberately tend to move through the cycle at roughly the pace the plan predicted. Sites that leave them to chance are the ones asking, three months in, why it is taking so long.

The honest summary is that the assessment itself is rarely the slow part. Scoping done casually at the start, and corrective actions written loosely at the end, account for most cGMP certification delays in a first cycle.

Quick definitions

  • Application and scoping: the stage where scheme, products and sites are settled.
  • Documentation review: the desk stage that precedes the site visit.
  • Finding: a documented gap between a requirement and the evidence.
  • Corrective action: the change made so the gap does not recur.
  • Effectiveness verification: confirming the change worked, using records made afterwards.
  • Certification decision: the independent technical review before a certificate is issued.
  • Scope extension: the reassessment that brings something new under an existing certificate.
  • Contemporaneous record: entered while the task was under way, not caught up on later.

Why Australian manufacturers work with IAS

  • A stage-by-stage plan issued with the quotation, so the timeline is visible from the start.
  • Scope settled in writing before the audit is planned, which removes the commonest cause of cGMP certification delays.
  • One fixed written quotation, with no open-ended billing if the process runs long.
  • Certification and internal auditor training from one organisation, so the audit method your team learns matches the criteria they are assessed against.
  • Open to every manufacturing sector, not only pharmaceutical and food producers.

One boundary, stated without decoration: IAS assesses and certifies management systems, and it trains people. Operating permission and market authorisation sit entirely with regulatory authorities.

Routine queries are answered in the frequently asked questions, what stands behind an IAS certificate is set out under IAS accreditation, and the wider service is described on the ISO certification in Australia index.

Frequently Asked Questions

How long does GMP certification take?

There is no fixed number of weeks, because readiness, scope breadth, site count and scheme complexity all move it. What IAS commits to is a stage-by-stage plan issued with the quotation, so you can see where the time goes rather than waiting to find out.

Will findings during the audit delay our certificate?

Findings themselves rarely cause the delay. What causes it is the closure — a corrective action written as an intention rather than a change, or evidence gathered before the change has had time to work.

Should we wait until our documentation is complete before applying?

Usually not. Gaps identified during documentation review are carried into the audit plan and addressed through corrective action. Applicants who wait for perfection generally take longer overall than those who apply with an honest picture.

Does a smaller site certify faster?

Not automatically. Readiness matters more than headcount. A small, well-run operation with contemporaneous records moves faster than a large plant whose procedures no longer match practice.

What is the single most common first-audit finding?

A procedure that exists and is approved but no longer describes what people do — usually because a change was made and never traced through to the document, the training and the records.

Can we shorten the process by training our staff first?

It helps considerably. Interviews go faster when operators can explain why a step exists, and a site with internal auditors has usually found and closed its own gaps before the assessor arrives.

What happens between the audit and the certificate?

An independent technical review of the audit evidence, plus closure of any findings. This stage is where most cGMP certification delays arise, and it is the one most within your control.

Do changes made during the process affect the audit?

They can. A change to product lines, sites or processes outside the agreed scope usually calls for a scope extension. Telling IAS as it happens keeps the plan intact; discovering it at the audit does not.

How do we keep the timeline from slipping after certification?

By running internal audits between assessments. Surveillance visits go quickly at sites that have already found their own drift, and slowly at sites discovering it for the first time.

Can we pause the process if production gets busy?

Usually yes, and it is better than pressing on with nobody available to host an audit. Say so early. What causes real difficulty is a pause taken silently, after a plan has been built around dates that then pass without contact.

FSSC 22000 V6 to V7 in Australia: Your Transition Countdown Starts Now

FSSC 22000 V6 to V7 in Australia: Your Transition Countdown Starts Now

Quick answer

FSSC 22000 Version 7 replaces Version 6 through a published transition timeline rather than an overnight switch, and Australian certified organisations should treat that timeline as a planning tool, not a countdown to panic over. Version 6 certificates remain valid and fully auditable throughout the official transition window, and most already-certified sites move across at their next scheduled audit.

Key changes at a glance

  • FSSC has published a formal transition timeline covering the move from Version 6 to Version 7.
  • Exact cascade dates vary and should be confirmed directly with your certification body, not assumed.
  • Version 6 certificates remain valid and fully auditable throughout the official transition window.
  • Most already-certified Australian sites move to Version 7 via their next scheduled audit, not a new cycle.
  • PRP references, auditor qualification, sustainability and AI governance requirements all land at that same audit.
  • Proactive planning now avoids a compressed scramble as your surveillance or recertification date approaches.
  • Rushing an unplanned re-certification before Version 6 even lapses is unnecessary and not recommended.
FSSC 22000 V6 to V7 in Australia: Your Transition Countdown Starts Now

What do we actually know about the V6 to V7 transition?

FSSC has published a transition timeline for the move from Version 6 to Version 7, setting out the general phasing certification bodies and certified organisations should expect. Because cascade dates and phase-in specifics can differ by region and by certificate, and because sources on the exact cutover dates conflict, the responsible approach for any Australian organisation is to treat fssc.com and your own certification body as the authoritative sources for the dates that apply to your certificate, rather than relying on a single secondary summary.

What is consistent and confirmed across the scheme is that Version 6 certificates remain valid and fully auditable during the official transition window. That single fact should shape how Australian certified organisations approach the transition: there is a defined runway to prepare, not a cliff edge where certification suddenly becomes invalid the day Version 7 is published.

The transition timeline exists precisely so that certification bodies and certified sites can plan a smooth handover rather than face a compressed, all-at-once conversion. Understanding that structure — a published timeline, a valid Version 6 window, and a defined mechanism for moving certified sites across — is more useful for planning purposes than any single date.

Why does FSSC manage transitions this way?

FSSC 22000 sits within the Global Food Safety Initiative’s benchmarking framework, built on the ISO 22000 food safety management system standard with additional PRP and scheme-specific requirements layered on top. When a GFSI-recognised scheme updates — as FSSC 22000 has with Version 7’s revised PRP references, GFSI 2024-aligned auditor qualification requirements, clarified food chain categories, and new sustainability and AI governance clauses — it needs a transition mechanism that keeps certificate holders compliant throughout, rather than creating a gap where no valid certificate exists.

A published transition timeline paired with continued validity of Version 6 certificates is the standard way mature certification schemes manage this kind of update. It reflects that Version 7 is scheme maintenance and enhancement, not a rejection of everything certified under Version 6, and it gives both certification bodies and certified organisations a structured runway to work through PRP documentation updates, auditor requalification, and new sustainability procedures at a manageable pace.

For Australian organisations used to planning around ISO recertification cycles generally, this pattern should feel familiar: a defined transition period, continued validity of the prior version’s certificates, and delivery of the new requirements through the normal audit cycle rather than a special one-off event.

What should certified organisations in Australia do right now?

The most useful first step is contacting your certification body directly to confirm the specific cascade dates and timeline milestones that apply to your certificate, since generic summaries — including this one — should never be treated as a substitute for that direct confirmation. From there, map your own audit calendar: because most already-certified Australian sites will move to Version 7 through their next scheduled surveillance or recertification audit rather than a brand-new certification cycle, knowing that date lets you work backward to a realistic internal preparation schedule.

Use the time before that scheduled audit productively. Review PRP documentation against the updated ISO 22002-x:2025 references, confirm your internal audit team’s training reflects the GFSI 2024-aligned competence expectations, and put basic Food Loss & Waste and AI governance procedures in place if your organisation does not already have them. None of this needs to happen overnight, but all of it benefits from starting well before your scheduled visit rather than in the final weeks before it.

Australian food businesses exporting internationally should also flag the transition to key customers or brand-owner partners who track certificate status, so there is no confusion if a Version 6 certificate is still showing as valid closer to the point where competitors have already moved to Version 7. A short internal briefing note summarising your confirmed timeline, prepared once your certification body responds, is often enough to keep both internal stakeholders and external partners aligned.

What mistakes do Australian organisations commonly make?

The single most common mistake is waiting for a firm, universally quoted cutover date before doing any preparation at all. Because cascade dates genuinely vary and are best confirmed per certificate, waiting for a single public date that applies uniformly to everyone means waiting indefinitely — the better approach is confirming your own certificate’s timeline directly and planning against that.

A second common mistake is assuming the transition requires an entirely new certification project. For most already-certified sites it does not; it is delivered through the audit you already have scheduled, so treating it as a major new undertaking often leads to over-investing time and resources relative to what is actually required.

A third mistake is confusing the transition timeline with the auditor qualification, PRP standard, and sustainability changes that ride along with it. The timeline tells you when the audit happens; the other changes tell you what that audit will actually assess — both need attention, and neither substitutes for the other.

A fourth mistake, seen among Australian organisations managing multiple certified sites, is assuming every site shares the same cascade date simply because they share a certification body. Audit scheduling is typically set per site based on each site’s own certification anniversary, so multi-site operators should confirm the transition timing separately for each certified location rather than assuming one date covers the whole group.

How does IAS Australia help you prepare?

Preparing for a scheduled Version 7 audit is ultimately about people: your internal audit team, quality function, and anyone responsible for interpreting PRP documentation and sustainability procedures need to understand the new requirements well before the certification body auditor arrives. IAS Australia supports certified organisations with FSSC 22000-focused training built around the Version 7 scheme, so your team is not learning the changes for the first time during the audit itself.

If your organisation is mapping its transition timeline against its own audit calendar, explore the FSSC 22000 Lead Auditor and Internal Auditor training programmes to make sure your internal team is ready well ahead of that visit. And because the transition timeline is only one part of the Version 7 picture, the complete FSSC 22000 certification guide covers the PRP, auditor qualification, sustainability and AI governance changes that will also be assessed at that same audit.

FSSC 22000 V6 vs V7: transition basics at a glance

AspectVersion 6Version 7
Certificate validityVersion 6 certificates valid and auditableVersion 6 certificates remain valid and auditable during transition
Path for existing certificate holdersN/AMove to Version 7 at next scheduled surveillance or recertification audit
New certification cycle requiredN/ANot required for most already-certified sites
Authoritative source for exact datesN/Afssc.com and your certification body directly
Recommended planning approachN/AProactive preparation ahead of your next scheduled audit
Changes assessed alongside the transitionPRP, auditor and sustainability rules under Version 6Updated PRP references, auditor qualification, sustainability and AI governance rules

Exact FSSC 22000 Version 6 to Version 7 transition and cascade dates should be confirmed directly with your certification body.

Dr. C.D. Mohana Priya

ISO 22000:2018 Lead Auditor · Laboratory Quality Tutor

A molecular geneticist and Associate Professor (Research) at Sri Ramachandra Institute of Higher Education and Research, Chennai, and an ISO 22000:2018 Lead Auditor, ISO 9001:2015 Lead Auditor and ISO 15189:2022 Internal Auditor. With 15+ years spanning laboratory quality management, food-safety systems and management-system training, she brings a scientific, standards-based rigour to FSSC 22000 auditor education.

Frequently asked questions

When exactly does the FSSC 22000 Version 6 to Version 7 transition happen?

FSSC has published a transition timeline, but exact cascade dates vary and should be confirmed directly with fssc.com or your certification body rather than a single generic date.

Is my FSSC 22000 Version 6 certificate in Australia still valid?

Yes. Version 6 certificates remain valid and fully auditable during the official transition window.

Do Australian sites need a new certification cycle to move to Version 7?

No. Most already-certified sites move to Version 7 through their next scheduled surveillance or recertification audit rather than starting over.

Should we wait for a confirmed cutover date before preparing?

No. Because dates vary by certificate, the recommended approach is to confirm your own timeline with your certification body and begin preparing well ahead of your scheduled audit.

What else changes at the same audit as the Version 7 transition?

The same scheduled audit that moves you to Version 7 will also assess the updated PRP references, auditor qualification requirements, and new sustainability and AI governance clauses.

Will Australian sites be notified before their transition audit is scheduled?

Yes — certification bodies operating in Australia notify certified organisations ahead of the audit where Version 7 requirements will first be assessed, so there is time to prepare.

Australian Organizations Can Prevent Workplace Incidents and Legal Issues Using ISO 45001

How Australian Organizations Can Prevent Workplace Incidents and Legal Issues Using ISO 45001