Cosmetic Factory Audit Checklist for OEM Buyers

This is the working checklist: the questions, the evidence each one requires and how to score the answers. It assumes you already have a shortlist. If you are still deciding who to audit, our guide to choosing a cosmetics manufacturer in China comes first; its factory visit checklist is about first impressions on a shortlist (housekeeping, zoning, gowning), while this one grades records against samples you pick. Checking whether licences and certificates are genuine is a desk exercise, covered in how to find a skincare manufacturer you can trust. Visit notice and our production address are on our factory page.

Scope: audits run by cosmetic OEM buyers, on site or remotely, of a plant making skincare, hair care, body care or colour cosmetics under contract. It does not cover men's grooming lines, ingestible beauty supplements or massage creams and balms. Supplements fall under food rules, and massage products are often sold as professional or therapeutic goods, so each needs its own checklist and reference standard. Medical devices and drugs, including sunscreens sold as OTC drugs in the US, are out of scope for the same reason.

What the Audit Is Measured Against

A supplier audit checklist needs a reference standard. Without one, each finding is just the auditor's opinion.

In the EU, Article 8 of Regulation (EC) No 1223/2009 requires cosmetics to be manufactured in line with good manufacturing practice. It presumes compliance when manufacture follows the relevant harmonised standard, and in practice that standard is ISO 22716. In the US, the Modernization of Cosmetics Regulation Act of 2022 directs the FDA to issue GMP regulations for cosmetic facilities, but no final rule is in force yet. Until one is, the FDA's reference point is its 2013 draft guidance on cosmetic GMP. That draft revised the agency's earlier GMP guidelines and inspection checklist, and the FDA says it took ISO 22716 into account. Where the rule stands is tracked in our MoCRA compliance guide.

For a buyer, the practical upshot is simple: structure the audit around the areas of ISO 22716:2007 and your audit report will use the same terms as the factory's certification body. If you want a refresher on what the certificate covers, see ISO 22716 and GMPC explained. A certificate tells you the system passed someone else's audit on a given date. Your audit tells you whether that system runs your product.

How to Score Each Line

Give every checklist line one of four grades, and write down the evidence you saw next to it. A grade with no evidence note doesn't count.

Agree the lines that count as critical before the audit starts. A sensible default list:

• A finished batch you pick that can't be traced to its raw material and packaging lots
• Product released without a named release authority and recorded test results
• Rejected or quarantined material stored with released stock and no physical status control
• The audited site isn't the site that will make your product
• Formula or material substitutions made without a documented change control

One critical finding outweighs a high overall score. A factory scoring 90% with an untraceable batch is a weaker supplier than one scoring 75% with every batch traceable.

The Checklist: Seven Areas, Evidence Required

Each line below has two parts: the question, and the evidence that earns a 2. Wherever you can, choose the sample yourself on the day. Records the factory has prepared in advance show how the system performs at its best, not on a normal day.

1. Site and scope

• Is this the site that will manufacture my SKU? Evidence: the production licence address and the certificate scope match the building you are standing in, and the quote names this site. (The desk check of the certificate is a separate step, so here you only confirm the match.)
• Is my product category within the certified and licensed scope? Evidence: the category appears on the scope, not just "cosmetics".
• Will any step be subcontracted? Evidence: a written list of outsourced steps (filling, testing, printing) and the subcontractor's name.

2. Raw materials and packaging receipt

• How is material status shown? Evidence: pick a drum yourself. It should carry a quarantine, released or rejected label, and that status should match the stock record.
• What is checked at receipt? Evidence: the receiving record for that drum, with the supplier's certificate of analysis and the factory's own identity or acceptance check.
• Who releases incoming material? Evidence: a signature from a named QC role, not from the warehouse.
• Are packaging components controlled the same way? Evidence: the same status logic applied to bottles, pumps and printed cartons. Printed components with superseded artwork are a common gap.

3. Supplier approval: the supplier audit checklist inside the factory audit

Your OEM is a buyer too, and part of your product's risk sits with its suppliers. ISO 22716 treats the purchase of raw and packaging materials as a controlled activity, so a factory should be able to show its own supplier controls.

• Is there an approved supplier list? Evidence: the list, with the supplier of the drum you sampled on it.
• How is a supplier approved and re-evaluated? Evidence: an approval file for one supplier, including specification, CoA history and any audit or questionnaire.
• What happens when a supplier changes a grade or site? Evidence: a change notification and the factory's assessment of it.
• Can a material be bought from an unapproved source in a shortage? Evidence: the procedure says no, or requires documented approval. A buyer should hear about it before production, not after.

4. Weighing, batching and processing

• Does the batch record follow the approved formula? Evidence: for a batch you pick, actual weights recorded against target, material lot numbers entered, and operator and checker signatures.
• Are process parameters recorded as values? Evidence: temperatures, times and mixing speeds written as numbers, not ticks.
• Is equipment cleaning recorded between batches? Evidence: the cleaning log for the vessel the sampled batch was made in, dated before that batch.

5. Filling, packing and line clearance

• Which line would run my format? Evidence: a named line, with a recent batch of a similar viscosity and pack.
• How is line clearance done between products? Evidence: a signed clearance record removing the previous product's components and labels.
• What in-process checks are made? Evidence: recorded fill weights at set intervals, closure torque or leak checks, and batch and expiry coding checks.

6. Quality control, release and retained samples

• What is the finished product specification? Evidence: a specification with limits, and the test results for your sampled batch measured against it.
• What is tested in-house and what is outsourced? Evidence: a list. Microbiology in particular is often sent out. That's acceptable when the lab is named and the results are on file. Challenge test reports belong in the product file rather than batch release. For outsourced work, see our guide to verifying a cosmetic testing laboratory and its reports.
• Who releases the finished batch? Evidence: a release record signed by a QC role independent of production.
• Are retained samples kept? Evidence: retained samples from the batch you picked, labelled and on the shelf.

Product development evidence (stability programmes, formulation competence) is a separate question with its own method, covered in how to verify formulation capability and cosmetic stability testing. Keep it out of the plant audit so the audit stays on manufacturing.

7. Deviations, complaints, recalls and change control

• How are deviations recorded and closed? Evidence: ask for the deviation log and choose one entry. It should show the investigation, root cause, corrective action and close date.
• How are complaints handled? Evidence: a complaint record linked back to a batch.
• Is there a recall or withdrawal procedure? Evidence: a procedure, ideally with a mock-recall exercise on file.
• What triggers change control? Evidence: a recent change record covering a material, a supplier or a process. This is also where you agree that your formula and suppliers are not changed without your approval, the same principle that governs a technology transfer.

The Traceability Test: Run It Both Ways

This is the most informative half hour of a factory audit. Choose a finished batch code from the retained samples or the warehouse, and trace it in both directions.

• Backward: finished batch → batch record → each raw material lot → that lot's receiving record and supplier CoA → packaging component lots.
• Forward: pick a raw material lot → every finished batch that used it → where those batches were shipped.

Backward traceability shows the record system works. Forward traceability shows whether the factory could find every affected batch if a supplier reported a problem with a lot. Time both traces. Lots that are found in minutes from records are a different system from lots that someone needs a day to reconstruct.

Remote Factory Audits: Rules That Keep Them Honest

A remote audit is efficient for document review, interviews and a first look at the floor, and it can come before an on-site visit. It only works if the camera shows what you ask for, not a prepared tour.

• You name the route on the call. Ask for the raw material store, then a specific shelf, then the line for your format, in an order you choose live.
• Close-ups on labels. Status labels, batch codes and record entries must be legible on screen. If they can't be read, grade the line 1, not 2.
• Documents shown on screen in full. Not cropped extracts. You choose which page.
• Same sampling rules as on site. Pick the batch for the traceability test during the call, not beforehand.
• Record what couldn't be verified. A remote audit report should list the lines held over to an on-site visit or to a third-party auditor.

Agree in advance what you're allowed to see. Other customers' formulas and records are confidential, so expect them to be redacted. Redaction is a legitimate restriction. Refusing to show any example of a record type is not.

After the Audit: Findings, Corrective Action and Re-Audit

Write each finding against its checklist line, the evidence observed and the grade. Then sort the findings:

• Critical: no sampling or production order until it is closed with evidence.
• Major (a 0 on a line that matters to your product): corrective action with an owner and a due date, closed before the first production run.
• Minor (a 1): corrective action tracked, verified at the next audit.

Close each finding with evidence of what changed. A revised procedure on its own proves the document changed, not the practice. A completed record made under the new procedure is better evidence.

Plan a re-audit when something material changes: a new site or line, a new product category, a change of key raw material supplier, a serious complaint, or a critical finding at the last audit. Otherwise, set a fixed interval in your quality agreement and use the factory's surveillance audit reports between visits.

Frequently Asked Questions

What is a cosmetic factory audit?

A structured check of whether a manufacturing site's quality system actually runs as documented, for the product you plan to buy. It covers site scope, material control, batching, filling, quality control and release, deviations and change control, and it is usually measured against ISO 22716, the cosmetics GMP standard. A buyer's audit differs from a certification audit because it focuses on your category, your format and samples you pick.

What should a supplier audit checklist include?

Every line should pair a question with the evidence that answers it, plus a grade. For cosmetic OEM buyers, the core areas are site and scope, raw material and packaging receipt, the factory's own supplier approval, batching records, filling and line clearance, QC release and retained samples, and deviations and change control. Add a two-way traceability test and agree the critical lines before the audit starts.

Is an ISO 22716 certificate a substitute for a factory audit?

No, though it is a useful baseline. The certificate shows the quality system passed a certification body's audit at a point in time, within a stated scope. Your audit checks whether that system covers your category and format, and whether the records for a batch you choose hold up. Many buyers use the certificate together with the certification body's surveillance reports between their own audits.

Can a factory audit be done remotely?

Yes, for document review, interviews and an initial walkthrough, provided you choose the route live, labels and records are legible on camera, and documents are shown in full. Some lines are hard to verify remotely, such as physical segregation and actual cleaning practice. List those in the report and close them on site or through a third-party auditor.

Should I use a third-party auditor?

A third-party auditor is useful when you can't travel, need a report in a recognised format for a retailer, or want an independent view. Give them your checklist and your critical lines so the audit is built around your product, not a generic template.

How often should a cosmetic supplier be re-audited?

Set a regular interval in the quality agreement, and also re-audit when something material changes: a new site, line or category, a change of key supplier, a serious complaint, or a critical finding last time. Use the factory's certification surveillance reports between your own audits.

What should I send the factory before the audit?

Your product list with formats and pack types, target markets, the checklist itself and the critical lines you have agreed. Ask in return for the site address that will make your product, the certificate scope, the organisation chart for QC and production, and a list of outsourced steps. Don't send the batch or lot you plan to sample; pick it on the day.

How is this different from choosing a manufacturer?

Choosing a manufacturer narrows the field on capability, price, certificates and communication. A factory audit comes after that, on one or two shortlisted sites, and tests whether the quality system works on records you select. Treat a good audit result as a condition for the first order, not a reason to skip commercial comparison.

What will the factory not show me?

Expect other customers' formulas and identifying records to be withheld or redacted, and expect some areas to need appropriate gowning or to be viewed through a window. Those are normal limits. A factory refusing to show any completed example of a batch record, release record or deviation is not.

Our Guangzhou site holds ISO 22716 and GMPC certificates (HBPCER20260352 and HBPCER20260353, issued by Intertek and verifiable at certs.intertek.com.cn) and is registered as a cosmetic facility with the US FDA under MoCRA (FEI 3038966060). Registration is a listing, not an FDA approval or inspection result. If you want to run this checklist on us, send your product list, target markets and checklist through our contact page and we'll agree the scope before booking.