ISO 22716 audits: the records auditors ask for first

ISO 22716 sets out GMP for the production, control, storage and shipment of cosmetic products. It does not cover research, development or distribution beyond the manufacturer's gate. The standard is organised into 17 clauses covering personnel, premises, equipment, raw materials, production, finished products, quality control laboratory, treatment of out-of-spec product, waste, subcontracting, deviations, complaints and recalls, change control, internal audit and documentation.

Cleaning and sanitation, equipment maintenance and calibration, batch documentation, sampling and testing, deviation handling, change control, complaints, recalls and self-inspection. The standard does not prescribe the format, but every procedure must be controlled (versioned, approved, accessible) and every batch traceable end-to-end from raw material lot to finished goods.

ISO 22716 is a guideline standard, not a management system standard, so formal certification is optional. Most manufacturers nonetheless pursue certification through a notified body (e.g. SGS, BSI, Bureau Veritas) because it shortcuts customer audits. Brand owners commissioning a manufacturer should request the latest certificate and the most recent unannounced audit report.

For a single site with existing quality procedures, six to nine months from decision to certificate is a realistic plan: two to three months closing gaps, a documentation review, then a Stage 1 and Stage 2 audit with a corrective action window between them. Sites starting without controlled procedures or a batch record system should assume twelve months or more, because the constraint is generating a history of records, not writing the procedures.

Certification body fees for a small to mid-sized site typically land in the low thousands per year, including surveillance audits. That is rarely the real cost. The larger spend is internal: gap analysis, procedure writing, training records, supplier qualification, and the staff time spent assembling evidence for the audit itself. Sites that already hold batch records, deviations and training as structured data rather than paper report materially shorter audits, which is the argument for evidencing GMP inside cosmetic ERP software rather than around it.

These three are regularly conflated in tenders and supplier questionnaires. They do different jobs.

• ISO 22716. Product-specific GMP for cosmetics. Tells you how to make and control the product. Harmonised under EU 1223/2009, so compliance with it is the accepted route to the GMP requirement in Article 8.
• ISO 9001. A generic quality management system. Tells you how to run and improve the organisation. It says nothing about batch records, raw material lots or challenge testing, so it does not satisfy the cosmetics GMP duty on its own.
• MoCRA GMP. The US regime under the Modernization of Cosmetics Regulation Act. FDA's good manufacturing practice requirements are being introduced through rulemaking, drawing heavily on ISO 22716. A site already running ISO 22716 is well positioned, but registration, product listing and adverse event duties are separate. See MoCRA compliance.

Many manufacturers hold ISO 9001 and ISO 22716 together: the first for the business, the second for the product.

ISO 22716 is documentation-heavy. Worldover holds batch records, raw material lots, in-process QC, finished goods release, deviations and change control as structured data, then renders auditor-ready evidence on demand. The standard does not change; the cost of evidencing it does.

Auditors do not work through the standard clause by clause. They pick a batch, then pull the records that should exist around it. This checklist maps each clause group to the artefact that is asked for, and to the failure that shows up most often in cosmetic GMP audits.

Read down the last column and a pattern emerges: nearly every finding is a broken link between two records that live in different places. That is a systems problem rather than a discipline problem, and it is what quality management software for cosmetics and cosmetic ERP software are for.

ISO 22716 GMP requires documented procedures, batch records and audit trails for every stage of cosmetics production. Meeting this through paper records and spreadsheets works until your first serious audit.

Worldover's MES module produces paperless batch records that meet ISO 22716 requirements by default: digital work instructions, in-process checks, operator sign-offs and automatic audit trail generation. Audit prep takes minutes, not weeks, and per-client batch record formats are generated automatically at close-out.