What an OEM Factory Audit Actually Checks: ISO 22716, GMPC and the GMP Rules Behind Every Market You Sell Into

Most factory audits don't fail on cleanrooms - they fail on records

An auditor never walks into a cosmetics factory expecting spotless floors. What they expect is evidence: that the same process which produced the batch you are buying also produced the batch before it and the one after it. ISO 22716:2007 is the standard most audits are built on, and it is still the current edition - ISO/TC 217 reviewed it in December 2022 and confirmed it stays valid. There is no ISO 22716:2026. If a supplier tells you a newer version exists, ask them which clause changed and why. On QuickOEM, every factory in the network is benchmarked against that same baseline, and certificate numbers are checked against the issuing certification body's public register before a plant is listed. The rest of this article is the checklist we would use if we were the buyer.

ISO 22716 is a process standard, not a product standard

It says nothing about whether your serum actually works. It says a great deal about whether the factory can prove it made what it says it made, consistently, and can still prove it three years later when a regulator asks. The standard is organised around a handful of systems, and an auditor tests each one against records rather than against interviews.

• Quality management - documented responsibilities, resource allocation, management review, and internal audit programmes with real findings and real follow-up.
• Premises and equipment - water treatment and its validation, air handling for the grades that need it, cleaning and sanitisation records, calibration logs.
• Production and control - batch records, in-process controls, weight and volume reconciliation, yield checks, and environmental monitoring where the dosage form requires it.
• Quality control - the lab that actually releases batches, retention samples, stability data, and how out-of-specification material is handled.
• Complaints, deviations, change control and recall - the four areas where factories lose the most points, precisely because they cannot be improvised on the day of the audit.

EU: GMP is a legal duty, and the PIF has to say so

Article 8 of Regulation (EC) No 1223/2009 requires cosmetic products to be manufactured according to GMP. Article 11 then requires the Product Information File to include a statement that the product was developed and manufactured in compliance with GMP, and the PIF must be retained for at least 10 years. That single sentence is why an EU-bound factory keeps a materially different documentation set from one that only sells domestically. It also explains why the answer we have GMP is an incomplete sentence: the statement has to sit next to a specific plant, a specific product category and a specific PIF holder. If the PIF of a cream was signed off by a site that does not make creams, the file does not support the claim.

What the GMP expectation looks like, market by market

The baseline differs by destination. A factory comfortable with two regimes is usually not comfortable with all of them, which is exactly the question to ask before you place the order.

• European Union - GMP is mandatory under (EC) 1223/2009 and the competent authority may audit you or your factory directly. Notify through CPNP; keep the PIF for 10 years.
• United States - MoCRA gave FDA the authority to issue its own GMP rule, but as of the end of 2026 no final rule has been published. In practice ISO 22716 is the reference. Facility registration renews every two years, serious adverse events are due 15 business days after you become aware, and FDA holds mandatory recall power.
• China - the cosmetic GMP regulation has applied since 1 January 2022. For scale, industry data from the end of 2024 counted 5,935 cosmetics production enterprises nationwide; that is the whole-industry figure, not a list of audited suppliers. Read it as context for how thin the certified supply pool is.
• United Kingdom - SCPN is not a mirror of the EU CPNP. Registration route, PIF content and competent authority do not transfer across the border, and the PIF must be held in English for at least 10 years.
• Indonesia (BPOM) - a notification must carry a valid NA number and a local notification holder is required. GMP evidence is examined at the registration stage, so the file you keep must match the file you submit.
• Saudi Arabia - conformity is verified batch by batch via SFDA, GHAD and FASEH. The pathway is documented rather than calendar-driven, so avoid promising a fixed number of working days in your submission.
• Australia - there is no pre-market registration for cosmetics, but you must register as an AICIS introducer, keep records for at least five years, and note that sunscreens are TGA therapeutic goods with separate duties.
• Brazil (ANVISA) - the official position is that GMP certification is not compulsory for cosmetics, yet production must still follow good manufacturing principles, and a local license holder is required.

ISO 9001 will not save you

A quality management certificate proves that a company operates a documented management system. It does not prove that the system covers cosmetic-specific risks such as preservative efficacy challenge testing, microbial limits, stability, contamination control, or product information content. Regulators do not accept ISO 9001 as a substitute for cosmetic GMP, and neither does an auditor who has sat through a dozen inspections. The reverse caution matters just as much: holding an ISO 22716 certificate tells you nothing about the condition of the plant this morning. Certifications describe the moment of certification. Only an on-site audit - or a documented remote audit run against an ISO 22716 checklist - describes today.

China's GMPC and ISO 22716 are not the same legal animal

Both are called GMP, but they are not the same instrument. China's regulation is domestic law with its own inspection and enforcement route; ISO 22716 is an international consensus standard adopted by customers and used by authorities as a reference. A plant can hold both certificates and still have gaps in whichever regime its customers never ask about. This is why we ask for both sets of records and why we check whether the scope matches the site and the formulation type. A facility holding an ISO 22716 certificate scoped to general cosmetics may have entirely different controls for a leave-on emulsion, a serum or a sunscreen - so verify per dosage form rather than per company.

The five records that decide the outcome

If you remember nothing else from this article, remember these five. Auditors are trained to follow a record backwards, not to admire a facility.

• Batch records that reconcile - input weight, yield and packaging consumed against what actually shipped, with every shortfall explained.
• Deviation and change-control logs showing who approved a change, when, and what risk assessment supported it. Open or hand-waved deviations are the most common finding.
• Retention samples held for the defined period and correctly labelled, so a batch from three years ago can still be tested.
• Complaint and recall files, including evidence of a recall drill. Many factories have a policy on the shelf and no record of ever having practised it.
• Training and qualification records for the people who touch the product, especially at aseptic or high-risk steps.

How to verify a certificate in about fifteen minutes

Certificate numbers are public by design. Use that instead of the PDF in the supplier deck.

• Check the number in the issuing certification body's public register, not in a document the supplier forwarded.
• Confirm the scope: the plant address and the dosage forms must cover what you are buying. A group certificate spanning several legal entities is not single-site assurance.
• Confirm the dates: initial certification, current expiry and audit cycle. A lapsed certificate with no renewal pathway is worse than no certificate.
• Confirm the language of the scope for China-sourced plants. Many certificates carry a Chinese-language scope that does not name the product categories you need.
• Ask for the most recent audit report rather than the certificate alone. The findings and corrective-action page is where a weak facility reveals itself.

Turning the audit into a purchase decision

An audit is not a pass/fail event. It is a set of risks you either accept, price into the unit cost, or close with contractual terms before the first shipment. Most brands over-invest in the physical plant and under-invest in the paperwork that actually causes a recall. The cheapest fixes should be demanded up front: a named PIF holder, a retention-sampling plan, a written complaint route to the factory, and a batch-data response commitment inside 48 hours. On QuickOEM, brand-side access is free and factory quotes come direct with no added margin. Tell us your target markets and we will shortlist only the plants whose certificate scope covers them.