Risk-Based Raw Material Sampling: How Often Should You Actually Test Incoming Ingredients?

FDA 483 observation data from dietary supplement inspections has been remarkably consistent over the past decade. Year after year, inadequate incoming raw material testing lands near the top of the most-cited cGMP violations — not because manufacturers have no program, but because the programs they have don’t hold up under scrutiny. Too many lots skipped. Sampling plans that aren’t documented. Testing scope that doesn’t match the risk profile of the ingredient.

If you’re asking “how often should we test this ingredient?” you’re already thinking correctly. The honest answer is that it depends on four variables: what the ingredient is, who’s supplying it, what your historical testing data shows, and what the regulatory baseline actually requires. Most guidance glosses over the interaction between these factors. This post won’t.

What 21 CFR 111 Actually Requires (It’s More Than Most People Assume)

The starting point for any US-market supplement manufacturer is 21 CFR 111.75. The language is specific: for each component that is a dietary ingredient, you must conduct at least one test to verify its identity for every incoming lot. Not every other lot. Not annually per supplier. Every lot.

This is one of the most consistently misapplied sections of the dietary supplement cGMP rule. Manufacturers build robust supplier qualification programs — questionnaires, audits, approved vendor lists — and conclude that a qualified supplier means they can reduce lot-level identity testing. For dietary ingredients, that reasoning doesn’t hold under FDA’s framework. Supplier approval status reduces how much you rely on the supplier’s own COA; it doesn’t substitute for your own identity verification on incoming lots.

For non-dietary ingredient components — excipients, encapsulation materials, flow agents — the flexibility is meaningfully greater. You can use reduced sampling frequencies if you have a documented, risk-justified SOP that supports the approach. That’s where risk-based thinking genuinely does the work.

Beyond identity: purity, potency, and microbial testing are not mandated at every lot under 21 CFR 111.75, but the regulation requires you to establish specifications for each parameter and test at “appropriate intervals.” Defining what “appropriate” means in writing — before an inspection, not during one — is the entire purpose of a risk-based program.

Building a Three-Tier Supplier Risk Framework

The foundation of any defensible sampling program is supplier tiering. Not all raw materials carry equal risk, and not all suppliers have equal track records. A documented tiering system concentrates your analytical testing resources where the exposure is greatest.

Tier 1 — High Risk

Tier 1 includes botanicals and herbal extracts, which carry industry-wide adulteration and substitution rates that remain stubbornly elevated. A 2020 analysis published in Food Control examined commercial herbal raw materials and found adulteration or substitution in more than 25% of samples in certain botanical categories — a figure that subsequent market surveillance data has not significantly improved. Turmeric, ashwagandha, ginseng, and several popular adaptogen extracts are perennial problem categories.

Tier 1 also covers materials sourced from suppliers without a documented GMP audit history, any ingredient involved in FDA alerts or recalls within the past 36 months, ingredients with novel or complex identity signatures (where substitution can be difficult to detect by organoleptic inspection alone), and any new supplier regardless of ingredient type.

For Tier 1 materials, the testing protocol at an accredited analytical testing laboratory should include: identity (HPTLC, FTIR, or DNA barcoding as appropriate to the ingredient class), heavy metals by ICP-MS (lead, arsenic, cadmium, mercury against USP or internal specifications), actives quantification for standardized extracts, and a full microbial panel covering total aerobic count, yeast and mold, E. coli, Salmonella, and Staphylococcus aureus at minimum. Testing frequency: every incoming lot, without exception.

Tier 2 — Moderate Risk

Tier 2 covers established suppliers with at least 12 months of clean incoming test results in your system, commodity ingredients with well-understood global supply chains, and materials where the economics of adulteration are weaker. Many vitamin forms and mineral salts from qualified manufacturers land here — their identity signatures are straightforward and the incentive to substitute is limited.

Testing protocol: identity on every lot (still non-negotiable for dietary ingredients), with extended panels — potency, heavy metals, and microbiology — tested on every third lot or semi-annually, whichever comes first. Documented trigger conditions, described in the next section, can bump any specific lot to full testing regardless of schedule.

Tier 3 — Lower Risk

Tier 3 is reserved for materials with a multi-year history in your program, consistent clean results in your internal data, third-party GMP certification from a credible certifying body (NSF, USP, ISO 22716, ICH Q7-compliant facilities), and ingredients where the identity profile is chemically unambiguous. Gelatin capsules from a certified supplier, silicon dioxide from a major excipient manufacturer, or magnesium oxide with a stable, simple identity signature often qualify.

Testing protocol: identity verification on every lot (still required if the ingredient is classified as a dietary ingredient or a component of a dietary ingredient), with extended analytical panels performed annually or whenever specification changes, supply chain changes, or regulatory signals arise. Annual testing frequency for extended panels on Tier 3 materials is justifiable — but only if the justification is documented in the SOP and supported by a current risk assessment.

Setting the Right Sampling Plan Within Each Lot

Tiering answers how often to test across lots. Sampling plans answer a separate question: how many containers to pull from within a single incoming lot. These are distinct decisions, and conflating them creates gaps in both directions.

Two approaches dominate in supplement manufacturing: AQL (Acceptable Quality Level) sampling per ANSI/ASQ Z1.4, and C=0 (zero-acceptance number) plans.

AQL sampling is statistically designed to allow a defined percentage of non-conforming units to pass through. For packaging components and non-critical materials, AQL plans are often perfectly appropriate and widely accepted. For dietary supplement raw materials — particularly Tier 1 botanicals — AQL introduces a structural problem: lots with a meaningful fraction of non-conforming containers can still pass. That’s an acceptable trade-off when you’re sampling corrugated boxes. It’s less acceptable when the material goes into a capsule that will carry a label claim.

C=0 plans set the acceptance number to zero, meaning a single non-conforming sample result rejects the entire lot. For high-risk raw materials tested at an accredited analytical testing laboratory, C=0 plans represent best practice among quality consultants and are increasingly expected by retail buyers and third-party certifiers conducting supplier audits. The additional analytical cost of sampling more containers per lot is real, but modest relative to the cost of a contamination event, a market withdrawal, or a lost retail account.

For a typical 20-drum lot of a Tier 1 botanical, a C=0 plan at a standard inspection level requires sampling approximately 5 containers. An AQL plan at equivalent confidence might require 3. Two additional analytical samples per lot is an investment worth making when the ingredient is going into a finished product with a 24-month shelf life and your name on the label.

Trigger Conditions That Override the Schedule

A well-designed fixed testing schedule still needs documented override conditions — events that automatically escalate any incoming lot to full analytical testing, regardless of tier assignment or where it falls in the testing rotation.

At minimum, your incoming material SOP should define escalation triggers for:

• Supplier audit findings: any major finding or unresolved observation from a recent audit of the supplier’s facility bumps all incoming materials from that source to Tier 1 testing until the CAPA is closed and verified
• Regulatory signals: an FDA Warning Letter, import alert, or 483 observation citing the supplier or involving the same material class from that supply region
• Extended or abnormal transit: shipments with documented temperature excursions, unusual delays exceeding typical transit windows, or damage to primary packaging on arrival
• Supply chain changes: supplier notification of a change in raw material origin country, sub-supplier, extraction method, or processing site — even when the spec sheet appears unchanged
• Internal trend data: if your incoming test results for a specific material show consistent potency drift, creeping out-of-trend microbial counts, or shifting identity profiles across three or more consecutive lots, that’s a signal requiring investigation, not a reason to wait for a full failure

Documenting these triggers in your SOP — specifically, not generically — is what converts a good-faith testing program into one that holds up to both FDA scrutiny and the standards of global B2B customers who conduct their own supplier audits of your facility.

The Documentation That Actually Holds Up to Scrutiny

Testing without complete records is, in a regulatory and legal sense, testing that didn’t happen. Under 21 CFR 111.260, records for each component lot received must be retained for at least 1 year beyond the shelf life of the product in which it was used, or 2 years from the date of sale — whichever is longer. For supplement products with 24-month expiry dating, that means 4 or more years of incoming material records.

Each lot record should contain: the supplier’s lot number and your internal batch identifier, the received date and the date testing was completed, the specification version that was tested against, the test method reference (including version), the identity of the analyst or the external analytical testing laboratory that performed the testing, a link to or copy of the underlying lab report, and the disposition decision with an authorized signature.

The single documentation gap that creates the most problems in FDA inspections is this: recording “Pass” in the batch record without retaining the underlying analytical report from the contract lab. FDA investigators routinely request the actual reports, and “our contract analytical testing laboratory has them” is not a records-retention strategy. You need to receive, file, and be able to produce those reports on request — within the inspection window.

Reviewing the Program Annually — and Documenting That You Did

A risk-based program is a living document, not a one-time design exercise. Supplier profiles change. New ingredients move into high-risk categories as adulteration patterns shift. Your own internal test data accumulates trend signals over time that weren’t visible in year one.

Schedule a formal annual review of all supplier tier assignments, using four input sources: your internal incoming test results from the prior 12 months (including any out-of-specification events and trend data), external FDA recall and safety alert data for materials in your supply network (the FDA recall database is publicly searchable), the results of any supplier audits conducted during the year, and customer complaints or returned goods investigations that were traced to incoming material quality issues.

The output — including any tier changes, SOP revisions, and the rationale for keeping any tier assignments unchanged — should be documented in your quality management system. An auditor reviewing a program that has clearly been evaluated and maintained year-over-year has a fundamentally different level of confidence in it than one that looks like it was designed in 2019 and hasn’t been touched since.

---

Pull out your current incoming material testing SOP and answer three specific questions. Does it require identity testing on every lot of every dietary ingredient, with no carve-outs for approved suppliers? Does it define the sampling plan — C=0 or AQL — and document the rationale for that choice? And does it list specific, enumerated trigger conditions that escalate testing outside the normal schedule? If any of those answers is no, that’s your starting point.

---

Written by Nour Abochama, VP Operations, Qalitex | Quality Consultant, Ayah Labs. Learn more about our team

Talk to our team about raw material testing. Contact us

Related from our network

• Identity and Potency Testing for Supplement Raw Materials at Qalitex Laboratories — ISO 17025-accredited analytical testing with HPTLC, ICP-MS, and full microbial panels for dietary supplement manufacturers.