Pharma customers audit the paperwork before the first order

GMP governs the licensed manufacturing operation. ISO 9001 covers what sits around it: commercial supplier performance, complaint closure across functions, change control that reaches beyond production, and management review against targets. Distributors, API traders and contract service providers who fall outside a manufacturing licence use ISO 9001 as the recognised system for that scope. Many customer questionnaires now ask for both.

No. Certification covers the sites named on the certificate. A contract manufacturer needs certification for its own site, and your system has to show how you qualified and monitor it: audit reports, change notification agreements, requalification intervals. Customer auditors look hard at that supplier file, because it is where responsibility for a site you do not control is either evidenced or quietly assumed.

They can sit under one organisation but rarely under one standard. Food-law lines are covered by ISO 22000 hazard analysis and prerequisite programmes, while drug lines run under GMP. Where both are certified, the scope statement names each production block explicitly. Auditors then check segregation, dedicated equipment or validated cleaning between them, and separate release routes.

They verify it first. The buyer checks the accreditation mark, the certificate number on the register, and whether the scope actually covers the product being bought. A scope mismatch is the most common reason a certificate is rejected during vendor approval, so get the wording right at proposal stage. Certification does not remove a customer’s right to audit, but it usually shortens the visit.

Not automatically. A new manufacturing block, dosage form or laboratory scope is a scope extension and needs an audit of the added area before the certificate is amended. Tell SIS when commissioning is planned rather than after a customer asks. Extension audits are short, but they cannot be issued retrospectively to cover product already shipped.

No. An accredited certification body cannot consult for an organisation it certifies, and that independence is the reason the certificate carries weight with regulators and customers. SIS reports findings precisely enough for your team or your consultant to act: the clause, the evidence seen, and what was missing. Closing them stays on your side of the line.