Every supplier on your shortlist sends the same PDF deck — the same GMP badge, the same "ISO 22716 certified" line, the same 30-day lead-time promise. On paper they look interchangeable, which is the real problem. The certificate is rarely the lie; the gap is whether it covers your product type, at this production address, on a registration that is still current. Buyers who cannot tell the difference wire a deposit, then discover the second run does not match the sample.
TL;DR Before any deposit leaves your account, verify the supplier in five moves: confirm certificate scope and site address, trace every raw-material lot, demand stability and preservative test reports, and screen your category for rules no GMP badge covers. Each step turns a marketing claim into checkable evidence.
The system below is what we run with brands before releasing a deposit on their behalf. It is built to be copied — the email template at the end requests exactly the documents each step requires.
Step 1: Verify Supplier Certifications (GMP, ISO 22716, FDA)
A certificate proves one successful audit at one named site on one dated period. It does not prove the line still runs to that standard today, and it rarely proves the scope covers your formula.
Key Takeaway: Treat a certificate as a starting point, not proof. Verify the scope, the address, the FEI number, and the body that issued it before you trust any of it.
Request the full ISO 22716 (Cosmetics GMP) file, not a cover-page screenshot. Check the issuing body and certificate number, the issue and expiry dates, and — most often missed — the scope statement. A line reading "filling of surfactant-based products" does not cover a lotion emulsion bottled elsewhere; suppliers have been known to hold a scope-limited certificate covering only filling while formulation happens at a different, uncertified site. The ISO 22716 standard page (iso.org) shows what a legitimate scope references.
The facility address on the certificate must match the physical production site. A GMP certificate for a sister plant that does not make liquids is worthless for your order.
For U.S.-bound product, the Modernization of Cosmetics Regulation Act (MoCRA) requires facility registration. Ask for the FEI (FDA Establishment Identifier) number and a status screenshot, and confirm the biennial renewal date is current — one brand was shown a lapsed number that returned nothing in the FDA database. The FDA's registration and listing page (fda.gov) explains what a valid registration looks like; FDA lists facilities but does not "approve" cosmetics. The number only helps once you verify a U.S. manufacturer's FDA registration yourself.
Validate the certifier too: cross-check the accreditation body in ANAB's directory (anab.ansi.org) or IAF CertSearch, and for a large order commission a third-party SGS or Intertek audit. PIC/S GMP guidance (picscheme.org) shows how pharmaceutical-grade GMP overlaps with cosmetics. Our guide on how to verify a factory's GMP and FDA claims covers whether those claims survive inspection.
Step 2: Verify Ingredient Quality and Traceability
A great formula is worthless if raw materials drift between batches. Traceability is your defense against adulteration and unsubstantiated claims — and what makes a recall take days instead of months.
Key Takeaway: Demand batch-level documents, not category-level assurances. If the supplier cannot produce lot-level records for your batch, you have no chain of custody.
For every production run, the quality team should provide:
- Master Batch Record — the recipe and instructions for making the product.
- Executed Batch Record — the filled-in version for your batch, signed and dated, listing the exact lot numbers of every raw material used.
- Certificate of Analysis (CoA) — identity, purity, and specs for a specific batch of each ingredient.
- Safety Data Sheet (SDS) — hazards, handling, and storage.
- Allergen Declaration — required for fragrances and certain plant extracts.
- IFRA Certificate — confirms fragrance compliance with the International Fragrance Association's standards.
The differentiator is the chain of custody: a compliant factory links incoming raw-material lot numbers to your production batch record. A supplier once substituted a certified sustainable oil for a cheaper uncertified grade; batch-level CoAs caught it because the lot numbers did not match the supplier's paperwork. Without executed batch records, a sample perfect at 1 kg has no explanation when it drifts at scale.
For the EU market, Regulation (EC) No 1223/2009 requires a Product Information File (PIF) and CPNP notification, which the documents above populate (eur-lex.europa.eu). A supplier who cannot hand you batch-level CoAs will not build a defensible PIF either. Our guide on how batch traceability protects brands shows the chain-of-custody system in practice.
Step 3: Verify Product Safety and Stability
A formula stable in a lab beaker is not stable in a tube on a hot truck. Safety and stability testing is the line between a two-year shelf life and a warehouse of destroyed stock.
Key Takeaway: Stability and preservative testing are not optional line items. They are the evidence the product is still safe and on-spec when your customer opens it.
- Stability testing exposes samples to 40–45°C for three months plus freeze-thaw cycles, checking color, odor, viscosity, pH, and appearance. Three stable months at 40°C roughly equals a two-year shelf life. Labs typically quote $1,500–$3,000 per formula over 3–6 months — confirm with your own lab.
- Preservative Efficacy Testing (PET), or challenge test, inoculates the product with bacteria, yeast, and mold to confirm the preservative kills them. Required for any water-containing formula (labs typically quote $800–$1,500).
- Packaging compatibility testing runs the product in its final pack to catch leaching, discoloration, or seal failure.
- Toxicological review / CPSR — a qualified safety assessor calculates the Margin of Safety; the EU requires a Cosmetic Product Safety Report (Regulation (EC) No 1223/2009). For the complete pre-manufacturer testing checklist, see what product testing to confirm.
One brand lost an entire first run to microbial growth because the preservative system was never challenge-tested — the cost was the whole batch plus a relabel, not a ~$1,000 test. A novel plant preservative that passed a lab screen still needs a real challenge test in the actual formula and packaging.
Step 4: Screen Your Category for Rules No GMP Badge Covers
General certificates tell you a factory can make product safely. They do not tell you whether your specific product is legal to sell. Some categories carry rules a GMP audit never touches.
Key Takeaway: Check the category before you check the factory. The category rule decides which certificates and tests actually matter.
Self-tanning is the clearest example. The active, dihydroxyacetone (DHA), is regulated by the FDA as a color additive (hfpappexternal.fda.gov). Use is restricted to external application only — not lips, nose, or eye areas — and the FDA has not approved all-over spray booths where inhalation is likely. For lotions and creams, DHA up to 15% is generally recognized for external use. If the product has no sunscreen, a specific FDA warning statement is mandatory; omitting it makes the product misbranded and unsellable on major platforms. A brand's self-tan mousse was pulled from a major platform because the warning was dropped for "clean label" design — the whole inventory had to be relabeled.
The method generalizes: before evaluating any supplier, screen your category for its own rules — color additives, OTC drug status, sunscreen therapeutic-goods classification (Australia's TGA), restricted lists (Canada's Hotlist). The category rule decides whether a standard GMP certificate is enough or whether you need extra filings, tests, or warnings.
Diagnostic Table: What Each Document Actually Proves
| Document | What it proves | What it does NOT prove | How to verify independently |
|---|---|---|---|
| ISO 22716 certificate | A successful GMP audit at a named site for a dated period | The scope covers your product type, or that the site still meets standard today | Read the scope; match the address; cross-check the issuer via ANAB / IAF CertSearch; re-audit before large orders |
| FDA facility registration | The facility is listed with FDA under MoCRA | Product approval (FDA does not approve cosmetics) or that registration is current | Request the FEI number; check status in FDA's system; confirm the biennial renewal date |
| Certificate of Analysis (CoA) | Identity and purity of a specific raw-material lot | That every lot in your batch matched spec, or that no substitution occurred | Demand batch-level CoAs tied to your Executed Batch Record; cross-reference lot numbers |
| PET / preservative efficacy report | The preservative system passed a challenge test under lab conditions | Real-world stability over two years, or performance in your actual packaging | Pair with stability and packaging-compatibility testing; confirm the method (e.g., ISO 11930) and lab accreditation |
Red Flags: Stop Before the Deposit
Most failed supplier relationships announce themselves in the document request, not the production run. Pair these signals with our seven due-diligence dimensions for manufacturers when you are still choosing between factories:
- Quote far below market — often 30%+ under, which usually means testing, tooling, or compliant materials were quietly unbundled.
- Refuses original certificate files — sends only low-res scans or cover pages, never the full scope page.
- Refuses video or on-site audit — will not show the line, the changing room, or cleaning records.
- Scope mismatch — the certificate covers filling, but your product is an emulsion made elsewhere.
- Lapsed registration — the FEI number is not verifiable, or the renewal date has passed.
- Avoids capacity numbers — answers "we can do any volume" instead of naming real output.
- Sample-bulk drift — the sample matched the brief, but no executed batch records explain the bulk.
- Hidden fees after signing — mold or lab fees appear only in the contract, never the quote. Request every line item up front.
- Trader, not factory — the supplying entity has no owned production site; verify the legal entity against the physical plant.
Step 5: Put the System in Writing — The Document Request Template
The fifth step is the easiest to skip and the costliest to recover from: put every document request in writing before a deposit moves. Copy this into your first serious email to a shortlisted manufacturer — a supplier who answers completely and quickly is already signaling how the relationship will run.
Subject: Document request — [Product name] manufacturing verification
Hello [Name],
Before we move to a deposit, please share the following within 5 business days:
- Current ISO 22716 certificate — full file with scope page and facility address.
- FDA facility registration proof (U.S.-bound): FEI number + status screenshot from the FDA portal.
- EU readiness (if applicable): confirmation of PIF and CPNP notification handling.
- Master Batch Record and a sample Executed Batch Record.
- CoA and SDS for each raw material in our formula.
- Allergen declaration and IFRA certificate (if fragranced).
- Stability test protocol with sample report; PET/challenge test report (ISO 11930 or equivalent).
- Packaging compatibility test result for the final pack.
- A quote itemizing tooling/mold fee, per-batch lab testing, MOQ, and lead time.
- Confirmation of audit access — video or on-site — at a mutually convenient time.
For custom formulation orders, which typically run above 2,000 pieces, we treat any missing document as a stop, not a follow-up. Pair this with our document checklist before deposit for the full pre-payment file map.
Where Verification Pays Off
Verification is not a checkbox ticked once before launch. It is the system that lets a brand reach the second reorder without a fire — the difference between a relationship that scales and one that ends in a recall. The five steps above are what we run before releasing any deposit, and the email template asks for the evidence each step needs.
If you are weighing a supplier and want a second set of eyes on the certificates and batch records you already hold, we can run a supplier-readiness assessment on your documents — the same check we apply before releasing a deposit. Our pre-deposit verification checklist covers the last-mile checks once the documents are in.
