A microbial limit test and a preservative challenge test answer different questions, and a cosmetic needs both. The limit test counts the microorganisms already in one finished batch against limits such as ISO 17516: 100 CFU per gram for eye-area, mucous-membrane and under-three products, 1,000 for the rest. The challenge test, usually ISO 11930, deliberately contaminates the formula with five organisms and measures over 28 days whether the preservative system kills them. This comparison covers water-containing skincare, hair care and makeup made by contract manufacturers in any market. Low-risk formats such as anhydrous balms may be exempt, and limits differ in ASEAN and the US. Ask your factory for both reports before approving a first batch.
Key takeaways
- One test is about the batch, the other is about the formula. A limit test is a snapshot of how clean one production batch is on the day it was sampled. A challenge test is a 28-day stress test of whether the formula can defend itself after the consumer opens it. Passing one says nothing about the other.
- The limit test repeats; the challenge test is done once per formula and pack. Expect a limit test on every batch released. Expect a challenge test at development, and again whenever the preservative system, pH, water phase or packaging changes.
- A clean batch can still fail in the bathroom. A product filled hot in a sanitised line can show under 10 CFU/g at release and still grow mould after six weeks of wet fingers if the preservative is too weak. Only the challenge test catches that.
- “Criteria B” is a conditional pass. Under ISO 11930 a formula that meets Criteria B but not Criteria A is acceptable only with a documented risk assessment, typically protective packaging such as an airless pump or a single-dose pack.
- Limits are not identical worldwide. ISO 17516 and EU practice use 100 and 1,000 CFU per gram with absence of four organisms in 1 g. The ASEAN guideline uses 500 and 1,000 with absence of three organisms in 0.1 g. Specify the stricter of your target markets in the product specification.
Who is this comparison for?
This article is for brand owners, product developers and sourcing managers who buy finished cosmetics from an OEM (original equipment manufacturer) or ODM (original design manufacturer) and receive test reports they are expected to approve. It will help you decide which microbiological test to request at which stage, read the result, and spot a report that does not prove what the factory says it proves. It is not a laboratory method. If you are still building your overall test plan, start with our checklist of cosmetic product testing before the first batch and come back here for the microbiology.
What is the difference between a microbial limit test and a challenge test?
A microbial limit test measures contamination that is already present; a challenge test measures resistance to contamination that will arrive later. The first is quality control of manufacturing hygiene. The second is validation of formulation design. Both are reported in CFU (colony-forming units), which is why they are often confused.
In a microbial limit test (also called microbial enumeration, bioburden or “micro release” testing) the laboratory takes a sample of the finished batch, neutralises the preservative, plates the sample on growth media and counts the colonies after incubation. It also runs enrichment tests to confirm that specific harmful species are absent. The result is compared with a limit.
In a preservative challenge test (preservation efficacy test, PET, or antimicrobial effectiveness test) the laboratory adds a large, known number of five reference organisms to separate portions of the product, stores them at room temperature, and counts the survivors at 7, 14 and 28 days. The result is a log reduction: how many powers of ten the population fell.
| Point of comparison | Microbial limit test | Preservative challenge test |
|---|---|---|
| Question answered | Is this batch clean enough to release? | Can this formula protect itself during use? |
| What is tested | One production batch, as made | The formula in its final composition, ideally in or with its final pack |
| Main standard | ISO 17516 (limits); ISO 21149, 16212, 22717, 22718, 21150 and 18416 (methods) | ISO 11930; alternatives include USP <51> and Ph. Eur. 5.1.3 |
| How the result is expressed | CFU per g or ml, plus “absent / detected” for specified organisms | Log reduction per organism at each time point; Criteria A, B or fail |
| Frequency | Every batch (or a justified reduced plan for low-risk products) | Once per formula and pack; repeated after a relevant change |
| Laboratory time (typical) | About 5–7 working days | 28 days of incubation; about 5–7 weeks door to door |
| Indicative cost per sample (illustrative, varies by lab and market) | USD 50–150 | USD 300–900 |
| Who normally pays | Factory, inside the unit price | Brand at development, or factory for its own stock formulas |
| What a pass does not prove | That the product stays clean after opening | That any particular batch was made hygienically |
The time and cost rows are planning ranges we chose to show the order of magnitude, not quotations from a named laboratory. The 28-day incubation, by contrast, is fixed by the method.
What does a microbial limit test measure, and what are the limits?
A microbial limit test measures the total number of aerobic bacteria, yeasts and moulds in a gram or millilitre of finished product and confirms that named harmful species are absent. The international reference is ISO 17516:2014, Cosmetics — Microbiology — Microbiological limits, which sets two tiers.
- Products for children under three, the eye area or mucous membranes: total aerobic mesophilic microorganisms (bacteria plus yeast and mould) of no more than 1 × 10² CFU per g or ml.
- All other products: no more than 1 × 10³ CFU per g or ml.
- Both tiers: Escherichia coli, Pseudomonas aeruginosa, Staphylococcus aureus and Candida albicans absent in 1 g or 1 ml.
Plate counting is imprecise at low numbers, so the standard’s note treats a result as out of limit only above 200 CFU for the 10² tier and above 2,000 CFU for the 10³ tier. That allowance is for measurement variability. It is not a looser specification, and a factory that routinely reports 150 CFU/g on an eye cream has a hygiene trend worth questioning even though each result passes.
The European Commission’s scientific committee uses the same two categories and the same figures in the SCCS Notes of Guidance (12th revision), and Annex I of Regulation (EC) No 1223/2009 requires the safety report to contain the microbiological specifications of the product and the results of the preservation challenge test. Other markets differ, as the table shows (all sources checked 13 November 2026).
| Framework | Count limit: under-three, eye area, mucous membranes | Count limit: other products | Specified organisms | Challenge test expectation | Source |
|---|---|---|---|---|---|
| ISO 17516:2014 (international) | ≤ 100 CFU per g or ml | ≤ 1,000 CFU per g or ml | E. coli, P. aeruginosa, S. aureus, C. albicans absent in 1 g or ml | Not covered; refers to ISO 11930 and ISO 29621 | ISO catalogue |
| European Union | ≤ 100 CFU per g or ml | ≤ 1,000 CFU per g or ml | Same four, not detectable in 1 g or ml | Result required in the safety report (Annex I, Part A) | Regulation 1223/2009; SCCS Notes of Guidance |
| Great Britain | ≤ 100 CFU per g or ml (by reference to the same standards) | ≤ 1,000 CFU per g or ml | Same four | Result required in the safety report | UK cosmetics regulation as retained; gov.uk guidance |
| ASEAN | ≤ 500 CFU per g or ml | ≤ 1,000 CFU per g or ml | P. aeruginosa, S. aureus, C. albicans absent in 0.1 g or ml; list stated as not exhaustive | Expected in the product information file safety assessment | ASEAN Guidelines on Limits of Contaminants for Cosmetics |
| United States | Not disclosed in regulation | Not disclosed in regulation | No fixed list; product must not be adulterated | No mandated method; safety substantiation is the firm’s responsibility | FDA cosmetics pages; Bacteriological Analytical Manual, Chapter 23 |
The ASEAN figures come from the ASEAN Guidelines on Limits of Contaminants for Cosmetics published through Singapore’s Health Sciences Authority, whose ASEAN Cosmetic Directive page hosts the current documents. In the United States there is no numeric limit in the regulations: the FDA states on its microbiological safety page that companies are responsible for keeping products free from harmful microorganisms and that microbial contamination is a common reason for cosmetic recalls, and it publishes its own laboratory methods in Chapter 23 of the Bacteriological Analytical Manual.
Our view: write the ISO 17516 figures and 1 g sample size into the specification even for ASEAN-only or US-only products. They are the strictest of the published sets on the sensitive tier, laboratories everywhere can run them, and one specification then serves every market you may enter later. The limits belong on the certificate of analysis; our tutorial on reading a cosmetic spec sheet and COA shows where to find them.
Specified organisms are a minimum, not the whole list
The four named species are indicators. Water-borne bacteria of the Burkholderia cepacia complex are not on the ISO list, yet they tolerate many preservatives and are a recurring cause of recalls in water-based products. A competent factory identifies any Gram-negative colony it recovers instead of reporting only a number, and controls its purified-water system as the most likely source. Ask what the laboratory does when a count is within limit but the colonies look unusual.
How does a preservative challenge test work?
A challenge test inoculates the product with a high dose of five reference organisms and counts the survivors at set intervals to prove that the preservative system, the formula and the pack together keep the product safe in use. The cosmetic-specific method is ISO 11930:2019, Evaluation of the antimicrobial protection of a cosmetic product.
The five organisms are three bacteria (Pseudomonas aeruginosa, Staphylococcus aureus, Escherichia coli), one yeast (Candida albicans) and one mould (Aspergillus brasiliensis). Each is added to its own portion of product at roughly 10⁵ to 10⁶ CFU per g for bacteria and 10⁴ to 10⁵ for yeast and mould, far above anything a consumer would introduce. The portions are held at room temperature and sampled at 7, 14 and 28 days. The standard then applies two sets of acceptance criteria.
| Organism group | Criteria A: day 7 | Criteria A: day 14 | Criteria A: day 28 | Criteria B: day 14 | Criteria B: day 28 |
|---|---|---|---|---|---|
| Bacteria (three species) | ≥ 3 log reduction | ≥ 3 log and no increase | ≥ 3 log and no increase | ≥ 3 log reduction | ≥ 3 log and no increase |
| Yeast (C. albicans) | ≥ 1 log reduction | ≥ 1 log and no increase | ≥ 1 log and no increase | ≥ 1 log reduction | ≥ 1 log and no increase |
| Mould (A. brasiliensis) | Not assessed | No increase from the inoculum (≥ 0 log) | ≥ 1 log and no increase | No increase from the inoculum (≥ 0 log) | ≥ 0 log and no increase |
This table is our condensed reading of the criteria in Annex B of ISO 11930; the standard itself allows a small measurement deviation and is the authority on exact wording. A 3 log reduction means 99.9% of the organisms died; 1 log means 90%.
Meeting Criteria A means the formula is considered protected on its own. Meeting only Criteria B means it is protected provided a documented risk assessment shows that something else limits contamination in use, most often the pack. Meeting neither is a failure and the formula must be reworked.
A worked example: one cream, five organisms
The figures below are illustrative, built to show how a report is read. They are not data from a real product.
| Organism | Inoculum (CFU/g) | Day 7 count and log reduction | Day 14 count and log reduction | Day 28 count and log reduction | Result |
|---|---|---|---|---|---|
| P. aeruginosa | 5.0 × 10⁵ | 2.0 × 10² (3.40) | < 10 (> 4.70) | < 10 (> 4.70) | Meets A |
| S. aureus | 6.3 × 10⁵ | 5.0 × 10² (3.10) | < 10 (> 4.80) | < 10 (> 4.80) | Meets A |
| E. coli | 4.0 × 10⁵ | 1.0 × 10² (3.60) | < 10 (> 4.60) | < 10 (> 4.60) | Meets A |
| C. albicans | 5.0 × 10⁴ | 2.5 × 10³ (1.30) | 4.0 × 10² (2.10) | < 10 (> 3.70) | Meets A |
| A. brasiliensis | 4.0 × 10⁴ | Not assessed | 2.5 × 10⁴ (0.20) | 1.0 × 10⁴ (0.60) | Meets B only |
Four organisms pass comfortably, but the mould fell by only 0.60 log at day 28 against the 1 log that Criteria A requires. The overall verdict is therefore Criteria B, because a formula is graded on its weakest organism. In a jar, this cream needs a stronger mould defence. In an airless pump with a justified risk assessment, it may be acceptable as it stands. A report summary that says only “pass” hides exactly this decision, so always read the table, not the conclusion. Weak mould results are also the typical pattern in formulas marketed with reduced or “alternative” preservation, a trade-off we cover in our piece on clean and sustainable claims in cosmetics OEM.
When do you need each test?
You need a challenge test before the formula is approved and a limit test before each batch is released, with a repeat challenge test whenever a change could weaken preservation. The triggers below are the ones buyers most often miss.
| Stage or event | Microbial limit test | Preservative challenge test | Why |
|---|---|---|---|
| Lab sample approved, before stability starts | Optional | Yes, on the final formula | A failure here costs weeks; a failure after artwork is printed costs the launch date |
| Stability study (end of accelerated or real-time storage) | Yes, at each pull point | Recommended on aged samples | Preservatives can degrade, migrate into packaging or be bound by other ingredients over time |
| Pilot or first production batch | Yes | Only if process conditions differ from the lab sample | Confirms that scale-up did not introduce contamination |
| Every routine production batch | Yes, before release | No | Batch hygiene varies; formula design does not |
| Change of preservative, pH, water content, chelating agent or a high-load botanical | Yes | Yes, repeat | Each of these changes how much preservative is available in the water phase |
| Change of pack type (for example tube to jar, or pump to dropper) | Routine only | Reassess; repeat if protection was part of the justification | A Criteria B result justified by an airless pack does not transfer to a jar |
| Moving the formula to a new factory | Yes, on the first batches | Yes, unless raw materials and process are demonstrably identical | Different raw-material grades and water systems change the result |
| Consumer complaint of smell, separation, gas or visible growth | Yes, on the retained sample and the returned unit | Consider, if more than one batch is affected | Distinguishes a one-batch hygiene lapse from a formula weakness |
The stability row matters more than most briefs allow for. A challenge test passed on a fresh sample tells you about day one; the same test on a sample that has spent three months at 40°C tells you about the end of shelf life. If the budget allows only one extra test, that is the one to buy. Our stability testing explainer describes the storage conditions, and the article on shelf life, PAO and batch codes explains how the results feed the period-after-opening symbol. For the new-factory row, see how to switch cosmetics manufacturers without losing your formula.
Which products can skip microbiological testing?
Products whose composition or process makes microbial growth implausible can be classed as microbiologically low risk and exempted from routine testing, but only through a written risk assessment. The reference is ISO 29621, which lists the factors an assessor may rely on:
- Low water activity: anhydrous balms, oils, waxes, pressed and loose powders, and lipsticks, where too little free water is available for growth (commonly cited as a water activity of about 0.75 or below).
- Extreme pH: about 3 or below, or about 10 or above, as in some peels, depilatories and hair relaxers.
- High alcohol: around 20% ethanol or more, as in fragrances and many toners and sanitising products.
- Hot filling: filling at around 65°C or above, as with poured sticks and some balms.
- Hostile raw materials: oxidising hair dyes, strong reducing agents, propellants and some solvents.
- Protective packaging: single-dose units and pressurised or airless systems that keep the consumer’s fingers and bathroom air out.
Three cautions. First, low risk is a conclusion about a specific formula, not a category: a “balm” containing a water-based botanical extract or a powder used with a wet sponge is no longer low risk. Second, the exemption has to be written down and signed by whoever is responsible for product safety; the absence of a test report is not evidence of an exemption. Third, protective packaging lowers risk in use but does nothing for contamination introduced during manufacture, so batch limit testing normally continues. Pack choices that support the argument are compared in our guide to cosmetic packaging and filling options.
What should you ask your manufacturer for?
Ask for the challenge test report on your exact formula, the microbiological specification, and the limit test result for each batch, and check that each document names the product, the method and the laboratory. A reliable factory supplies all three without negotiation.
| Document | What it should show | Red flag |
|---|---|---|
| Challenge test report | Your formula code and version; method (ISO 11930 or equivalent); all five organisms; counts and log reductions at each time point; Criteria A or B stated; laboratory name and date | A report for a “similar” base formula; fewer than five organisms; a bare “pass” with no data; a date older than the last formula change |
| Risk assessment (if Criteria B or low-risk exemption) | The factor relied on (pack, water activity, pH, alcohol), with the measured value and the name of the assessor | “Not required for this product type” with nothing in writing |
| Microbiological specification | Count limit, list of specified organisms, sample size (1 g or 0.1 g) and test methods | Limits quoted without a method, or a single limit applied to an eye-area or baby product |
| Batch certificate of analysis | Actual counts (for example “< 10 CFU/g”), each specified organism reported separately, batch number and test date | “Complies” in every field; results issued on the same day the batch was filled |
| Water system records | Routine microbial counts on purified water and the action taken when a result was high | No trend data, or testing only when a customer asks |
| Laboratory status | Whether testing is in-house or external, and whether the laboratory is accredited to ISO/IEC 17025 for these methods | Unwillingness to name the external laboratory |
Five questions settle most doubts in a single call:
- Was the challenge test run on my formula as it will be manufactured, including my fragrance and my actives, or on your base?
- Did it meet Criteria A or Criteria B, and if B, what is the written justification?
- Do you test every batch before release, and do you ship before the result is back?
- Which organisms do you test for beyond the standard list, and how do you identify an unexpected colony?
- What happens to a batch that fails: is it destroyed, and will I be told?
The third question exposes the most common shortcut. Limit testing takes about a week, and a factory under delivery pressure may ship “at risk” before the result arrives. Make release-after-results a contract term. These checks sit inside the wider quality system described in our guide to cosmetic GMP and ISO 22716 for brand owners, and you can verify the laboratory, the water system and the retained-sample room in person using the factory audit checklist. When you are shortlisting, the OEM Hallmark manufacturer directory lists factories with their stated certifications so you can ask these questions of several at once.
Which mistakes do brands make with microbiological testing?
The costliest mistakes come from treating one test as a substitute for the other or accepting a report that does not match the product being sold.
- Accepting the base-formula report. Adding a botanical extract, a protein, a clay or a new fragrance to a stock base can bind or dilute the preservative. The base passed; your variant has not been tested.
- Testing only the fresh sample. Preservative levels can fall during storage. A formula that scrapes through Criteria A when new can fail after three months at elevated temperature.
- Reading “pass” without reading the criteria. A Criteria B result is a pass with a condition attached. If the condition is an airless pump and you later move to a jar, the pass no longer applies.
- Assuming a preservative-free claim removes the need. It increases it. A product without listed preservatives still has to show protection, through its water activity, pH, multifunctional ingredients or pack, and the challenge test is how that is shown.
- Applying the general limit to a sensitive product. Eye creams, mascaras, intimate washes, lip products and anything positioned for babies fall in the 100 CFU tier.
- Ignoring the retained sample. When a complaint arrives, the retained sample from that batch is the only way to tell factory contamination from consumer contamination. Confirm it exists and how long it is kept; our guide to cosmetovigilance and complaints sets out the investigation.
Frequently asked questions
Is a challenge test legally required for cosmetics?
In the EU and Great Britain the safety report must include the results of a preservation challenge test, so in practice it is required for any product that is not justified as low risk. ASEAN expects it within the safety assessment in the product information file. The US sets no mandatory method, but the company must be able to substantiate safety, and a challenge test is the accepted evidence. See our explainer on the cosmetic product safety report.
How long does a preservative challenge test take?
The incubation period under ISO 11930 is 28 days and cannot be shortened. Allowing for sample receipt, method suitability checks and reporting, most laboratories return a result in about five to seven weeks. Build this into the development timeline before stability and artwork, because a failure means reformulating and starting the 28 days again.
Can a product pass the microbial limit test and still be unsafe?
Yes. The limit test shows that a batch was clean when sampled. It does not show that the formula can resist the microorganisms introduced by fingers, water and air during weeks of use. A hygienically made but under-preserved product passes at release and can spoil in the consumer’s hands, which is why the challenge test exists.
Do anhydrous products such as balms and oils need these tests?
Often not, provided a written risk assessment under ISO 29621 shows that the formula cannot support growth, usually because there is too little available water. The assessment must reflect the real formula and use: a balm containing a water-based extract, or an oil cleanser that is emulsified with water in the jar, may lose its low-risk status.
What is the difference between ISO 11930 and USP 51?
Both are challenge tests using similar organisms over 28 days, but ISO 11930 was written for cosmetics and includes a risk-assessment route through Criteria B, while USP <51> comes from pharmaceuticals and sets criteria by product category. Many US laboratories offer USP <51> or industry-association methods by default. For products sold in the EU, GB or ASEAN, request ISO 11930.
Who pays for microbiological testing, the brand or the factory?
Routine batch limit testing is normally included in the unit price as part of the factory’s release procedure. Challenge testing is usually charged to the brand for a custom formula and absorbed by the factory for its own stock formulas, although the report for a stock formula covers that formula only as supplied. Ask for both to be itemised in the quotation.
Sources and limitations
Primary sources used in this article, all checked on 13 November 2026: ISO 17516:2014 (microbiological limits), ISO 11930:2019 (evaluation of antimicrobial protection) and ISO 29621 (microbiologically low-risk products), as described in the ISO catalogue and summarised from the standards; Regulation (EC) No 1223/2009, Annex I (EUR-Lex); the SCCS Notes of Guidance for the Testing of Cosmetic Ingredients and their Safety Evaluation, 12th revision (European Commission); the ASEAN Guidelines on Limits of Contaminants for Cosmetics and the Health Sciences Authority of Singapore’s ASEAN Cosmetic Directive page; the FDA’s page on microbiological safety and cosmetics, its page on the Modernization of Cosmetics Regulation Act of 2022 and Chapter 23 of the Bacteriological Analytical Manual; and the UK government’s guidance on making cosmetic products available in Great Britain. ISO standards are paid documents; our tables condense their requirements and the published text prevails.
Limitations: the worked challenge-test example, the laboratory turnaround times and the cost ranges are illustrative figures chosen to explain how results are read and planned for. They are not measurements from a named product or quotations from a named laboratory. The low-risk thresholds are the commonly cited values and must be confirmed against the current edition of ISO 29621. Standards and guidelines are revised; ISO 17516 has a revision in progress at the time of writing. We did not audit any factory or laboratory for this article. Confirm limits with the regulator in each market and have the safety assessor for your product decide what testing it needs.
This article is independent editorial content provided for general information. It does not constitute legal, regulatory or technical advice. Verify all requirements with your manufacturer, an accredited laboratory and a qualified safety assessor before making commercial decisions.