ISO 9001 vs ISO 22716 for Cosmetic Manufacturers: What Buyers Verify

What ISO 9001 actually certifies

ISO 9001 is a generic quality management system standard. It is deliberately industry-neutral: the same requirements apply to a software company, a logistics firm or a cosmetic factory. What it certifies is that the organization has defined its processes, assigns responsibilities, controls documents and records, sets quality objectives, measures customer satisfaction, handles nonconformities and corrective actions, audits itself internally and reviews the system at management level.

For a buyer, that translates into some concrete expectations when you deal with an ISO 9001 certified manufacturer:

• There should be a documented procedure for handling your order, from quotation through production planning to release.
• Complaints and deviations should be logged, investigated and closed with a corrective action, and you can ask to see the trend.
• Suppliers of raw materials and packaging should be evaluated and approved according to a procedure, not by habit.
• Measuring equipment used for quality decisions should be calibrated and traceable.
• Management should be able to show quality objectives and how they review them.

What ISO 9001 does not certify is equally important. It says nothing specific about hygiene zoning, air handling, water quality for cosmetic production, cross-contamination control between batches, microbiological monitoring or the particular risks of filling an emulsion. A factory can be fully compliant with ISO 9001 while running processes that would worry a cosmetic quality engineer, because the standard only checks that processes are defined and followed, not that they are the right processes for cosmetics.

So read ISO 9001 as a statement about organizational discipline. It is a positive signal for order handling, documentation and problem resolution, especially for buyers coordinating global sourcing across several categories, but it is not a statement about cosmetic product safety.

What ISO 22716 actually certifies

ISO 22716 is the international standard for good manufacturing practices in the cosmetics industry. Unlike ISO 9001, it is written specifically for sites that produce, control, store and ship cosmetic products. It is the standard that regulators in several markets reference when they talk about cosmetic GMP, and it is what a cosmetic quality professional has in mind when they ask whether a plant is GMP-compliant.

Its scope covers the practical conditions of cosmetic production:

• **Personnel**: training, hygiene, protective clothing and clear responsibilities for quality decisions.
• **Premises**: layout that supports flow and separation, cleaning and sanitation, pest control, lighting and ventilation appropriate to the activity.
• **Equipment**: design that allows cleaning, calibration, maintenance and documented cleaning status.
• **Raw materials and packaging**: receipt, identification, quarantine, release, storage and traceability.
• **Production**: documented instructions, batch records, in-process controls, line clearance and identification of product status at every stage.
• **Finished products**: release criteria, storage and shipment conditions, and a retained sample policy.
• **Quality control laboratory**: methods, sampling plans, reagents, out-of-specification handling.
• **Treatment of nonconforming product, waste, subcontracting, deviations, complaints and recalls, change control and internal audit.**

For a buyer, ISO 22716 is the standard that speaks to the questions you care most about when your name is on the label: will each batch be made the same way, will contamination be controlled, will there be a batch record you can inspect, and will the factory know what to do if something goes wrong after shipment.

Note what it is not. ISO 22716 is about manufacturing practice, not about the safety of a specific formula, the accuracy of a marketing claim or the legality of the product in your market. Those remain your responsibility as the brand owner, supported by the documents the factory provides per product when you order.

Where the two standards overlap, and where they do not

Because both standards talk about documentation, training, audits and corrective action, factories often present them as interchangeable or as a ladder where one is simply the advanced version of the other. Neither view is accurate. Think of them as two overlapping circles.

The overlap includes document control, record keeping, training records, internal audits, handling of nonconformities and corrective action, supplier evaluation, and management involvement. A factory that genuinely runs ISO 9001 will find much of the administrative side of ISO 22716 familiar.

The parts that belong only to ISO 22716 are the cosmetic-specific operational controls: hygiene zoning and gowning, environmental and microbiological monitoring, cleaning validation of equipment between products, water system control, line clearance between batches, batch record structure, retained samples and recall readiness. These are the controls that prevent the problems that actually hurt cosmetic brands, such as microbial contamination, cross-contamination between fragrances or actives, and batches that cannot be traced.

The parts that belong mainly to ISO 9001 are the business-system elements: customer focus, measurement of customer satisfaction, risk-based thinking across the organization, performance evaluation and continual improvement as a management discipline. These matter for how reliably the company will serve you over years, but they do not inspect the filling room.

A useful way to frame the comparison when evaluating a cosmetic manufacturer:

• ISO 22716 answers: can this site make cosmetics safely and consistently?
• ISO 9001 answers: does this organization manage its processes and its customers in a disciplined way?

The same logic applies when a cosmetic factory also presents itself as a supplement manufacturer. Supplements are typically produced under food or supplement GMP frameworks, not ISO 22716, so a cosmetic GMP certificate does not cover ingestible products made on the same site. Ask for the standard that matches each product category.

What it tells you when a factory has one but not the other

Certification combinations are a signal, not a verdict, but they do say something about where the factory has invested. Here is how to read the common cases.

**ISO 22716 only.** This is a reasonable profile for a dedicated cosmetic contract manufacturer. The site has chosen the standard that matches its product and its regulatory environment. The gap you should probe is the business system: how orders are managed, how changes are communicated, how complaints are trended across customers, and whether the company reviews its own performance. Those answers come from conversation and from looking at records, not from a certificate.

**ISO 9001 only.** This profile is common at diversified factories, at newer sites, or at companies that started in another industry. It tells you the organization is disciplined on paper, but it leaves the cosmetic-specific controls unverified. Do not assume the absence of ISO 22716 means poor practice; some factories operate under a national cosmetic GMP scheme instead. Ask which cosmetic GMP framework the site follows, who inspects it, and whether an inspection report or certificate can be shown.

**Both standards.** The strongest profile on paper and often found at factories serving export markets. The risk here is complacency on your side. Two certificates do not tell you whether the specific line, shift and product family you will use are covered, nor whether the scope on the certificate matches what you are buying. Verify scope and site address, then audit.

**Neither standard, but a national GMP certificate.** In Thailand and other manufacturing countries, a cosmetic GMP certificate issued or recognized by the national regulator can be the primary credential. Treat it with the same seriousness as ISO 22716, verify it with the issuing authority, and ask what the inspection covered.

In all cases, the question is not which logo is on the brochure but whether the controls that protect your product exist and are followed. Certificates shorten your audit; they do not replace it.

How to verify a certificate instead of trusting a logo

Certificates are easy to display and easy to misrepresent. A methodical buyer verifies four things before giving a certificate any weight.

• **The certification body**: who issued it, and is that body accredited to certify against this standard? Accredited certification bodies are listed by national accreditation bodies, and their certificates can usually be checked in a register. A certificate from an unknown issuer with no accreditation mark deserves a direct question.
• **The scope**: what activities and product categories does the certificate cover? A certificate scoped to warehousing and distribution does not cover manufacturing. One scoped to liquid personal care may not cover color cosmetics or aerosols. Read the scope line word by word.
• **The site**: does the address on the certificate match the factory you are evaluating? Groups with several plants sometimes hold certification at one site and present it for all. Match the address to the plant where your product will actually be made.
• **The validity**: certificates expire, and ISO certifications involve surveillance audits between renewals. Ask for the current certificate and, if possible, the date of the last surveillance audit.

Beyond the certificate itself, ask for evidence that the system lives: the most recent internal audit summary, a sample batch record with sensitive data blacked out, the training matrix for the filling area, and the complaint log trend. A factory that is proud of its system will show these without fuss. A factory that offers only the certificate and a tour of the showroom is asking you to take its word.

Finally, confirm who will actually make your product. Some manufacturers and many production-management partners operate through a partner factory network; that model can work well, but each site in the network should be verified separately, and you should know which one is assigned to your SKU before you approve samples.

Audit questions that go beyond the certificate

When you visit, or when you commission a third-party audit, use the two standards as a map for your questions. The goal is to see the controls in action, not to re-audit the certification body.

Questions drawn from ISO 22716:

• Walk me through the line clearance between the previous product and mine. Where is it recorded?
• Show me the cleaning record for this mixing tank and the validation that the cleaning method works.
• How is water for production treated and monitored, and when was the last out-of-limit result?
• Where are retained samples kept, for how long, and how would you locate the retained sample for a batch I complained about?
• What is the environmental monitoring plan for the filling room, and what happened the last time a result exceeded the alert level?
• Show me a completed batch record and point to the in-process checks.
• Describe your recall procedure and when it was last tested.

Questions drawn from ISO 9001:

• How is my order tracked from quotation to release, and who owns each step?
• How are changes to my formula, packaging or artwork controlled and communicated?
• Show me the complaint log for the last year and the corrective actions that came from it.
• How do you evaluate and re-evaluate suppliers of my raw materials and packaging?
• What quality objectives did management set this year and how are they tracked?

Red flags include records that are filled in too neatly after the fact, staff who cannot explain a procedure that is framed on the wall, a cleaning log with gaps on weekends, and a certificate for a different address. Good signs include staff who correct you on a detail, visible status labels on every tank and pallet, and a quality manager who volunteers a recent deviation and what was learned from it. Whichever standards appear on the brochure, these observations are what you are really buying.