Cosmetic GMP Certification: ISO 22716, Audits, and MoCRA

Cosmetic GMP certification in the United States now sits at the intersection of two frameworks: ISO 22716, the international Good Manufacturing Practice standard for cosmetics, and the Modernization of Cosmetics Regulation Act of 2022 (MoCRA), which for the first time gives the FDA authority to require and enforce GMP compliance for cosmetic manufacturers.¹ Certification itself is voluntary and granted by an accredited third-party registrar, but the practices it verifies overlap heavily with what federal law now expects. The FDA’s existing GMP guidance already incorporates elements of ISO 22716, and MoCRA directs the agency to write formal GMP regulations consistent with recognized national and international standards.²

What ISO 22716 Actually Requires

ISO 22716 covers the full production lifecycle, from raw material intake through finished goods release. Certification means you can demonstrate, with documentation and by direct observation, that your facility meets each part of that lifecycle standard.

Personnel and Hygiene

Everyone involved in manufacturing or quality control needs documented qualifications, training, or experience appropriate to their role. Workers in direct contact with raw materials, in-process batches, or finished products must have clean clothing, hair restraints, gloves, and any other protective gear the job calls for. Employees with open wounds or infections that could contaminate a batch stay off the floor.² Training records should show both general hygiene education and role-specific technical instruction for each person.

Facility Design and Sanitation

Buildings must be large enough and organized well enough to prevent mix-ups and cross-contamination between raw ingredients, in-process materials, finished products, and packaging.² In practice, that means a logical flow so inbound raw materials never cross paths with outbound finished goods. Sanitation protocols for production surfaces and air handling must be written, followed, and documented. Equipment needs regular maintenance and calibration, with logs recording every adjustment, repair, and verification.

Raw Materials and Supply Chain

Raw materials must be identified, tested against specifications, and stored under controlled conditions. The standard calls for separate storage designations so that quarantined materials awaiting testing, accepted materials cleared for use, and rejected materials cannot be confused.² Every container should carry its identity, lot number, and control status. Outside suppliers need vetting, and climate-sensitive materials need storage that prevents chemical degradation. The result is a traceability chain running from supplier through final formulation.

Microbial Quality

ISO 22716 doesn’t set specific microbial count limits, but industry guidelines fill that gap. The widely followed CTFA (now PCPC) Microbiology Guidelines recommend no more than 100 colony-forming units per gram or milliliter for eye-area and baby products, and no more than 1,000 CFU/g for all other cosmetics. Four organisms are universally treated as unacceptable in any cosmetic: Pseudomonas aeruginosa, Staphylococcus aureus, Candida albicans, and Escherichia coli. Eye-area and infant products call for especially strict environmental monitoring and preservative efficacy testing.

Documentation to Have in Place Before You Book an Audit

Certification preparation is mostly a documentation exercise. You’ll need a copy of the ISO 22716 standard itself, available from the International Organization for Standardization or authorized distributors for roughly $150 to $200. From there, the work is building the written quality system.

Standard Operating Procedures are the backbone. Every major activity needs a written procedure: production steps, cleaning and sanitation, equipment calibration, product recalls, complaint handling, and deviation management. A Master Production Record should exist for each product, laying out formulation, ingredient quantities, equipment settings, and in-process checks for a standard batch. A batch numbering system inside those records must allow full traceability from raw material supplier to end consumer.

You also need to formally separate quality from production. The people reviewing batch records and approving product release cannot be the same people running the line, and internal auditors cannot audit their own areas of responsibility.² Environmental monitoring records for temperature, humidity, and air quality in storage and production zones round things out, along with safety data sheets for every chemical on-site.

Missing signatures, incomplete date fields, and gaps in training logs are what sink audits. Auditors read documentation for systemic weakness, so an organized record system reflects an organized operation. Plan several months for preparation if you’re building the quality system from scratch.

The Certification Audit

Once documentation is in place, you select an accredited third-party certification body (a registrar) to conduct the formal assessment. Choose one accredited by a recognized body such as ANAB, UKAS, or another International Accreditation Forum member. Audit fees typically run from $3,000 to $15,000 depending on facility size, number of product lines, and the registrar’s pricing. Get quotes from at least two before committing.

The audit itself runs in two stages:

Stage 1 is a documentation review. The auditor examines your written procedures, quality manual, training records, and batch documentation against ISO 22716 requirements. Some registrars do this partly on-site, some entirely as a desk review. Any documentation gaps identified here must close before Stage 2.
Stage 2 is the on-site assessment. The auditor watches manufacturing happen in real time, checks whether employees actually follow the procedures you’ve written, verifies sanitation logs against actual cleaning, and interviews production and quality staff. The point is to confirm that the written system functions on the floor.

After the site visit, findings go to the registrar’s technical review committee. No major nonconformities means a certificate valid for three years. Minor nonconformities can usually be handled through a corrective action plan within a set timeframe without blocking certification. Major nonconformities require a follow-up audit, adding cost and delay.

Keeping the Certificate

Certification is not one-and-done. Registrars conduct annual surveillance audits between full cycles to confirm continued compliance. These are narrower than the initial assessment but can still surface nonconformities requiring corrective action. Every three years, a full recertification audit reviews the entire quality system.

Between registrar visits, your own internal audits should run more frequently, staffed by people who don’t own the areas they’re reviewing.² Any problems found should feed into a Corrective and Preventive Action system that records root cause, the fix, and verification that the fix worked. Returning surveillance auditors will check whether previous findings were actually resolved.

The facilities that hold certification without scrambling are the ones treating GMP as daily operations. Real-time batch record review, rolling training schedules, and CAPA findings closed in weeks make the surveillance audit a confirmation rather than a discovery.

How MoCRA Changes the Picture for U.S. Manufacturers

Before MoCRA, cosmetic manufacturers could largely self-regulate their manufacturing quality. The FDA had no mandatory recall authority for cosmetics, no facility registration requirement, and no federal GMP mandate. MoCRA changed all three.¹

Under the law, every cosmetic facility must register with the FDA, and every responsible person (the manufacturer, packer, or distributor named on the label) must list each marketed cosmetic product and its ingredients with the agency, with listings updated annually.³ Responsible persons also have to maintain records substantiating the safety of each formulation and report serious adverse events to the FDA within 15 business days, with follow-up information on the same event due within another 15 business days if it surfaces within a year.¹ Adverse event records must be kept for six years, or three years for qualifying small businesses.⁴

MoCRA also directs the FDA to write formal GMP regulations consistent with recognized standards, and the agency’s existing guidance already draws on ISO 22716.² Practically, a facility built to ISO 22716 is positioned to meet what the federal rules will require. One point catches brand owners off guard: if your name is on the label, you are the responsible person under MoCRA even if a contract manufacturer actually produces the product. Registration and listing obligations follow the label, not the factory.

Small Business Exemption

MoCRA exempts small businesses (average U.S. gross annual cosmetic sales below $1,000,000 over the prior three years, adjusted for inflation) from facility registration, product listing, and GMP requirements.⁵ The exemption disappears, though, if you manufacture or process any of the following:

Products that regularly contact the mucous membrane of the eye under normal use.
Injectable cosmetic products.
Products intended for internal use.
Products meant to alter appearance for more than 24 hours where the consumer does not remove them as part of normal use.

One product in those categories pulls the whole facility and responsible person out of the exemption.¹ Serious adverse event reporting applies to everyone regardless of business size.

What Noncompliance Costs

The FDA can now order a mandatory recall when a cosmetic product presents a reasonable probability of causing serious health consequences or death and the company refuses to recall voluntarily. It can also suspend a facility’s registration if products from that facility present serious health risks due to a systemic failure, which effectively blocks the facility from selling anything in the United States until the suspension lifts.¹

Under the broader Federal Food, Drug, and Cosmetic Act, violations (which now include MoCRA requirements) can carry criminal penalties: up to one year in prison and a $1,000 fine for a first offense, rising to up to three years and $10,000 for repeat violations or violations committed with intent to defraud or mislead.⁶ The FDA can also seize adulterated or misbranded products through federal court. Lost retail accounts, broken supply contracts, and reputational damage from a suspension or recall usually cost more than the statutory penalties themselves.

1
U.S. Food and Drug Administration. Modernization of Cosmetics Regulation Act of 2022 (MoCRA)
2
Food and Drug Administration. Guidance for Industry – Cosmetic Good Manufacturing Practices
3
U.S. Food and Drug Administration. Registration and Listing of Cosmetic Product Facilities and Products
4
U.S. Food and Drug Administration. FDA Issues Draft Guidance for Industry – FDA Records Access Authority for Cosmetics Products
5
U.S. Food and Drug Administration. Guidance for Industry – Registration and Listing of Cosmetic Product Facilities and Products
6
Office of the Law Revision Counsel. 21 USC Chapter 9 Subchapter III – Prohibited Acts and Penalties