Where we work · Gambia
ISO and GRC certification consulting in Gambia
Achieve ISO and GRC certification in Gambia with Sterling: 8,100+ client engagements in 60+ countries, 20+ years.
- 20 standards, one team
- Accredited certification route
- Lagos office team
- Effivity and Academy included
Sectors that ask for certification in Gambia
Clients include
ISO and GRC certification in Gambia at a glance
Food businesses in The Gambia are registered and licensed by the Food Safety and Quality Authority, and the Food Safety and Quality Act 2011 requires hazard controls, written records and traceability, which is why food safety and quality management lead the demand for ISO and GRC work. Banks and payment providers follow the Central Bank's Cybersecurity Guidelines for Financial Institutions, hotels and restaurants are licensed by the Gambia Tourism Board, and workplaces answer to Part XV of the Labour Act 2023 on safety, health and accident notification. The Anti-Corruption Act 2023 reaches bribery in the private sector, the Medicines Control Agency regulates medical devices and medicines, and GIEPA offers incentives to priority sectors and runs the July 22nd Business Park export processing zone. No Gambian accreditation body for management systems was identified, so certificates from accredited certification bodies usually carry accreditation from another economy. Sterling's Lagos office serves Gambian organisations, drawing on 8,100+ client engagements in 60+ countries, 20+ years of practice, and Effivity and Sterling Academy included with every engagement.
ISO and GRC standards Sterling delivers in Gambia
Each card opens Sterling's guide to the standard: what it requires, how certification or compliance works and what sets the time and cost.
Quality & operational excellence
Information security, cyber & cloud
Privacy & data protection
AI governance & digital trust
Environment, energy & climate
Health & safety
Governance, risk & resilience
Financial services, payments & AML
Food safety & agriculture
Healthcare, medical devices & life sciences
Laboratories, inspection & accreditation
Automotive, aerospace, rail & defence
Construction, energy, oil & gas
Regulators and laws that drive certification in Gambia (10)
| Law or regulator | What it asks for | Standards it cites |
|---|---|---|
| Food Safety and Quality Authority (FSQA), which describes itself as the sole National Competent Authority for the official control of the safety and quality of food and animal feed, whether produced locally, imported or destined for export Food and feed businesses: manufacturers, importers, exporters, storage, retail and food vehicles or vessels | Food Safety and Quality Act, 2011. A business dealing in food or feed must be registered with the Authority (section 32) and an establishment, vehicle or vessel must hold a licence (section 33), whose conditions may cover premises, equipment and internal systems for food safety (section 34). Operators must implement a system of controls based on hazard identification, critical points, monitoring, corrective action, sampling and written records (section 40), keep traceability one step back and one step forward (section 39) and withdraw or recall non-compliant product (section 38). The Act does not name HACCP or ISO 22000. FSQA publishes guidelines on import and export, food storage warehouses, traceability, withdrawal and recall, food retail establishments and start-up food and feed businesses. | |
| Medicines Control Agency (MCA), under the Ministry of Health Medicines, herbal medicines, cosmetics, household chemicals and medical devices | Medicines and Related Products Act 2014, which the MCA says gives it the mandate to control the manufacture, importation, exportation, distribution, use and advertisement of medicines and related products, with related products including herbal medicines, cosmetics, medical devices and household chemicals. Its functions include approving and registering products, granting and revoking licences and permits, appointing inspectors and prescribing quality standards. The MCA publishes guidelines on marketing authorisation, storage and distribution of medicines, and its own inspections. | |
| Central Bank of The Gambia (CBG), Banking Supervision Department Banks, non-bank financial institutions and other institutions authorised by the Central Bank | Cybersecurity Guidelines for Financial Institutions (Version 1.0, January 2022), issued under section 79 of the Central Bank of The Gambia Act 2018 and applying to institutions authorised under the Banking Act 2009, the Non-Bank Financial Institutions Act 2016 and section 66(b) of the Central Bank Act. They cover board and senior management duties, a cybersecurity steering committee, a chief information security officer, disaster recovery and business continuity plans with a test calendar, incident response and drills, independent assessment by internal audit, outsourcing due diligence and exit planning, awareness training, quarterly reporting to senior management, and immediate reporting of cyber incidents to the CBG. The CBG also lists an Outsourcing Guideline for Banks and a Risk Management guideline. The cybersecurity guidelines name no ISO standard. | |
| Central Bank of The Gambia (CBG) Mobile money, payment service providers and the national payment system | The CBG lists licensed mobile money operators and payment service providers and publishes a Regulation for the Provision of Mobile Money Services, whose stated purposes include allowing electronic payment services without compromising the safety and efficiency of the national payment system and setting minimum standards for consumer protection and risk management. The CBG also describes the real time gross settlement, securities settlement, automated clearing and GamSwitch payment systems. None of these pages names an ISO or PCI standard. | |
| Public Utilities Regulatory Authority (PURA) Telecommunications, internet and ICT service providers, and holders of critical information infrastructure | PURA states that the Information and Communications Act, 2009 makes it the authority for the regulation of information and communications services, networks and associated facilities, and that the Gambia Public Utilities Regulatory Authority Act, 2001 and the Electricity Act 2005 also define its role. The 2009 Act includes a Part on computer misuse and cyber crime, with offences such as unauthorised access, interception, modification and denial of access. PURA reports that it set up the national computer security and incident response team, gmCSIRT, to support critical information infrastructure holders. | |
| National Environment Agency (NEA) Industrial and development projects, hazardous chemicals and pesticides, emissions and effluents | National Environment Management Act (NEMA), 1994, under which the NEA was established as the principal coordinating body. The NEA's site lists Environmental Impact Assessment Regulations, which require environmental and social impact assessments for major development projects before approval and construction, Environmental Quality Standards on emission, effluent and noise levels for industrial operations, regulations on hazardous chemicals and pesticides, and a Plastic Bag Ban Regulation, 2015. | |
| Commissioner of Labour, under the Labour Act, 2023 Every workplace: employers, factories, hotels, ports and building sites | Labour Act, 2023, Part XV on occupational safety, health and welfare. Operators of a workplace must file notice of its particulars with the Commissioner (section 112); employers must keep workplaces clean, ventilated and lit, take fire prevention and escape measures, keep machinery safe, and provide welfare facilities and protective equipment for special risks (sections 113 to 116); and must notify the Commissioner of any industrial accident or occupational disease (section 116). Officers have powers of entry and inspection under Part II. | |
| Gambia Tourism Board Hotels, restaurants, night clubs, casinos, tourist enterprises and tourist guides | Gambia Tourism Board Act 2011. The Act says no one may operate a hotel, night club, casino or restaurant, or run a tourist enterprise or act as a tourist guide, without a licence granted by the Board, and it provides for the Board to classify hotels and keep a register of them. | |
| Gambia Anti-Corruption Commission All organisations, including private sector entities dealing with public officials and foreign public officials | Gambia Anti-Corruption Act, 2023, which creates offences of bribery of a public officer, a foreign public official or an official of a public international organisation, bribery in relation to contracts, bribery in the private sector, trading in influence and abuse of office, and a duty to report a bribery transaction. | |
| Gambia Investment and Export Promotion Agency (GIEPA) Investors and exporters seeking incentives, and export-processing enterprises | GIEPA states that the Special Investment Certificate and the Export Processing Zone Licence are offered under the GIEPA Act 2015 to priority sectors (agriculture, fisheries, tourism, forestry, manufacturing, energy and other services). The Special Investment Certificate application lists a food safety and quality assurance document and an environmental impact assessment where they apply. The National Export Strategy 2021-2025 names tourism, agribusiness and horticulture, fisheries, groundnuts, cashews and light manufacturing as priority export sectors. |
Accreditation and recognition
- No national accreditation body for management system or laboratory conformity assessment identified: The National Accreditation and Quality Assurance Authority Act, 2015 (Act No. 2 of 2015) defines accreditation as formal recognition of an educational institution for meeting standards in its programmes, and its Authority concerns tertiary and higher education institutions, so it is not a conformity assessment accreditation body. The Gambia does not appear among the signatory or non-signatory accreditation bodies or regional groups in the arrangement's member list dated 31 December 2025.
- The Gambia Standards Bureau: National standards body under The Gambia Standards Bureau Act, 2010: it establishes and publishes standards for imported and locally produced goods, promotes standardisation, conformity assessment and metrology, and keeps national measurement standards and reference standards for calibration.
Look for a certification body whose accreditation scope covers your standard and sector, from a national accreditation body recognised under the international arrangements of Global ACI (Global Accreditation Cooperation Incorporated, formerly the IAF MLA). Sterling does not certify.
Tenders and procurement
- Public procurement and the Gambia Public Procurement Authority's supplier registration (Gambia Public Procurement Authority (GPPA)): GPPA describes its mandate as regulating and overseeing all public procurement, and it runs a supplier registration portal, tender notices and registers of suppliers. Each tender document sets its own qualification and evaluation criteria, so read the clause on quality, safety or management-system evidence in every bid.
Economic zones
- July 22nd Business Park (export processing zone): manufacturing and processing, agribusiness, assembly and bulk breaking, labelling, packaging and repackaging, warehousing, ICT, financial and offshore services
Sterling in Gambia
Sterling delivers in Gambia from its Lagos office: one team from scoping to certificate, with Effivity ISO & GRC software and Sterling Academy access included. Sterling does not certify; certification decisions stay with independent bodies.
Questions Gambia clients ask
Who controls food safety in The Gambia?
The Food Safety and Quality Authority is the national competent authority for the official control of food and animal feed, whether produced locally, imported or exported. The Food Safety and Quality Act 2011 requires food businesses to register, establishments to be licensed, hazard controls with written records and traceability. Ask the Authority which licence conditions apply to your operation.
Which cyber security rules apply to Gambian banks?
Institutions authorised by the Central Bank follow its Cybersecurity Guidelines for Financial Institutions, issued in January 2022 under the Central Bank Act 2018. They cover board oversight, a security officer, disaster recovery with a test calendar, independent assessment, outsourcing and incident reporting to the Central Bank. The guidelines name no ISO standard, so ask the Bank how it expects you to evidence compliance.
Are certification audits in The Gambia conducted in English?
Yes, English is the usual language, because Acts, regulator guidelines and official notices are published in English. Staff interviews may run in a local language where people prefer it. Agree the audit language, any interpreter and the language of controlled documents with your certification body when you apply.
Is there an export processing zone in The Gambia?
Yes. GIEPA describes the July 22nd Business Park at Banjul International Airport in Yundum as the country's first export processing zone, open to manufacturing, processing, agribusiness, packaging, warehousing and ICT activities. Enterprises in export processing zones receive duty and tax exemptions under the Export Processing Zone Licence. Ask GIEPA about eligibility for your project.
Who regulates medical devices and medicines in The Gambia?
The Medicines Control Agency, set up under the Medicines and Related Products Act 2014, controls the manufacture, importation, exportation, distribution and advertisement of medicines and related products, which include medical devices, cosmetics and herbal medicines. It approves and registers products and appoints inspectors. Read the Agency's published guidelines before choosing a registration route.
Is there a Gambian accreditation body for ISO certificates?
None was identified for management systems or laboratories. The National Accreditation and Quality Assurance Authority Act 2015 concerns the recognition of educational institutions, and The Gambia Standards Bureau has a standards and metrology role. Certificates for Gambian organisations usually carry accreditation from another economy, so ask your certification body for its accreditation scope and check what your buyer accepts.
Start with a free discovery call
A Sterling consultant goes through your entities, your regulators and your target date with you. No proposal until the scope is agreed.
Sources
- Food Safety and Quality Act, 2011. A business dealing in food or feed must be registered with the Authority (section 32) and an establishment, vehicle or vessel must hold a licence (section 33), whose conditions may cover premises, equipment and internal systems for food safety (section 34). Operators must implement a system of controls based on hazard identification, critical points, monitoring, corrective action, sampling and written records (section 40), keep traceability one step back and one step forward (section 39) and withdraw or recall non-compliant product (section 38). The Act does not name HACCP or ISO 22000. FSQA publishes guidelines on import and export, food storage warehouses, traceability, withdrawal and recall, food retail establishments and start-up food and feed businesses. — assembly.gm; fsqa.gm (accessed 18 Oct 2026)
- Medicines and Related Products Act 2014, which the MCA says gives it the mandate to control the manufacture, importation, exportation, distribution, use and advertisement of medicines and related products, with related products including herbal medicines, cosmetics, medical devices and household chemicals. Its functions include approving and registering products, granting and revoking licences and permits, appointing inspectors and prescribing quality standards. The MCA publishes guidelines on marketing authorisation, storage and distribution of medicines, and its own inspections. — mca.gm (accessed 18 Oct 2026)
- Cybersecurity Guidelines for Financial Institutions (Version 1.0, January 2022), issued under section 79 of the Central Bank of The Gambia Act 2018 and applying to institutions authorised under the Banking Act 2009, the Non-Bank Financial Institutions Act 2016 and section 66(b) of the Central Bank Act. They cover board and senior management duties, a cybersecurity steering committee, a chief information security officer, disaster recovery and business continuity plans with a test calendar, incident response and drills, independent assessment by internal audit, outsourcing due diligence and exit planning, awareness training, quarterly reporting to senior management, and immediate reporting of cyber incidents to the CBG. The CBG also lists an Outsourcing Guideline for Banks and a Risk Management guideline. The cybersecurity guidelines name no ISO standard. — cbg.gm (accessed 18 Oct 2026)
- The CBG lists licensed mobile money operators and payment service providers and publishes a Regulation for the Provision of Mobile Money Services, whose stated purposes include allowing electronic payment services without compromising the safety and efficiency of the national payment system and setting minimum standards for consumer protection and risk management. The CBG also describes the real time gross settlement, securities settlement, automated clearing and GamSwitch payment systems. None of these pages names an ISO or PCI standard. — cbg.gm (accessed 18 Oct 2026)
- PURA states that the Information and Communications Act, 2009 makes it the authority for the regulation of information and communications services, networks and associated facilities, and that the Gambia Public Utilities Regulatory Authority Act, 2001 and the Electricity Act 2005 also define its role. The 2009 Act includes a Part on computer misuse and cyber crime, with offences such as unauthorised access, interception, modification and denial of access. PURA reports that it set up the national computer security and incident response team, gmCSIRT, to support critical information infrastructure holders. — pura.gm; assembly.gm (accessed 18 Oct 2026)
- National Environment Management Act (NEMA), 1994, under which the NEA was established as the principal coordinating body. The NEA's site lists Environmental Impact Assessment Regulations, which require environmental and social impact assessments for major development projects before approval and construction, Environmental Quality Standards on emission, effluent and noise levels for industrial operations, regulations on hazardous chemicals and pesticides, and a Plastic Bag Ban Regulation, 2015. — nea.gm (accessed 18 Oct 2026)
- Labour Act, 2023, Part XV on occupational safety, health and welfare. Operators of a workplace must file notice of its particulars with the Commissioner (section 112); employers must keep workplaces clean, ventilated and lit, take fire prevention and escape measures, keep machinery safe, and provide welfare facilities and protective equipment for special risks (sections 113 to 116); and must notify the Commissioner of any industrial accident or occupational disease (section 116). Officers have powers of entry and inspection under Part II. — assembly.gm (accessed 18 Oct 2026)
- Gambia Tourism Board Act 2011. The Act says no one may operate a hotel, night club, casino or restaurant, or run a tourist enterprise or act as a tourist guide, without a licence granted by the Board, and it provides for the Board to classify hotels and keep a register of them. — assembly.gm (accessed 18 Oct 2026)
- Gambia Anti-Corruption Act, 2023, which creates offences of bribery of a public officer, a foreign public official or an official of a public international organisation, bribery in relation to contracts, bribery in the private sector, trading in influence and abuse of office, and a duty to report a bribery transaction. — assembly.gm (accessed 18 Oct 2026)
- GIEPA states that the Special Investment Certificate and the Export Processing Zone Licence are offered under the GIEPA Act 2015 to priority sectors (agriculture, fisheries, tourism, forestry, manufacturing, energy and other services). The Special Investment Certificate application lists a food safety and quality assurance document and an environmental impact assessment where they apply. The National Export Strategy 2021-2025 names tourism, agribusiness and horticulture, fisheries, groundnuts, cashews and light manufacturing as priority export sectors. — giepa.gm (accessed 18 Oct 2026)
- No national accreditation body for management system or laboratory conformity assessment identified — assembly.gm; iaf.nu (accessed 18 Oct 2026)
- The Gambia Standards Bureau — assembly.gm (accessed 18 Oct 2026)
- Public procurement and the Gambia Public Procurement Authority's supplier registration — gppa.gm (accessed 18 Oct 2026)
- July 22nd Business Park (export processing zone) — giepa.gm (accessed 18 Oct 2026)
Talk to a consultant
Plan your certification with the Lagos team.
Tell us your goals, locations and target date. We’ll help you define the scope, timeline and next steps.
southafrica@sterling-grc.com+1 201 263 4443 (global headquarters) · the Lagos office replies by e-mail within one working day
What would you like to achieve?
Choose a starting point. The enquiry form takes about a minute.
Book my free discovery callContinue to the enquiry form to share your details. Please do not include passwords, sensitive personal information or confidential files. A Sterling consultant replies within one working day. Privacy notice