Buyer FAQ — Certifications, Audits & Documentation

Direct answer: A Malaysian supplement OEM should hold FSSC 22000, GMP, HACCP, JAKIM Halal, US FDA registration, and MeSTI at minimum. A brand owner should verify each certificate is current, request the audit report, confirm the scope covers the contracted product format, and demand a Certificate of Analysis for every batch before accepting delivery.

Certifications are the first line of due diligence when selecting a contract manufacturer. Each one represents an independent audit against a defined standard, with a scope, a validity period, and a set of findings that a buyer is entitled to review. A manufacturer holding multiple certifications has been assessed by different bodies against different frameworks, providing layered assurance rather than a single point of failure.

In Malaysia, the regulatory landscape for food-classified supplements is built on MeSTI notification as the baseline, with GMP, HACCP and FSSC 22000 building progressively on top. JAKIM Halal certification is a separate but parallel requirement for any product carrying a halal claim. US FDA facility registration matters for export. NanoVerify applies only when nano-processed ingredients are used. Understanding how these certifications interact — and what each one does and does not cover — is essential before signing a manufacturing agreement.

The Six Certifications a Supplement OEM Should Hold

Not every manufacturer holds the same set of certifications, and not every certification is equally relevant to every product. The table below summarises the six quality certifications a Malaysian supplement OEM should hold, plus NanoVerify for nano-processed formulations.

A manufacturer holding all six certifications simultaneously — as Bionutricia does at its integrated Sungai Buloh facility — demonstrates a layered food-safety system rather than a single certificate. The certifications are not interchangeable: FSSC 22000 audits the management system, GMP audits the manufacturing process, HACCP audits the hazard controls, and JAKIM Halal audits the halal integrity of the entire chain. Each addresses a different risk.

FSSC 22000 is the most comprehensive of the six. It is a GFSI-recognised scheme that incorporates ISO 22000, prerequisite programmes, and additional requirements for food safety culture, fraud prevention and defence. Version 6, the current iteration, strengthened requirements around food safety culture and food fraud, making it more demanding than its predecessor. A buyer should confirm the manufacturer holds the current version, not a lapsed or legacy certificate.

GMP certification confirms that the facility operates to pharmaceutical-grade manufacturing standards. In Malaysia, this is distinct from MeSTI, which is the Ministry of Health’s baseline food safety notification. A manufacturer can hold MeSTI without GMP, but the reverse is not typical — GMP is the higher standard.

HACCP certification validates that the manufacturer has identified critical control points in its process and implemented monitoring, corrective action and verification procedures for each one. It is process-specific: a HACCP plan for powder sachet filling is different from one for liquid bottling, and a buyer should confirm the plan covers the contracted format.

JAKIM Halal certification is issued by the Department of Islamic Development Malaysia and is the most stringent halal certification globally recognised. It audits ingredients, processing aids, cleaning protocols, storage segregation, and the entire supply chain — not just the finished product. A buyer should verify that the certificate scope explicitly names the product and format being manufactured, not just the facility.

What Auditors Actually Check During a Facility Audit

A certification audit is not a paperwork exercise. Auditors physically inspect the facility, review records, interview staff, and trace batches from raw material intake to finished product dispatch. The depth and focus vary by certification, but the common thread is evidence: every claim must be backed by a record.

A GMP audit typically covers five domains: premises and equipment, quality systems, production controls, documentation, and personnel. Auditors check that equipment is calibrated, that cleaning is validated, that batch records are complete and retrievable, and that staff are trained for their assigned tasks. Non-conformances in any domain can result in a failed audit or a conditional pass requiring corrective action within a set timeframe.

A HACCP audit focuses on the hazard analysis and critical control point plan. Auditors verify that hazards have been identified for the specific product and process, that critical limits are set and monitored, that corrective actions are documented, and that the plan is reviewed when the process changes. A HACCP plan that has not been updated after a formula or format change is a red flag.

A JAKIM halal audit examines the full halal chain: ingredient documentation, supplier halal certificates, cleaning validation between halal and non-halal production, physical segregation of halal and non-halal materials, and traceability from raw material to finished product. The auditor checks that every ingredient supplied to the facility has a valid halal certificate or is verified as not requiring one, and that the facility’s cleaning protocols prevent cross-contact.

What Documentation a Brand Owner Should Request

Before signing a manufacturing agreement, a brand owner should request and review the following documentation from any prospective OEM:

• Certificate of Analysis (CoA) for at least one recent batch of a comparable product. The CoA should show identity testing, assay or potency, microbial limits, and heavy-metal results. A CoA that reports only pass/fail without numerical values is insufficient.
• Current certification certificates for FSSC 22000, GMP, HACCP, JAKIM Halal, US FDA registration, and MeSTI. Each certificate should be checked for validity date, scope, and the facility address.
• Audit reports or summary findings from the most recent certification cycle. A manufacturer that refuses to share audit findings is a red flag — the certificate alone tells you the facility passed, not what the auditor found.
• Stability data for the proposed formulation, ideally real-time data under ICH conditions for the target market climate zone. Accelerated data is useful but not a substitute for real-time evidence at the intended storage temperature.
• Batch records and traceability documentation showing that the manufacturer can trace every batch from raw material lot to finished product, with retention samples stored and retrievable.
• Halal certificate scope confirming that the specific product and format are covered, not just the facility. JAKIM certificates name the products and formats they cover.

At an integrated facility like Bionutricia’s Sungai Buloh plant, formulation and filling happen under one quality system, which simplifies traceability from raw material to finished batch. A buyer should still request the documentation above — integration is an advantage, not a substitute for verification.

How the Certifications Interact

The six certifications are not redundant — they address different layers of risk and often build on one another. FSSC 22000 incorporates ISO 22000, which in turn incorporates HACCP principles. A manufacturer holding FSSC 22000 has already implemented HACCP as part of its food safety management system, but a separate HACCP certificate provides additional, process-specific assurance.

GMP and HACCP overlap in areas like sanitation, process control, and documentation, but GMP is broader — it covers the entire manufacturing operation, while HACCP is focused on food safety hazards specific to the process. MeSTI is the Malaysian regulatory baseline: it is a notification, not a certification, and it is required for any food-classified product manufactured in Malaysia. Food-classified supplement products go through MeSTI notification; they do not require NPRA health-supplement MAL registration, which applies to a different product category and involves a separate evaluation process.

JAKIM Halal operates independently of the food safety certifications. A facility can hold FSSC 22000 and GMP without halal certification, and vice versa. For a brand targeting Muslim-majority markets, JAKIM Halal is the certification that opens doors — and it is the one most buyers scrutinise, because halal integrity is a chain that breaks at its weakest link.

NanoVerify sits outside the six core certifications and applies only when a product uses nano-processed ingredients, such as liposomal formulations. It verifies that the nano-processing claim is genuine and that particle size has been measured and reported.

Export Documentation Basics

For brand owners exporting supplements from Malaysia, the documentation pack extends beyond manufacturing certificates. The essential export documents include a Certificate of Origin (CoO), a Health Certificate issued by the Ministry of Health, and a Certificate of Free Sale (CFS) confirming the product is legally sold in the country of manufacture. Some destination markets require additional documentation — for example, GCC countries may require halal certificate attestation, and the United States requires prior notice of shipment to the FDA.

A manufacturer experienced in export should be able to provide or facilitate all of these documents. The brand owner should confirm which documents the manufacturer supplies directly and which the brand owner must obtain independently, before the first shipment is scheduled.

Manufacturing a Certified Supplement Product Under Your Own Brand

Bionutricia offers formulation development and private-label OEM/ODM manufacturing for brand owners and distributors from its integrated facility in Sungai Buloh, Selangor. Approved formats include powder sachets, liquid sachets, gel sachets, pouch beverages, chewable tablets, and liquid bottles. The patented enzymatic ultrasonic extraction process (MY-188945-A) is available for botanical ingredients, and Herbosomal® — Bionutricia’s proprietary liposomal encapsulation and sustained-release technology (registered trademark; patent-pending PI2023005773) — is available for formulations requiring liposomal encapsulation. The facility holds FSSC 22000, GMP, HACCP, JAKIM Halal, US FDA registration, MeSTI, and NanoVerify. An in-house authority team — a registered pharmacist, a nutritionist, a dietitian and a PhD biomedical scientist — oversees formulation and quality review. For a broader overview of the halal supplement OEM landscape in Malaysia, see the complete guide to halal supplement OEM in Malaysia.

Frequently Asked Questions

How often are FSSC 22000 and GMP certificates renewed?

FSSC 22000 requires annual surveillance audits and full recertification every three years. GMP renewal frequency depends on the issuing body, but annual surveillance is typical. A brand owner should ask for the current certificate and the most recent surveillance audit report, not just the initial certification.

What is the difference between JAKIM Halal and a generic halal claim?

A generic halal claim is a self-declaration by the manufacturer. JAKIM Halal certification is an independent, government-issued certification audited by the Department of Islamic Development Malaysia, covering ingredients, process, cleaning, storage, and the full supply chain. Only JAKIM certification is recognised by halal authorities in GCC countries, Indonesia, and other Muslim-majority markets.

Should a brand owner request the full audit report or just the certificate?

Both. The certificate confirms the facility passed; the audit report shows what the auditor found, including non-conformances and corrective actions. A manufacturer that shares its audit findings is demonstrating transparency. A manufacturer that refuses to share them is a red flag, regardless of how many certificates it holds.

What documentation is needed to export supplements from Malaysia?

The essential export documents are a Certificate of Origin, a Health Certificate from the Ministry of Health, and a Certificate of Free Sale. Destination markets may require additional documents — for example, halal certificate attestation for GCC countries, or prior notice for US FDA shipments. Confirm with the manufacturer which documents they supply and which the brand owner must obtain independently.

Is NanoVerify certification necessary for all liposomal supplements?

NanoVerify applies specifically to products that use nano-processed ingredients. If a supplement claims to use liposomal or nano-encapsulated actives, NanoVerify provides independent verification that the nano-processing is genuine and that particle size has been measured. It is not required for non-nano formulations.

Related Guides

• HACCP Certification Explained: What It Covers for a Supplement Contract Manufacturer
• FSSC 22000 Version 6: What Changed and What Supplement OEM Buyers Need to Know
• Halal Certification Renewal & Surveillance Audits: What Changes After Year One

To request a quotation or discuss a formulation, email ng@bio-nutricia.com or submit an enquiry through our website. The integrated manufacturing facility is located in Sungai Buloh, Selangor, Malaysia.

Article by Bionutricia R&D Team. Last updated: 30 September 2026.