What is GMP certification and what do auditors check?

Good Manufacturing Practice is the set of organisational and operational principles that ensure a cosmetic product is consistently produced and controlled to quality standards. For cosmetics, the reference standard is ISO 22716. Compliance is required under Article 8 of EU Cosmetics Regulation 1223/2009, and equivalent UK Cosmetics Regulation provisions apply post-Brexit.

GMP is not a single document or audit certificate. It is a working system covering premises, equipment, personnel, raw materials, production, finished products, quality control, complaints handling, internal audits and documentation. ISO 22716 sets the framework; the working system is what auditors check.

Compliance with GMP is mandatory for cosmetics placed on the EU and UK markets. Third-party certification to ISO 22716 is not strictly mandatory, but it is the practical baseline. Brand owners, retailers and manufacturers almost universally require it from their supply chain. In the US, MoCRA introduced a federal GMP regime for cosmetics, with FDA rulemaking ongoing.

Auditors check the working system, not the binder. Common areas of weakness include: incomplete batch records, untraceable raw material lots, gaps in equipment calibration logs, deviations recorded without CAPAs, and personnel training records that lag behind procedure updates. The strongest audit defences are not better documents but better data: a single, queryable source of truth across batch, raw material, equipment and personnel records.

For a cosmetics or chemicals business running hundreds of SKUs across multiple sites, GMP becomes a data problem. Worldover holds batch records, raw material lots, equipment logs and personnel qualifications as structured data. CAPAs are tracked through to closure. Internal audit findings link back to the affected SOPs and SKUs. When an external auditor walks in, the trail is queryable in seconds.

GMP, whether under ISO 22716, FDA cGMP or EU GMP, requires controlled procedures, trained operators and traceable records for every batch you produce. The work is not the SOPs, it is keeping the evidence live across every shift, every line and every client.

Worldover runs the whole GMP record digitally: SOPs linked to the work, in-process checks captured at source, operator and QA sign-offs timestamped, and a continuous, immutable audit trail. Deviations flow straight into the QMS module against the same batch, and per-client batch record formats are generated automatically.