Quality assurance and GMP consulting
Quality systems and GMP consulting in Sri Lanka
A workable quality system supports consistent manufacturing, reliable documentation and regulatory readiness.
RAQ Consultation helps manufacturers review their current practices, identify gaps and improve procedures against the standards relevant to their products and operations.
At a glance
- RAQ's role: Gap assessments, procedures, training, internal audits and readiness reviews. RAQ does not issue regulatory approvals or independent ISO certificates.
- Cosmetics: For Sri Lankan cosmetic factories, the National Medicines Regulatory Authority (NMRA) requires the manufacturing-division acknowledgement and ISO 22716:2007 certification before individual product registration.
- Medical devices: Local manufacturers need NMRA manufacturing-site approval and the required GMP evidence. ISO 13485 is central to many dossiers; ISO 9001 is accepted only in defined cases.
- Borderline products: Local manufacturers need NMRA manufacturing-site approval and GMP evidence, separate from classification, formulation approval and registration.
What we do
Practical quality-system support
- Gap assessments. Review the existing facility, systems and records against the agreed standard or regulatory requirement.
- SOPs and controlled documents. Develop or revise practical procedures, forms, registers and document-control practices that reflect how the business actually operates.
- Training and implementation. Help teams understand responsibilities and implement the required records and controls.
- Internal audits and corrective actions. Support audit planning, findings, root-cause review and actions to address identified weaknesses.
- Readiness assessments. Review preparations for a relevant regulatory inspection or independent certification audit without guaranteeing its outcome.
Detail: standards and site requirements for local and imported products
| Category | Standard the NMRA refers to | NMRA site requirement |
|---|---|---|
| Cosmetics (local) | ISO 22716:2007, compulsory | Site master file and NMRA acknowledgement, then certification by SLSI or a SLAB-accredited body |
| Cosmetics (imported) | ISO 22716:2007, or a GMP certificate from the country of origin | Certificate submitted with the product application |
| Medical devices | ISO 13485 generally; ISO 9001:2015 only in defined cases | Local site approval; Foreign Manufacturing Site Application unless exempt |
| Borderline products | WHO GMP; an ISO certificate is listed only where no GMP certificate is available | Local site licensing with GMP inspection; foreign sites by desk review |
A summary of what the NMRA publishes for each category. Requirements are confirmed for each site rather than assumed.
Local manufacturing in Sri Lanka
Three different manufacturing-site pathways
The NMRA does not apply one manufacturing-site process to every product. Local manufacturers of medical devices, borderline products and cosmetics follow different routes, and these are not interchangeable.
| Product category | Manufacturing-site compliance | Then |
|---|---|---|
| Medical devices | NMRA manufacturing-site approval, GMP assessment and the required GMP evidence (such as the NMRA GMP report, where applicable), subject only to currently valid exemptions | Registration of each device and the applicable manufacturing licences. Details |
| Borderline products | NMRA manufacturing-site approval, GMP assessment and the relevant GMP evidence or other accepted documentation | Classification, formulation approval and product registration, each a separate step. Details |
| Cosmetics | NMRA Manufacturing Regulatory Division acknowledgement, then ISO 22716:2007 certification from SLSI or a SLAB-accredited body; the NMRA no longer carries out routine GMP inspections of cosmetic sites | Registration of each cosmetic product. Details |
Certificates and approvals are not the same thing
ISO 22716, ISO 13485 and ISO 9001 certificates are issued by certification bodies. NMRA manufacturing-site approval and GMP inspection are regulatory decisions of the NMRA. Neither replaces product registration, and RAQ issues neither certificates nor approvals.
The NMRA withdrew its 2025 web notice on a GMP inspection waiver for listed and Class I medical devices. Any current exemption, such as the one GL-037 describes for the low-risk devices in its Appendix 1, must be confirmed for the specific device.
ISO 22716 for cosmetics
Cosmetic GMP and ISO 22716:2007 readiness
ISO 22716 addresses good manufacturing practice for cosmetics. For Sri Lankan cosmetic factories, the NMRA requires the manufacturing-division acknowledgement and the appropriate ISO 22716:2007 certification before individual product registration. The certification must be issued by the Sri Lanka Standards Institution (SLSI) or a body accredited by the Sri Lanka Accreditation Board (SLAB) for the relevant standard, in line with the current notice.
Because the transition for previously approved cosmetic sites ended on 31 May 2026 under the published notice, existing operators should not rely on the old grace period without checking current status.
RAQ can assist with facility gap assessment, SOPs, hygiene and housekeeping procedures, manufacturing records, batch documentation, quality-control records, training and internal audit preparation. Certification is issued by the relevant certification body, not by RAQ.
What the NMRA's ISO 22716:2007 notice and Cosmetics page say
The NMRA's ISO 22716:2007 arrangement for cosmetics manufacturing sites took effect on 1 May 2024. Under it, the NMRA discontinued its routine GMP inspections of cosmetics manufacturing sites and relies on ISO 22716:2007 certification. The NMRA does not issue ISO 22716 certificates, and it does not accept ISO 22716 certificates whose scope is stated as "Ayurvedic Cosmetics".
A new site first submits a site master file to the NMRA and receives an acknowledgement letter. The manufacturer then applies for ISO 22716:2007 certification with that acknowledgement. Product registration follows once the site is certified.
For imported cosmetics, the NMRA asks for a valid ISO 22716:2007 certificate or a GMP certificate issued by the cosmetic regulatory body of the country of origin. Product registration requirements are explained on the Cosmetics Registration page.
Medical-device quality systems
ISO 13485 and applicable manufacturing documentation
Medical-device quality systems must cover design and production controls where applicable, traceability, complaints and technical records. ISO 13485 is central to many medical-device dossiers, while the NMRA provides particular ISO 9001 allowances for listed devices.
For locally manufactured medical devices, the NMRA's manufacturing-site approval and GMP requirements apply in addition to the quality-system certificate. The process may involve the Site Master File, facility and document assessment, and NMRA GMP inspections or audits where required, and applicants provide the GMP evidence the procedure asks for, such as the NMRA GMP report where applicable. An ISO certificate does not by itself replace these requirements. The NMRA has withdrawn its 2025 web notice on a GMP inspection waiver for listed and Class I devices; any current exemption must be confirmed for the specific device (see Medical Devices).
RAQ supports quality-system gap reviews, document development, process controls, internal audits and the preparation of relevant manufacturing and quality documentation. The certificate and dossier requirements must be confirmed for the individual product and route.
Quality-system certificates in the NMRA's device documents
For medical device registration, the NMRA generally requires ISO 13485 certification. For listed devices, an ISO 9001:2015 certificate may be submitted instead; for locally made listed devices, it must be issued by a body accredited by SLAB or an equivalent competent body. Which certificate is accepted is confirmed for each application.
Under the NMRA low-risk device checklist (GL-037, Appendix 2), a new local manufacturer may submit ISO 9001:2015 and must obtain ISO 13485 within two years; a local manufacturer already audited by the NMRA is also to submit ISO 13485 within two years. For consolidated dossiers, the NMRA's checklist (F-MDR-035) asks for a certificate issued by a certification body accredited by the International Accreditation Forum (IAF) or by a recognised national accreditation body, together with a detailed ISO audit report.
Site approval, foreign sites and exemptions
The NMRA has procedures for approving local manufacturing sites for medicines, medical devices, borderline products and cosmetics. They involve review of documents, including a site master file, and GMP inspections by the NMRA where the procedure requires them. The step-by-step roadmap the NMRA publishes is for medicine manufacturers and, as it states, may vary for other product categories. For GMP, the NMRA adopts the World Health Organization (WHO) GMP guidelines.
Overseas device manufacturing sites are approved through a Foreign Manufacturing Site Application, which the NMRA's Medical Devices page says is submitted online through its eNMRA portal: a desk review that includes the site master file. The NMRA states that listed medical devices are exempt from manufacturing site registration for foreign manufacturers, and its low-risk device guideline (GL-037) sets out further provisions for the devices in its Appendix 1.
For local sites, the dossier checklist asks for an NMRA GMP report and certificate where applicable. Not every device manufacturer needs an NMRA GMP inspection or a separate GMP certificate; this is determined from current NMRA guidance for the device and pathway. Registration requirements are explained on the Medical Device Registration page.
ISO 9001 and management systems
Quality management beyond a single product category
ISO 9001 provides a general framework for managing processes, responsibilities, risks, corrective actions and improvement. It may be useful for manufacturers and other businesses seeking more consistent operations. It should not be presented as a universal substitute for ISO 13485 or a product-specific NMRA requirement.
Borderline-product manufacturing
Quality and manufacturing requirements for borderline products
Manufacturing requirements for borderline products depend on the product, manufacturing location and applicable NMRA procedure. RAQ helps manufacturers review the relevant records, site documentation and quality controls. We do not assume that cosmetic GMP arrangements automatically satisfy borderline-product requirements.
Manufacturers producing borderline products in Sri Lanka must comply with the applicable NMRA manufacturing-site approval and GMP requirements. The process may involve facility assessment, review of the Site Master File and quality documentation, and NMRA GMP inspections or audits where required. An ISO certificate listed as an alternative where a GMP certificate is not available is not an automatic exemption (see Borderline Products).
What the NMRA publishes for borderline manufacturing sites
The NMRA approves manufacturing sites for borderline products. Its borderline guidance describes licensing of local sites, which involves a site master file and GMP inspection, and approval of foreign sites by desk review, where a GMP inspection may be needed or may be waived if a stringent regulatory authority or the WHO has inspected the site.
For product registration, the NMRA's borderline overview lists a GMP report or GMP certificate for the site, or an ISO certificate if no GMP certificate is available, with a manufacturing licence and product list; the registration acceptance checklist F-BPR-010 asks for the date of the last GMP inspection or the GMP report, and a valid GMP certificate. The NMRA lists a separate GMP certificate application as optional for local manufacturers. The site evidence accepted for a particular application is confirmed with the NMRA; an ISO certificate should not be assumed to be an automatic substitute.
Registration requirements are explained on the Borderline Products page.
What clients receive
What the engagement produces
- A documented gap assessment against the agreed criteria.
- A prioritised action plan for the identified deficiencies.
- Draft or revised procedures and supporting forms within the agreed scope.
- Training topics and implementation guidance for relevant staff.
- Internal audit plans and findings, where engaged.
- A readiness summary showing completed work and outstanding gaps.
The exact deliverables depend on the facility, intended products and contractual scope. RAQ does not issue regulatory approvals or independent ISO certificates.
Consultancy, implementation, certification and NMRA approval
| Activity | Carried out by | What it involves |
|---|---|---|
| Consultancy | RAQ | Gap assessments, advice on what is needed, internal audits and readiness for an NMRA inspection or certification assessment |
| Implementation support | RAQ, with the manufacturer | Helping develop procedures (SOPs), records, training and corrective actions. The manufacturer owns and operates its quality system |
| Independent certification | Independent certification body | Assessment against ISO 22716:2007, ISO 13485 or ISO 9001:2015 and issue of the certificate. For local cosmetics manufacturers, the NMRA requires ISO 22716:2007 certification by SLSI or a body accredited by SLAB for that standard |
| NMRA inspection or approval | NMRA | Approval or licensing of manufacturing sites under the National Medicines Regulatory Authority Act, No. 5 of 2015, according to the product category; GMP inspections where the applicable pathway requires them (not routinely for cosmetics); and GMP certificates where the pathway provides for one. Not every manufacturer needs a separate GMP certificate |
FAQs
Frequently asked questions
Can RAQ certify our factory to ISO 22716?
No. RAQ provides consulting and preparation support. Certification must be performed by an appropriately recognised certification body under the applicable requirements.
Is ISO 9001 the same as ISO 13485?
No. The standards have different scopes. The appropriate regulatory quality-system evidence depends on the device and NMRA procedure.
Does an ISO certificate replace NMRA GMP approval for a local device or borderline-product site?
No. Certification bodies issue ISO certificates; the NMRA decides manufacturing-site approval and carries out GMP inspections where its procedure requires them. Local medical-device and borderline-product manufacturers must meet the NMRA's site and GMP requirements as well.
Are listed or Class I medical devices exempt from NMRA GMP inspection?
Not automatically. The NMRA has withdrawn its 2025 web notice on a waiver for these devices. GL-037 describes an exemption for local manufacturers of the low-risk devices in its Appendix 1; eligibility must be confirmed for the specific device.
Can a cosmetic factory apply for product registration without addressing its site requirements?
No. The NMRA's published local cosmetic route requires the relevant manufacturing acknowledgement and ISO 22716:2007 certification before product registration.
Can you prepare our SOPs?
Yes, SOP and document-control support can form part of an agreed consultancy engagement. Documents must match the facility's actual operations and be implemented by the responsible organisation.
Does a local cosmetic manufacturer still need an NMRA GMP inspection?
Not routinely: the NMRA relies on ISO 22716:2007 certification instead (see section 02).
Can RAQ guarantee that we pass an inspection or assessment?
No. The NMRA and certification bodies make their own decisions. RAQ can help you prepare, but cannot guarantee a certification or approval outcome.
Official sources
- NMRA: Manufacturing sites (opens in a new tab) ↗
- NMRA: ISO 22716:2007 certification for cosmetics manufacturing sites (opens in a new tab) ↗
- NMRA: Cosmetics (opens in a new tab) ↗
- NMRA: Medical Devices (checklists and guidelines) (opens in a new tab) ↗
- NMRA: Borderline Products (opens in a new tab) ↗
The information on this page is general guidance based on publicly available requirements. The applicable procedure and documents should be checked against the current NMRA publications and the individual product circumstances. RAQ is an independent consultancy and does not issue regulatory approvals.
Contact RAQ
Preparing your facility for GMP or certification?
Tell us what products you manufacture, the current facility status and the quality standard or regulatory requirement you need to address. We can discuss the scope of an initial readiness assessment.
Please do not send procedures, audit reports, formulations or other confidential documents in a first message.