A cosmetic GMP audit checks whether batch records match manufacturing practice. A certificate alone will not show whether staff reviewed a water result, kept a rejected ingredient out of production or used the correct label on the filling line.

For a brand choosing a manufacturing partner, the audit should end with a documented sourcing decision and any conditions that must be met before production. Use its findings alongside the commercial and technical checks in choosing a cosmetic lab. A supplier questionnaire alone cannot verify manufacturing practice.

Define the legal and technical scope

In the EU, Article 8 of the Cosmetics Regulation requires manufacture to comply with good manufacturing practice. It provides a presumption of compliance where manufacture follows the relevant harmonised standards referenced in the Official Journal. Article 11 requires the Product Information File to contain a manufacturing-method description and a statement of GMP compliance.

ISO 22716:2007 gives guidance on cosmetic production, control, storage and shipment. Its published scope excludes research and development and distribution of finished products; it also does not cover personnel safety or environmental protection as a whole. Review those subjects separately from the GMP audit.

Great Britain’s guidance also requires cosmetic GMP and describes ISO 22716 as one way, but not the only way, to demonstrate it. Do not treat that guidance as a statement of Northern Ireland’s requirements.

For the US, MoCRA requires FDA to establish cosmetic GMP regulations. The official rulemaking agenda entry reviewed for this article lists the rule as a long-term action, not an effective final GMP rule. FDA’s 2013 draft GMP guidance is non-binding. Check the rulemaking status when contracting; neither an ISO certificate nor FDA facility registration should be presented as FDA product approval.

The audit controls below are buyer recommendations informed by regulator guidance. Check them against the requirements of your target markets; a recommended audit method is not necessarily a legal obligation.

Request records for the proposed production route

Before the visit, identify the legal entity, site address, product categories, batch sizes and operations in scope. Establish who compounds, fills, tests, stores and releases the product. A certificate for one site may not cover the subcontractor filling your bottles.

Request the following under an appropriate confidentiality arrangement:

• The GMP statement and any certificate, including its issuer, scope, dates and covered addresses.
• A process flow and site layout showing material, personnel and waste movement.
• Current procedures for production, cleaning, testing, deviations and release.
• A completed batch record for a comparable product and associated test results.
• Water specifications and recent trends, where water is used in the product or relevant cleaning processes.
• Recent internal-audit findings, corrective actions and relevant complaint investigations.
• A list of outsourced operations and how the manufacturer qualifies those providers.

Verify certificate details with the issuer when necessary. ISO does not itself perform certification. Ask what evidence the manufacturer can provide if certification is absent; a missing certificate and an uncontrolled manufacturing process are different findings.

Trace a batch through production and release

Choose a recent batch comparable to your product and ask to select some of the supporting records yourself. Compare its approved master instructions with the executed record, laboratory results and release decision.

The FDA GMP inspection checklist supports checks on material status, equipment cleanliness, written instructions, water testing and control records. It is an older resource: use its production-control topics, not its obsolete references to voluntary registration, as the basis for questions.

At the line, check the equipment labels for contents and status. Compare that information with the batch record and material containers. Then ask how the next shift knows what is released, in use or awaiting a decision. Investigate discrepancies between records and practice even when the room looks clean.

For water-based products, discuss microbiological control with someone competent to assess it. Routine microbial results and a preservative challenge test answer different questions. Neither a good appearance nor one passing test establishes that the whole process is controlled.

Test exceptions, complaints and traceability

Review a specific deviation or change: an out-of-specification result, wrong component, delayed fill or supplier change. Check who investigated it, how affected stock was controlled and who authorised disposition. If the procedure tells staff to retest but does not explain how to investigate the original failure, ask the quality manager to account for the gap.

Ask the team to trace a raw-material lot forward into finished batches and a finished batch back to its inputs and packaging. Where records permit, continue to shipment destinations. Record any gaps and how long the exercise takes. Judge the result against an agreed criterion suited to the product and distribution arrangements, not an assumed universal time limit.

Review how complaints reach the quality team, how retained samples support investigation and how a recall would be coordinated. The contract should specify who shares complaint and recall information, with whom and how quickly, so the brand and Responsible Person can meet applicable reporting obligations. The complaints and recalls guide covers those handoffs.

Worked example: an unresolved water excursion

Imagine a brand evaluating a contractor for a leave-on lotion. The factory has an ISO 22716 certificate, and the selected batch has passing finished-product microbial results. During the audit, a water trend shows an excursion around its manufacturing date, but the batch review contains no reference to it.

The auditor should request the sampling-point details, excursion investigation, water-use timeline, affected-batch assessment and disposition rationale. A passing finished-product result does not explain whether the manufacturer considered the water issue before release.

The buyer could withhold approval for the proposed lotion route until a competent reviewer has assessed the issue and the manufacturer has addressed the control failure. The gap in the batch review does not, by itself, establish contamination or show that every batch at the site is affected.

Closure evidence might include the completed investigation, documented disposition of potentially affected stock, a revised review procedure and records from subsequent batches showing that water results are considered before release. Retraining attendance alone would not demonstrate that the revised control works.

Turn findings into purchasing conditions

Write each finding against an identified requirement or agreed audit criterion. Include the observed evidence, product risk, immediate containment, owner, due date and evidence needed for closure. Define finding categories before the audit; do not let a high overall score cancel a serious contamination or traceability concern.

The sourcing decision can be approval, approval limited to specified processes with conditions, or no approval until identified gaps close. Record the reasons and who authorised the decision. Agree audit access, subcontractor controls and notification of material changes in the quality agreement.

Before the first commercial order, confirm how the batch-release record and certificate of analysis will reach your team. Continue oversight when the manufacturing route, product risk or supplier performance changes. Keep the approval decision and any purchasing conditions with the audit evidence for that production route.