To audit a cosmetics factory before you sign, check four things on site: that its quality system works day to day and not just on paper, that it can trace a real shipped batch back to its raw-material lots, that its premises and equipment suit your product type, and that it fixes problems through documented corrective action. A certificate on the wall proves an audit happened once; your audit shows how the factory runs now. This checklist covers OEM and ODM skincare, haircare and colour-cosmetics manufacturers in any country, measured against ISO 22716 cosmetic GMP. It is not a certification audit and does not replace a regulatory inspection. Next step: send the pre-audit questionnaire below two weeks before you visit.
Key takeaways
- Audit the system, not the tour. The production floor on audit day is usually tidy. The batch records, deviation log, complaint file and calibration records show what happens on the other 364 days.
- Run a live traceability test. Pick a batch the factory shipped in the last six months and ask them to show every raw-material lot, test result and retained sample behind it. A good factory does this in under two hours.
- Grade every finding as critical, major or minor. One critical finding, such as falsified records or no microbiological release testing, should stop the deal. Minor findings are normal and should go into a corrective-action plan with dates.
- Write the right to re-audit into the contract. An audit is a snapshot. The supply agreement should let you audit again, with notice, and should oblige the factory to tell you about major changes.
Who is this checklist for?
This checklist is for brand owners, sourcing managers and quality leads who are about to commit to a cosmetics OEM (Original Equipment Manufacturer) or ODM (Original Design Manufacturer), or who want to re-check a factory they already use. It fits best after you have shortlisted two or three factories on paper and before you pay a development deposit or sign the supply agreement. If you have not yet screened the paperwork, start with our list of documents to request from a manufacturer and our review of the certifications a quality cosmetics factory should hold. If you are still building a shortlist, the oemhallmark manufacturer directory is a good place to begin.
What is a cosmetics factory audit, and when do you need one?
A cosmetics factory audit is a structured check of a manufacturer’s premises, processes and records against a defined standard, usually ISO 22716 cosmetic Good Manufacturing Practice (GMP), carried out by or for the brand that will buy from it. Auditors call this a second-party audit: you, the customer, are checking your supplier. It is different from a third-party certification audit, where an accredited body checks the factory for its own certificate, and from a regulator’s inspection.
Why bother if the factory already holds an ISO 22716 certificate? Because a certificate tells you the factory passed an audit on a particular date, against a scope it chose. It does not tell you whether that scope covers your product type, whether the site you visited is the site on the certificate, or whether standards have slipped since. If you are unsure how GMP and the ISO standard relate, our guide to cosmetic GMP and ISO 22716 explains the difference.
The law also puts this on you, directly or indirectly. In the EU, Article 8 of Regulation (EC) No 1223/2009 requires cosmetics to be made in compliance with GMP, and compliance is presumed where the harmonised standard (EN ISO 22716) is followed; the brand acting as Responsible Person must state GMP compliance in the Product Information File. The UK applies the same rule through the Cosmetic Products Enforcement Regulations 2013 and the retained regulation. In the US, the Modernization of Cosmetics Regulation Act (MoCRA) requires FDA to set cosmetic GMP regulations; until those are final, FDA’s 2013 draft guidance on cosmetic GMP, which drew on ISO 22716, is the best public indication of what FDA inspectors look for (both pages checked 25 September 2026).
There are four ways to run the check. The table compares them.
| Audit route | What it proves | What it misses | Typical time | Best when |
|---|---|---|---|---|
| Desk audit (questionnaire + documents) | The factory has a documented system and will share it | Whether anyone follows the documents | 1–2 weeks elapsed | Early screening of 5–10 candidates |
| Remote video audit | Premises exist and roughly match the claims; records can be shown on camera | Smells, cleanliness close up, what is off-camera | Half a day | Low-risk products, or travel is not possible |
| On-site audit by your own team | How the factory actually works, and how it responds to questions | Depth, if your team lacks GMP experience | 1–2 days on site | Final 2–3 candidates; you have a quality person |
| On-site audit by a hired auditor | Same as above, with a professional report you can file | Your own feel for the people and communication | 1–2 days on site plus report | Overseas factories, eye/baby/sun products, first large order |
For a first order with a new factory, especially one overseas, we recommend a desk audit for everyone on the shortlist and an on-site audit for the one you intend to sign with. Our guide to vetting an overseas cosmetics manufacturer covers the earlier screening steps.
What should you prepare before the audit?
Preparation decides the quality of the audit: agree the scope and agenda in writing, collect the factory’s documents in advance, and read them before you arrive so the site time goes on checking, not reading. Most weak audits fail here. The visitor arrives with no agenda, gets a guided tour and a presentation, and leaves with nothing they could not have learned from the brochure.
Two to three weeks before the visit:
- Confirm the site. Get the full address of the building where your product will be made and filled, and check it against the address on every certificate. Some suppliers show visitors one site and produce at another, or subcontract filling. If you suspect you are dealing with an intermediary, read factory vs trading company vs sourcing agent first.
- Send a pre-audit questionnaire. Ask for the organisation chart, product types made, batch sizes, equipment list, number of production and QC staff, subcontracted activities, certificates with scope and expiry, and the date and outcome of the last regulatory inspection or certification audit.
- Request the site master file, if one exists. A site master file is a short document describing the site, its layout, utilities and quality system. Regulators such as Singapore’s HSA ask for one before a cosmetic GMP certification audit (checked 25 September 2026), so a well-run factory usually has one ready.
- Send the agenda. List the areas you will cover (the checklist in the next section), the records you want to see, and one request for the traceability test described below, without naming the batch in advance.
- Decide who goes. Ideally a person with GMP or QC experience plus someone who can judge the commercial side. If nobody on your team has run an audit, hire an auditor for the first one and shadow them.
On the day, the factory’s head of quality, not only the sales manager, should be available for the whole visit. If the factory will not commit to that, note it: it tells you who holds power inside the business.
The factory audit checklist: what should you check in each area?
Check each of the ten areas below by comparing what the procedure says, what the records show and what you see on the floor; a gap between any two of those is a finding. The areas follow the structure of ISO 22716, which covers personnel, premises, equipment, raw materials and packaging, production, finished products, the quality-control laboratory, out-of-specification results, waste, subcontracting, deviations, complaints and recalls, change control, internal audit and documentation.
| Area | What to look at | Evidence to ask for | Red flag |
|---|---|---|---|
| 1. Personnel and hygiene | Gowning, hand washing, hair and jewellery rules at the entrance to production | Training records for two operators you pick at random; hygiene procedure | Operators cannot describe what they were trained on; no records |
| 2. Premises and flow | Separation of raw materials, weighing, compounding, filling and finished goods; one-way flow of people and materials | Site layout; cleaning schedules and completed logs | Open drains, peeling paint over open product, pests or bait stations never checked |
| 3. Equipment and cleaning | Vessels, mixers and filling heads; status labels showing “clean” or “in use” | Cleaning and sanitisation records for the last batch on one line; cleaning validation or rinse-test data | No status labels; cleaning “done” but no record of what, when or by whom |
| 4. Calibration and maintenance | Balances, pH meters, viscometers, thermometers | Calibration certificates and in-house check logs; maintenance plan | Expired calibration stickers on instruments used for release decisions |
| 5. Water system | How purified water is made, stored and distributed | Microbiological monitoring results for the last 3–6 months; sanitisation records | No routine micro testing of water, or repeated failures with no investigation |
| 6. Raw materials and packaging | Receiving, quarantine, sampling and approved status; storage conditions | Approved supplier list; incoming inspection records; certificates of analysis for one material | Materials used before release; no quarantine area; relabelled drums with no traceable origin |
| 7. Production and batch records | A batch being made, if possible; the master formula and the executed batch record | A completed batch record from the last month | Blank fields, entries written after the event, figures that do not add up |
| 8. QC laboratory and release | Tests run on bulk and finished product; microbiology in-house or outsourced | Specifications; test results for a released batch; out-of-specification investigations | No microbiological release test; results that are always exactly on target |
| 9. Deviations, complaints and CAPA | How problems are recorded, investigated and closed | Deviation log and complaint log for the last 12 months; two closed corrective and preventive actions (CAPA) | An empty deviation log (no factory has zero deviations); complaints with no root cause |
| 10. Change control, subcontracting and internal audit | How changes to formula, supplier or process are approved; who else does work for the factory | Change-control log; subcontractor list and agreements; last internal audit report | Raw-material suppliers swapped without telling customers; no internal audit in the last year |
Two areas deserve extra time for most brands. The water system matters because water is the main ingredient of most emulsions and the most common source of microbial contamination. The QC laboratory matters because it is where a batch is released or rejected. Our article on quality control best practices in cosmetics manufacturing explains what good release testing looks like, and what stability testing involves is worth reading before you review the laboratory’s stability data.
Adjust the checklist to your product. For products used around the eyes, on babies or on broken skin, look harder at microbiology, preservative-efficacy data and filling-room hygiene. For sunscreens, check how SPF batches are controlled and whether the factory makes the same product as a drug or quasi-drug for other markets, which usually means tighter controls. For powders and colour cosmetics, check dust control and cross-contamination between shades.
How do you run a traceability test during the audit?
A traceability test asks the factory to reconstruct the full history of one shipped batch, from the finished-goods batch code back to every raw-material and packaging lot, the test results and the retained sample, while you watch. It is the single most revealing hour of an audit, because it tests the documentation, the storage system and the people at the same time, and it is hard to stage.
How to run it:
- On the day, pick a finished-goods batch the factory shipped four to six months ago. Choose it yourself from the dispatch log or a finished-goods label; do not accept one they suggest.
- Ask for the executed batch record, the bulk and finished-product test results, and the release signature.
- From the batch record, pick two raw materials and one packaging component. Ask for the receiving records, the supplier’s certificate of analysis and the factory’s own incoming test for those exact lots.
- Ask to see the retained sample of the finished batch in the retention store.
- Ask which customers received that batch and in what quantities. This is the information a recall would need.
A well-run factory completes this in one to two hours without panic. If records cannot be found, if the retained sample is missing, or if lot numbers in the batch record do not match the receiving log, that is a major finding at least. For how batch codes and retained samples fit together, see the meaning of shelf life, PAO and batch codes. The same records are what you will rely on if a customer reports a reaction, as our guide to cosmetovigilance explains.
Which audit findings should stop the deal?
Grade every finding as critical, major or minor, and treat any critical finding as a reason not to sign until it is fixed and re-checked. Grading keeps the discussion objective. Without it, a factory can argue that ten small issues are nothing, or a nervous buyer can walk away over a missing signature.
| Grade | Definition | Examples | What to do |
|---|---|---|---|
| Critical | A direct risk to consumer safety, or evidence that records cannot be trusted | Falsified or back-dated records; no microbiological release testing; product released before test results; banned or undeclared materials in use | Do not sign. Re-audit only after written corrective action and evidence |
| Major | A significant GMP failure that could affect product quality if it continues | Traceability test failed; no water monitoring; out-of-specification results released without investigation; no change control | Sign only with a CAPA plan, deadlines and follow-up evidence, ideally a follow-up visit |
| Minor | An isolated lapse with low direct risk | One expired calibration label on a non-critical instrument; a missing signature; a small housekeeping issue | Record it; ask for correction by the next order |
Two further signals matter as much as the findings. The first is transparency: a factory that shows you a real deviation log with honest entries is safer than one that claims nothing ever goes wrong. The second is response: ask how the last major customer or certification finding was handled. A factory that can show you the root-cause analysis, the fix and the check that the fix worked has a working quality system.
What should happen after the audit?
After the audit, write a short report within a week, agree a corrective-action plan with the factory, and carry the key conditions into the supply contract. An audit that ends with a handshake and no document has little value in six months’ time, and none as evidence if a regulator asks how you chose your manufacturer.
The report needs only five parts: scope and date, who attended, findings graded critical, major or minor, the factory’s agreed actions with deadlines, and your conclusion (approved, approved with conditions, or not approved). Keep it with the Product Information File or your supplier-qualification records.
Then protect the result in the contract. Our review of what a good manufacturing contract looks like covers the wider agreement; the audit-related clauses to add are:
- the right to audit, with reasonable notice, and a for-cause audit right after a serious complaint or recall;
- an obligation to notify you before changing the production site, a key raw-material supplier, the formula or the process;
- a named quality contact and a time limit for answering quality questions;
- access to batch records, certificates of analysis and retained samples for your batches for at least the shelf life plus one year;
- a duty to tell you about regulatory inspections that affect your products and their outcome.
How often should you re-audit? For most brands, every one to two years, plus a for-cause audit after a serious complaint, a failed batch or a move to a new site or line. Re-audit sooner when volumes jump, since what works at pilot scale does not always hold at full scale, as our explainer on scale-up in cosmetics manufacturing shows. If an audit reveals problems the factory will not fix, our guide to switching cosmetics manufacturers without losing your formula covers the exit.
What mistakes do brands make when auditing a factory?
The most common audit mistake is letting the factory run the agenda, which turns an audit into a sales tour. Others we see often:
- Auditing the showroom line. Ask to see the line and filling equipment your product will actually use.
- Reading certificates without the scope. An ISO 22716 certificate for “manufacture of hair products” does not cover your sunscreen. Check the site address, scope and expiry, and confirm the certification body is accredited.
- Checking only the procedures. A thick quality manual proves the factory can write. Records and the floor prove it can follow them.
- Accepting a pre-selected batch for traceability. Always choose the batch yourself.
- Ignoring subcontractors. If microbiology testing, filling or labelling is done elsewhere, those sites are part of your supply chain too.
- Not writing anything down. Without a graded report and a CAPA plan, nothing gets fixed and nothing can be proven later.
Frequently asked questions
How much does a third-party cosmetics factory audit cost?
Costs vary by country, auditor and scope. As an editorial planning estimate, a one-day on-site GMP audit by an independent auditor or inspection company often costs from several hundred to a few thousand US dollars, plus travel and report writing. Ask two or three auditors for a quote against the same written scope, and confirm they have cosmetic GMP (ISO 22716) experience rather than only general ISO 9001 experience.
Is an ISO 22716 certificate enough, or do I still need to audit?
A valid certificate is a strong starting point but not a substitute for your own check. It shows the factory passed a certification audit on a date and scope of its choosing. Your audit confirms the scope covers your product, the site matches, and the system still works. For low-risk products and small first orders, a desk audit plus a remote video audit may be enough.
Can I audit a factory remotely?
Yes, for part of the work. A remote audit by live video can confirm the premises exist, show storage and production areas, and let you review records on screen. It cannot show cleanliness up close or what is off-camera, so treat it as a screening step. Use an on-site audit before a large order or for eye, baby or sun products.
Will a factory refuse to let me audit?
Reputable factories expect customer audits and usually agree once you are a serious prospect, sometimes after a non-disclosure agreement. Some limit access to other clients’ formulas or areas, which is reasonable. A flat refusal to allow any visit or document review, or constant postponement, is a warning sign that you may be dealing with a trading company or a site that would not pass.
What is the difference between a GMP audit and a social compliance audit?
A GMP audit checks product quality and safety systems, following standards such as ISO 22716. A social compliance audit checks labour conditions, working hours, wages and health and safety, often against schemes such as SMETA or amfori BSCI. They answer different questions. Retail buyers may ask for both, so ask the factory which audits it already holds before you commission new ones.
How long does a cosmetics factory audit take?
A desk audit usually takes one to two weeks of back-and-forth. An on-site audit of a small or mid-sized cosmetics factory usually takes one day, and two days for a large multi-line site or when you add a traceability test and laboratory review. Allow another week for the report and the factory’s corrective-action plan.
Sources and limitations
This checklist draws on primary sources checked on 25 September 2026: the European Commission’s cosmetics legislation page (Regulation (EC) No 1223/2009, Article 8 on GMP); the UK Cosmetic Products Enforcement Regulations 2013 on legislation.gov.uk; the US FDA’s MoCRA page and its June 2013 draft guidance on cosmetic GMP, which FDA says it intends to withdraw or revise once MoCRA GMP rulemaking is done; HSA Singapore’s cosmetic GMP certification page and its ASEAN Cosmetic Directive page. ISO 22716:2007 (cosmetic GMP) and ISO 19011 (guidelines for auditing management systems) are named rather than linked because the ISO website blocked our automated link checks. The checklist, grading table and cost and time ranges are editorial planning aids prepared by oemhallmark, not a certification scheme, and we did not audit any factory for this article. Requirements differ by market and product type; for high-risk products, use a qualified GMP auditor.
This article is general information for beauty brand owners and sourcing teams and is not legal, regulatory or quality-certification advice. Confirm current GMP requirements with the authority in each market where you sell.