Quick Answer: GMP certification is a third-party assessment against a defined standard or scheme, for a stated organisation, site and activity scope. Evaluate the audit basis, issuer, current status and supporting operating records before relying on it. ISO develops standards but does not certify companies. Certification supports due diligence; it does not automatically approve a cosmetic formula, label or sale in every country.
Start by asking what the certificate actually covers
The phrase GMP certified can describe different schemes and assessment arrangements. Before comparing suppliers, obtain the full certificate and identify the named standard, edition, certified entity, site address, activities, issue date and expiry or validity conditions. A logo in a presentation cannot answer these questions.
The BSI ISO 22716 scope summary covers cosmetic production, control, storage and shipment, while identifying exclusions. Read the certificate wording alongside the activities you need, including bulk manufacture, filling, packing and any subcontracted steps. Do not assume that an office or trading-company certificate covers a separate factory.
Create a project-specific scope statement before requesting quotations. Describe the products, site, lines and operations involved. If a brand plans to transfer from jars to tubes or add another manufacturing location, ask whether the present certification arrangement covers the change and what assessment is needed. A clear question is more useful than demanding a generic certificate.
| Field | Verification question | Reason it matters |
|---|---|---|
| Legal entity and site | Does this match the actual manufacturing location? | Prevents relying on an unrelated business or address |
| Standard and activities | Are the required operations within scope? | Avoids treating a narrow assessment as complete coverage |
| Dates and status | Is the certification currently valid and unsuspended? | A historic document may no longer represent current status |
| Issuer and reference | Can the issuer independently confirm the record? | Supports authenticity and accurate interpretation |
Distinguish the standard, certifier and accreditation body
ISO writes international standards. As ISO’s explanation of standards and certification makes clear, certification is performed by external bodies rather than ISO itself. A supplier should name the body that issued its certificate. Describing a factory as certified by ISO misstates the relationship.
Accreditation and certification are separate layers. Accreditation concerns the competence of a conformity-assessment body for its recognised activities; certification concerns the organisation or activity assessed under the scheme. Where accredited certification is claimed, verify both the body and its relevant scope. Do not infer that every certificate issued by a familiar organisation falls within the same accreditation coverage.
Ask the prospective certifier which scheme and conformity-assessment requirements it applies, what recognition it holds and how clients can verify status. Compare the answers in writing. The absence of an easily searchable directory entry should trigger direct verification, while a directory hit should still be matched to the exact certificate, entity and site.
Prepare evidence before scheduling the audit
A preparation review should compare real operations with the chosen criteria. Walk the site, interview operators and sample records. Identify missing controls, assign owners and allow enough operating time to demonstrate that changes work. Buying a manual shortly before the auditor arrives does not establish routine execution.
Useful evidence includes approved procedures, training, supplier and material controls, cleaning records, maintenance, batch documentation, testing, release and investigations. The FDA cosmetic GMP inspection checklist provides an official reference for self-inspection themes. It is not itself a certification programme and should not be presented as proof of FDA certification.
Select representative examples rather than only the easiest product. Include a batch with a deviation, a rejected incoming material or a completed complaint investigation when available. The purpose is to show how the system responds under pressure. Protect confidential formulas through appropriate access arrangements while preserving the auditor’s ability to assess relevant controls.
| Evidence group | Factory preparation | Brand review |
|---|---|---|
| Site and process map | Identify activities and outsourced steps | Match the actual order route |
| Controlled records | Provide representative completed examples | Check revision and batch traceability |
| Nonconformities | Show correction, cause and follow-up | Assess impact on proposed supply |
| Changes and release | Explain authority and notification rules | Agree access and communication expectations |
Understand the audit sequence without assuming one universal format
Ask the certification body to explain the proposed process, audit duration, sampling approach, locations and decision method. Some schemes separate document review and on-site assessment; others use different terminology. The applicable scheme determines the stages, surveillance and renewal arrangements. Avoid promising a fixed sequence or validity period without checking the contract.
During the assessment, auditors typically seek evidence through records, observation and interviews according to their programme. Sampling has limits: an audit cannot observe every employee, every batch or every moment of operation. A positive outcome should be understood in the context of the defined scope and assessment, supported by ongoing supplier oversight.
Clarify how outsourced work is considered. If a subcontractor makes bulk product and another site fills it, map both activities and the controls between them. Ask who approves the subcontractor and how results, deviations and changes are communicated. The paperwork should reflect the actual manufacturing route rather than the commercial invoice alone.
Close findings through evidence, not cosmetic paperwork
When a nonconformity is raised, understand the requirement and the observed evidence. Correction addresses the immediate problem; cause analysis asks why it happened; corrective action aims to prevent recurrence. The certification body should explain which responses it needs before making or maintaining a decision.
For example, a missing cleaning-status label may require immediate control of affected equipment. The broader investigation could examine training, handover or an unclear procedure. Simply printing another label does not establish that the next shift will use it correctly. A follow-up check should show whether the revised practice is operating effectively.
Retain the finding, response, supporting evidence and acceptance or closure communication. The brand should assess whether any finding affects supplied batches, even if the certification decision remains positive. Agree what information can be shared and how serious issues are escalated, respecting confidentiality without concealing material supply risks.
| Document or claim | Useful purpose | Separate check still needed |
|---|---|---|
| GMP certificate | Defined third-party assessment | Current scope, status and real operating evidence |
| Audit report | Details of sampled evidence and findings | Closure and relevance to the order |
| Batch analysis report | Results for an identified batch | Product specification and release review |
| Market compliance file | Destination-specific product evidence | Manufacturing execution and ongoing changes |
Verify a supplier certificate independently
Obtain the complete readable document, including annexes and any site list. Match the reference to the issuer’s official verification route or contact the issuer using independently located details. Ask about current status, covered activities and any limitations that affect your order. Record the date and result of the check.
Check spelling and addresses against the contract manufacturer’s legal details, but do not declare fraud solely because of a translated name or formatting difference. Resolve discrepancies with supporting records and the issuer. A certificate from a related company may be authentic while still being irrelevant to the factory you plan to use.
Keep a short supplier-review memo with the certificate copy, verification response, manufacturing map and unresolved questions. Schedule rechecks around expiry, renewal, significant changes or a serious quality signal. A certificate collected at onboarding can become outdated during a long product lifecycle, so ownership of the review needs to be explicit.
Keep destination-market compliance and commercial claims accurate
In the EU, European Commission cosmetics harmonised-standards overview requires GMP and sets out a presumption linked to relevant harmonised standards published in the Official Journal. It does not turn a supplier certificate into universal market approval. A product still needs the applicable safety, information, labeling and responsible-person arrangements.
Use precise language in purchasing and marketing. State the applicable standard and actual certified scope only when verified, and follow the issuer’s conditions for marks. Do not put an ISO logo on packaging as if ISO endorsed the product. This article makes no claim that MOOYAM holds a particular GMP or ISO certificate; project-specific evidence should be requested and checked.
For outsourced development, the OEM/ODM cosmetics manufacturer discussion should cover both manufacturing capability and document access. Local requirements such as those outlined in the Korean cosmetic regulations guide need their own review. A quality agreement can connect audit rights, change control and complaint handling with the destination requirements.
Plan the budget and supplier decision around evidence quality
Request an itemised proposal covering scope, sites, audit work, travel where applicable, corrective-action review and ongoing assessment. Cost and timing depend on the scheme and operation. A very fast promise without enough time to assess the site should prompt questions about what is actually being offered.
The brand’s final decision should combine verified certification with relevant capability, sample quality, communication and traceability. Record any limitations and the actions required before purchase. For a manufacturing project, contact the project team with the intended markets, product formats and required certificate scope so that the evidence request can be aligned with the actual supply route.
Frequently asked questions
Does ISO issue GMP certificates?
No. ISO develops standards; external certification bodies perform certification. Verify the actual issuer and exact scope.
Is an ISO 22716 certificate required everywhere?
No universal rule applies to every market and arrangement. Check destination legislation, customer contracts and the proposed scheme rather than assuming a global certificate requirement.
How can a brand verify a certificate?
Match the full reference, entity, site and scope through the issuer’s official verification route or independently located contact details, and record current status.
Does a valid certificate guarantee every batch?
No. Audit sampling and scope have limits. Continue batch review, change control, complaint monitoring and supplier oversight.
Can a certificate for one factory cover another site?
Only if the certificate and its applicable annexes actually include the relevant location and activities. Ask the issuer to resolve uncertainty before relying on it.
Last reviewed: 28 October 2026. General manufacturing and supplier-review information, not product-specific legal, certification or safety advice. Confirm current requirements and the relevant certification scheme with qualified advisers for each destination market.