How to Audit Cosmetic OEM Factory Certificates and Audit Documents

A Certificate Is a Starting Point, Not a Supplier Approval

For a brand sourcing private-label skincare, a factory certificate is useful evidence—but it is not a product approval, a guarantee that every production line is in scope, or proof that the exact batch you will receive is controlled. A practical OEM audit asks a more specific question: does this legal entity, at this address, performing this activity, have current and traceable evidence for the product route you are buying?

The distinction matters. The U.S. FDA’s cosmetics GMP inspection checklist covers facilities, equipment, personnel, raw materials, production instructions, laboratory controls, records, labelling, and complaints. It also specifies that control records should cover materials, batch manufacture, finished-product controls, and distribution.1 A framed certificate does not replace those operating records.

This guide gives procurement teams a structured way to review certificates, audit reports, batch evidence, and corrective-action records before they approve a cosmetic OEM partner. For the broader supplier-selection sequence, first read the China low-MOQ OEM/ODM buyer guide, then map the initial commercial route through the Low-MOQ Private-Label Skincare hub.

The buyer’s objective is not to collect logos. It is to establish that the supplier’s certified or audited system matches the proposed facility, product, process, and project responsibilities.

Separate the Four Evidence Types Before You Review Them

Different documents answer different questions. Mixing them together is one of the fastest ways to overestimate a factory’s readiness.

Evidence type	What it can show	What it cannot prove by itself	Buyer check
Certificate	A named certification body issued a time-bound certificate for an identified legal entity, site, standard, and scope	That every product, line, claim, market, or current batch is covered	Confirm certificate number, legal entity, site address, scope, standard, issuer, issue/expiry dates, and status
Accreditation or registry result	Whether the certificate body and certificate can be validated in the relevant public system	That the factory’s operational controls work on your project	Search the certificate number or entity; retain a dated result or written confirmation
Customer or third-party audit report	Observations and findings from a defined audit scope at a point in time	A universal “pass” for all customers or future production	Review scope, date, auditor, site, findings, evidence sampled, and closure status
Batch and quality records	How a particular material, production run, test, release, deviation, or shipment was controlled	That an unrelated factory certificate is authentic or in scope	Sample controlled, redacted records that map to the proposed process and product family

Use the site’s Certifications page as a starting point for the factory’s public claims, then request the current source documents and scope details for the facility that will actually make the product.

Step 1: Verify the Certificate Is Authentic and Still Relevant

Ask for a readable certificate PDF rather than a low-resolution badge or a cropped photo. Record the certificate number, issuing certification body, standard, named legal entity, factory address, scope, issue date, expiry date, and any relevant product or manufacturing wording. A trading company name, group brand, or office address is not automatically the same as the production site.

Where the certificate is accredited and searchable, use a recognized registry or ask the certification body for written confirmation. The International Accreditation Forum’s CertSearch service describes validation of certification status, the certification body’s accreditation, and the accreditation body’s IAF MLA status for accredited management-system certifications.4 If a record cannot be located, do not assume fraud; request a current explanation from the supplier and issuer, then decide whether the remaining risk is acceptable.

Field to verify	Why it matters	Practical red flag
Legal entity	The company named on the certificate should match the manufacturer in your agreement and quality documents	A sales company, brand name, or parent group appears instead of the production entity
Site address	Certificates and audits are generally site-specific	The address differs from the manufacturing location or is omitted
Scope	Scope must cover the relevant activity, such as cosmetic manufacture, filling, packing, storage, or the intended product category	Generic “quality management” language without cosmetic or manufacturing scope
Standard and version	Buyers need to know what was actually assessed	An unclear “GMP” badge with no standard, scheme, or issue details
Certification body and accreditation	Issuer identity makes independent validation possible	No issuer, certificate number, accreditation context, or registry result
Dates and status	Certification is time-bound and can be suspended, expired, or superseded	Expiry date has passed, or the supplier sends an old certificate after saying it is current

For EU-facing projects, EN ISO 22716:2007 is listed by the European Commission as a harmonised standard reference under Regulation (EC) No 1223/2009.3 That makes it a meaningful GMP reference, but it does not by itself complete product safety assessment, Responsible Person, notification, labelling, claims, or other market obligations. Map those roles early through the Global Compliance for Cosmetics hub.

Step 2: Match the Audit Scope to Your Actual Supply Route

An audit report is most useful when its scope maps to the project you want to place. Ask who conducted it, whether it was announced or unannounced, which site and areas were visited, which records were sampled, which observations were raised, and whether corrective actions were verified closed.

The FDA notes that a cosmetics inspection may examine buildings, equipment, training, materials handling, production procedures, quality controls, warehousing, labelling, packaging, and complaint files.2 Your buyer audit does not need to replicate a regulatory inspection, but those areas are a sensible evidence map.

Audit area	Evidence to sample	Decision question
Supplier and material control	Approved-supplier list, incoming inspection, status labels, rejected-material segregation	Can the factory distinguish approved from rejected material and packaging?
Production and cleaning	Master formula, line clearance, equipment-cleaning status, batch instruction, in-process checks	Can the system prevent mix-ups between products, components, and labels?
Packaging and labelling	Artwork version control, component release, line-start checks, reconciliation, retain samples	Can the supplier control the exact bottle, pump, carton, and label version you approved?
Laboratory and release	Finished-product specification, test summary, release authorization, out-of-specification or deviation record	Who can release or block a batch, and what happens if a result is not accepted?
Traceability and complaints	Batch code, distribution record, retention samples, complaint procedure, CAPA	Can the factory trace a lot and demonstrate a documented response to an issue?

Use the Low-MOQ Samples to First Order: Timeline and Responsibility Matrix to assign who supplies, reviews, approves, and archives each item. This prevents an audit file from becoming an isolated procurement attachment with no operational owner.

Step 3: Request a Small, Controlled Evidence Pack

Do not ask a supplier to transmit every confidential procedure or raw formula. Instead, request a controlled evidence pack with sensitive details redacted where appropriate. The goal is to see how the system operates without taking ownership of confidential material.

Request	Why it is useful	What “good enough” looks like
Current certificate and validation route	Establishes issuer, scope, site, and status	Readable PDF plus registry result or issuer-confirmation path
Recent audit summary and CAPA status	Shows whether the supplier manages findings	Scope, date, finding classification, owner, target date, closure evidence
Redacted batch-manufacturing record	Tests whether formula, lot, process, controls, and release are traceable	One complete, legible example with controlled document ID and batch linkage
Packaging-control example	Tests label, component, and artwork discipline	Revision-controlled artwork or line-check record tied to a component code
Quality-release example	Shows how the factory decides a batch is saleable	Specification, test or inspection summary, release decision, authorized role
Deviation or complaint example	Reveals whether nonconformities are documented and learned from	A redacted record showing containment, root-cause approach, CAPA, and effectiveness check

FDA guidance specifically calls for controls over raw and primary packaging materials, batch manufacture, finished products, and distribution records.1 Use that framework to ask what the evidence connects, not merely whether a template exists.

Step 4: Treat “FDA,” “EU 1223/2009,” and Customer Audits Correctly

These labels are often used too broadly in sourcing conversations. FDA facility registration is not FDA approval of a cosmetic product. Likewise, a reference to EU Regulation 1223/2009 is not an ISO certificate, and a passed customer audit is not a substitute for market-specific documentation. The final status depends on the finished formula, packaging, claims, target market, assigned Responsible Person or importer, and the applicable documentation route.

When your project targets the EU or United States, pair the factory audit with the EU & US Cosmetics Export Compliance Guide. It distinguishes factory quality inputs from product-specific COA, SDS/MSDS, PIF, CPSR, CPNP, labelling, claims, and market-role responsibilities.

Common Certificate and Audit Red Flags

The following signals do not automatically mean a supplier is unsuitable, but each should trigger clarification before a purchase order is released.

1. The certificate does not name the manufacturing legal entity or facility address.
2. The scope is generic, expired, incomplete, or unrelated to the proposed cosmetic activity.
3. The supplier provides certificate logos but will not share a certificate number, issuer, or validity route.
4. An audit summary contains major findings without a dated corrective-action plan and closure evidence.
5. The factory cannot show how the approved formula, packaging artwork, batch code, release decision, and shipment record connect.
6. A supplier promises universal EU or U.S. compliance before reviewing the finished product, claims, pack, and market roles.
7. The sales quotation names one company while the certificate, invoice, or production site names another without documented role allocation.

Commercial transparency must sit beside quality evidence. Review the low-MOQ hidden-cost and lead-time guide before signing: it helps align factory scope, pack availability, sample approval, production readiness, yield, schedule, and chargeable changes.

A Release Gate Before You Approve a First Order

Before approving bulk production, hold a short documentation gate. Confirm the production entity, facility, certificate scope, audit status, formula version, packaging components, artwork revision, quality-release route, traceability method, acceptance criteria, and document ownership. Then carry the same evidence into the first-production acceptance and replenishment checklist so the brand can reconcile what was approved, made, released, delivered, and held for reorder.

If you want to review a potential project with SEYE, share your product format, target market, quantity, packaging status, claim direction, target launch window, and current audit expectations with the OEM project team.

Frequently Asked Questions

Is ISO 22716 certification enough to approve a cosmetic OEM factory?

No. ISO 22716 is a valuable GMP reference, but buyers should also verify the named legal entity, facility address, scope, certification status, audit findings, operational records, and project-specific responsibilities. It does not independently complete market, product-safety, labelling, claims, or documentation obligations.

How do I check whether a cosmetic factory certificate is genuine?

Request the full certificate and verify the certificate number, issuing certification body, accreditation context, legal entity, factory address, scope, and issue and expiry dates. Where available, use the issuer’s verification route or an appropriate public certification registry and retain a dated record of the check.

What should a cosmetic OEM audit report include?

A useful report identifies the auditor, audit date, legal entity, site address, scope, areas visited, records sampled, findings, risk classification, corrective-action owners, target dates, and closure or follow-up status. Ask for an explanation if any of these are missing.

Is FDA registration the same as FDA approval for cosmetics?

No. FDA facility registration is not approval of a cosmetic product. It should not be presented as a general product endorsement or as a substitute for safety, labelling, quality, and market-specific obligations.

Can a buyer request batch records from a cosmetic OEM?

Yes, a buyer can request controlled or redacted examples to assess traceability and operating discipline. The supplier may protect confidential formula details, but should be able to show how approved materials, process controls, batch codes, tests, deviations, release, and distribution records connect.

How often should an OEM factory be re-audited?

Set the cadence according to product risk, market, performance, changes, complaint history, audit findings, and business exposure. Reassess earlier when the factory, formula, component, process, ownership, scope, or target market changes materially.

References