What Is the Difference Between ISO 9001 and GMP Certification?

ISO 9001 in plain English: a management system standard

ISO 9001 is an international standard for quality management systems. It is deliberately generic. A cosmetic factory, a logistics company, a software firm and a hotel can all be certified to it, because it does not describe how to make any particular product. It describes how an organisation should manage itself so that it delivers consistently what it has promised to customers.

In practice, an ISO 9001 system asks a company to:

• Define its processes and who is responsible for each one.
• Understand customer requirements and check that they are met.
• Control documents and records so the current version is the one in use.
• Evaluate suppliers and monitor their performance.
• Handle complaints, investigate root causes and take corrective action.
• Run internal audits and management reviews, and show continual improvement.

Certification is issued by an independent certification body after an audit, and it is maintained through periodic surveillance audits. The certificate states a scope, which is the list of activities and sites covered. That scope matters. A certificate covering 'trading of cosmetic products' at a head office says nothing about a production site in another province.

What ISO 9001 does not do is set hygiene rules, cleanroom conditions, water quality limits or batch release requirements. A company could, in theory, run an orderly management system around a production process that is not adequate for cosmetics. That is why ISO 9001 alone is not enough evidence when you are choosing a manufacturer for products applied to skin.

GMP in plain English: rules for how products are made

GMP stands for Good Manufacturing Practice. Unlike ISO 9001, it is product-focused and sector-specific. There are different GMP frameworks for pharmaceuticals, food, supplements and cosmetics, and they are not interchangeable. For cosmetics, the two references buyers meet most often are ISO 22716, the international guideline on cosmetic GMP, and the ASEAN Cosmetic GMP guidelines used across Southeast Asia, including Thailand.

Cosmetic GMP covers the practical conditions that keep a product safe and consistent:

• **Premises and equipment**: layout that prevents mix-ups and contamination, cleanable surfaces, maintained and calibrated equipment.
• **Personnel**: training, hygiene, protective clothing and health rules.
• **Raw materials and packaging**: approved suppliers, incoming inspection, quarantine and release, proper storage.
• **Production**: written batch instructions, in-process checks, labelling of vessels and lines, cleaning between batches.
• **Quality control**: testing of bulk and finished product, retained samples, and a formal release decision before goods ship.
• **Traceability**: batch records that link each finished unit back to the materials and steps used.
• **Deviations, complaints and recalls**: procedures for when something goes wrong.

How GMP is evidenced varies. Some factories hold a certificate issued under a national authority's scheme, while others are certified to ISO 22716 by a private certification body. Both can be valid, but they are different documents from different issuers. When a supplier simply says 'we have GMP', your next question should be: which GMP, issued by whom, for which site and product categories?

Side by side: the differences that matter to a buyer

Seen from a sourcing desk, the two certifications answer different questions.

• **Focus**: ISO 9001 looks at the organisation and its management processes. GMP looks at the product and the conditions of manufacture.
• **Industry**: ISO 9001 applies to any sector. GMP is written for a specific product type, and a food or pharmaceutical GMP certificate is not automatically evidence of cosmetic GMP.
• **Main risk addressed**: ISO 9001 addresses inconsistency in meeting customer requirements. GMP addresses contamination, mix-ups and unsafe or out-of-specification product.
• **Typical evidence**: ISO 9001 produces quality manuals, process maps, objectives and audit reports. GMP produces batch manufacturing records, cleaning logs, test results and release records.
• **Regulatory weight**: ISO 9001 is voluntary almost everywhere. Cosmetic GMP is expected or required by regulators and retailers in many markets, though the exact rule depends on the country. Confirm what applies with the authority or a regulatory adviser in your destination market.

The two also overlap. Both require document control, training, internal audits, corrective action and supplier evaluation. A factory with both tends to have GMP governing the shop floor and ISO 9001 tying together sales, purchasing, planning and customer service.

A simple way to remember it: GMP helps you trust the batch, ISO 9001 helps you trust the company's way of working. A manufacturer with GMP but no ISO 9001 can still be a sound choice. A manufacturer with ISO 9001 but no credible cosmetic GMP deserves a much closer look before you place an order.

How to verify a certificate instead of trusting a logo

A logo on a website is marketing. A certificate is a document you can check. Build these steps into your **supplier verification** routine for every factory on your shortlist.

• **Ask for the full certificate** as a PDF, not a cropped image. Read every line.
• **Check the legal entity name and address**. They should match the company you will sign a contract with and the site where your product will actually be made.
• **Read the scope**. Does it say manufacturing of cosmetic products, and does it include your category, such as skincare, hair care or colour cosmetics?
• **Check the standard and version**: ISO 9001, ISO 22716, ASEAN Cosmetic GMP or another scheme.
• **Check the dates**. Note the issue and expiry dates, and ask when the last surveillance audit took place.
• **Identify the issuer**. For private certification, the certification body should be accredited, and many bodies offer an online directory where you can confirm a certificate number. For authority-issued certificates, ask the supplier how you can confirm validity with the issuing office.
• **Ask for supporting evidence**: a summary of the last audit, the number and type of findings, and how they were closed.

Red flags include a certificate in a different company's name, a scope that covers only trading or packing, an expired document described as 'under renewal' with no audit date, and reluctance to share anything beyond a logo.

Finally, remember that a certificate reflects the days the auditor was on site. It reduces risk but does not replace your own review of samples, batch records and, where possible, a visit or live video walk-through.

Which one should you require for a cosmetic project?

The honest answer depends on your market, your sales channel and your own risk tolerance, but a sensible hierarchy looks like this.

**Treat cosmetic GMP as the baseline.** If you are evaluating a **skincare manufacturer in Thailand**, evidence of cosmetic GMP at the actual production site is the first thing to ask for. It relates directly to product safety, and many importing countries and retailers expect it. Check your destination market's rules, because some specify the standard they recognise.

**Treat ISO 9001 as a positive signal.** It suggests the factory handles quotations, change requests, complaints and delivery planning in a structured way. That matters over a multi-year relationship, especially if you plan several products.

**Look beyond both where your claims require it.** Halal, organic, vegan or cruelty-free positioning each has its own certification schemes. Neither ISO 9001 nor GMP covers them. Supplements and medical-type products follow different GMP frameworks from cosmetics altogether.

Also weigh certifications against fit. Larger, heavily certified factories may be geared to bigger programmes, while smaller sites may be more flexible on development but lighter on formal systems. When MOQ matters, the standard reference is 1,000 units per SKU. Prices and timelines depend on the specification and are confirmed at quotation.

If you prefer not to audit factories yourself, options include hiring a third-party inspection firm, using a B2B platform that screens suppliers, or working with an OEM/ODM company in **beauty and cosmetics manufacturing** that manages production and quality on your behalf. In every case, ask to see the certificates of the site that will actually fill your product.

Questions to ask on your next factory call

Certificates open the conversation. The answers to a few practical questions tell you whether the systems behind them are alive. Use this list on a video call or site visit, and ask to see examples rather than accepting a yes.

• Which GMP standard is the site certified or assessed against, and when was the last audit?
• Does the ISO 9001 scope include manufacturing at this address?
• Can you show a blank or redacted batch manufacturing record for a product similar to mine?
• How are raw materials quarantined, tested and released before use?
• What water system feeds production, and how often is the water tested?
• How do you clean and verify equipment between batches, especially after fragranced or coloured products?
• Who signs the final release of a batch, and is that person independent from production?
• How long do you keep retained samples and batch records?
• Can you walk me through a recent complaint or deviation and what changed afterwards?
• If you subcontract any step, such as filling or printing, which site does it and what certification does that site hold?

Listen for specifics. A team that works under real GMP will answer with document names, frequencies and responsible roles. Vague replies, or a promise to send everything later, are a reason to dig further.

Record the answers alongside each supplier's certificates in a simple comparison sheet. When quotes arrive, you will be comparing not only price but also how much confidence each factory has earned. That file also becomes useful evidence if a retailer or regulator later asks how you selected your manufacturer.