Three quotes land in your inbox on the same morning. Unit prices sit within a few cents of each other, all three suppliers claim GMP, all three say they can make your launch window. The spreadsheet you built to compare them stops being useful at exactly that point: it measures the three things suppliers are most willing to negotiate and least able to guarantee.
TL;DR — Seven dimensions decide whether a cosmetic manufacturer becomes a growth partner or a line item you spend next year unwinding: certification depth, capacity headroom, communication quality, R&D capability, IP protection, total cost of ownership, and jurisdictional and ethical compliance. Only the first carries veto power. The rest are weighted, not equal.
What follows is a ranked framework rather than an even checklist. Weight is the whole point: treating all seven as equally important produces roughly the same decision as treating none of them seriously, and costs about three weeks more.
The Seven Dimensions, Ranked by Weight — and When to Skip Most of Them
Most supplier comparisons collapse into three columns: unit price, MOQ, lead time. They are the easiest numbers to obtain and the least predictive of the outcome you actually care about, which is whether batch four behaves like batch one.
| Dimension | Weight | Verification move | Red flag | Pass line |
|---|---|---|---|---|
| 1. Certification depth | Veto | Certificate names the site-owning entity and address; issuing body in the ANAB directory; recent batch COA on request | Certificate names a trading entity or a different address; COA only "after order" | Entity, address, and COA reconcile before payment |
| 2. Capacity & scalability | High | Ask current utilization; ask where your run sits on the schedule | Above 90% utilization, or "any volume" with no schedule | Headroom to absorb a reorder spike |
| 3. Communication quality | High | Send one sharp technical question; time the reply, check who answers | Replies rerouted into sales language; gaps during sampling | Direct answers, documents sent unprompted |
| 4. R&D capability | Medium-high | In-house chemists named; time a custom sample from spec to bench | Stock formulas only; cannot explain a processing decision | Can explain why the formula is built this way |
| 5. IP protection | Medium-high | NNN agreement, not a bare NDA; manufacturing procedure assigned to you | NDA only; refuses process ownership | NNN signed, procedure ownership in writing |
| 6. Total cost of ownership | Medium | Who pays for scrap, rework, retesting, recall; where tooling and test fees sit | Unit-price-only talk; tooling and test fees in later clauses | Cost allocation in writing before the PO |
| 7. Jurisdiction & ethics | Medium (tiebreaker) | SA8000 or SMETA status including edition; REACH-IT filings for EU product; CS3D exposure | No social audit record; refuses an ethics review | Documented audit status or a dated remediation plan |
Why Certification Is the Door That Locks Behind You
Six of the seven dimensions can be repaired after signature. Capacity can be sourced elsewhere. Cost allocation can be renegotiated at the second PO. A formula can be redeveloped. A certification failure rarely unwinds cheaply, because by the time it surfaces you have finished goods in a warehouse, a retail listing date, and marketing spend already committed against it.
ISO 22716 remains the reference GMP standard for cosmetics, and the current edition is still ISO 22716:2007 — ISO's own record shows it as confirmed (stage 90.93, confirmed following the 2022-01-15 systematic review). Buyers are sometimes told a newer version exists and that an existing certificate is therefore out of date. Check that claim against ISO directly before acting on it.
The certificate has to name the legal entity that owns the production site and the site address itself; one issued to a trading company at a different address covers nothing that happens on the line. Confirm the issuing body is accredited — ANAB publishes a directory of accredited certification bodies.
For US-bound product, ISO 22716 and MoCRA are separate systems. MoCRA requires facility registration and product listing with FDA, and a GMP certificate does not stand in for either.
[Key Takeaway: Certification is a gate, not a score. Make three documents reconcile before any deposit moves: the ISO 22716 certificate, the production address written into the contract, and a batch COA from a real run rather than a template. If the certificate names a trading entity, if the contract address is not where your goods will be filled, or if the COA only appears after you order, stop the evaluation — the other six dimensions cannot rescue a supplier who fails this one.]
When Three Checks Are Enough
Weighted diligence is not maximum diligence. Running all seven dimensions against every purchase order is how sourcing teams lose the internal argument for doing any of them.
For a repeat run with a supplier you have already shipped with — same formula, same line, previous batch COA clean — three of the checks above are sufficient:
- The certificate is still within validity.
- A real slot exists on the production schedule.
- The last batch COA is on file and passed.
Run all seven when any one of these is true: this is your first engagement with the supplier, the formula is custom rather than catalogued, or the product is entering a market you have not shipped into before. One trigger is enough. New market entry reopens dimension one completely, because a supplier fluent in US MoCRA registration and listing may have no EU-side substance or notification work to show.
There is no volume exemption. A standard production-scale run of an established formula with a known supplier can use the compressed path. A first run with an unknown one cannot, whatever its size, because that run is the only evidence you will have.
Running Each Dimension: What to Ask, When to Walk
Two of the seven are calendar problems rather than effort problems: R&D sampling and IP paperwork. Start those on day one. The rest run in parallel over email, and what you need arrives as documents rather than answers.
Dimensions 1–3: Paper, Pressure, and People
Certification. Ask for two things: the ISO 22716 certificate with its full scope statement, and a batch COA from the last run of a product in your category. A supplier who sends the certificate within the hour but cannot produce a COA from an actual run is showing you a document library, not a quality system. Certification checks belong inside a systematic supplier verification process rather than standing alone, because a certificate attests to a management system as it stood on the audit date — the limits of that are set out in the separate breakdown of what GMP and ISO 22716 certificates actually prove.
Capacity. Pin down current utilization, then ask where your run would sit on the schedule. A plant running above 90% has no buffer, and your reorder queues behind whoever is larger. Sourcing-side convention puts the comfortable band nearer 70% — enough slack to absorb a spike, enough load to keep the lines warm. It is a rule of thumb, not a measurement. The opposite answer fails too. "We can handle any volume," with no schedule, no line count, and no shift pattern behind it, is a sales sentence.
Run size and capacity are connected through production economics rather than negotiation. Custom formulation work typically carries MOQs above 2,000 pcs. That floor is not a supplier's pricing strategy: filling line setup, component procurement, and per-batch microbiological and stability testing all carry costs that do not scale down with run length. Color cosmetics and premium packaging components generally sit higher again.
Communication. The most underestimated dimension on the list, and the cheapest to test. Send one sharp technical question — the fill tolerance held on a given line, or what happens to the preservative system if a chelating agent is swapped. Two things are being measured: how long the reply takes, and whether an engineer answers it or a sales contact restates your question back as a benefit. Factory auditors who do this for a living tend to say the same thing: a supplier's response behaviour during quoting predicted the working relationship better than any certificate on file.
Dimensions 4–7: The Long Half of the Relationship
R&D. Have them name the chemists on staff and say whether those chemists built the formulas in the catalogue. Then test it: commission a custom formulation sample and time it from spec sheet to bench sample. Custom formulation development is commonly quoted in a $5,000–$20,000 band, per industry feedback, and that figure is a development fee rather than a unit cost. What you are measuring is not the sample. It is whether the questions come back sharp — target pH, viscosity window, packaging compatibility, preservative efficacy — or whether someone asks which stock formula you would like tinted.
IP protection. An NDA prevents disclosure. It does not prevent use. An NNN agreement adds non-use and non-circumvention, which are the clauses that matter once a factory holds your formulation. Then there is the part buyers forget: the manufacturing procedure. The INCI list goes on your carton. The processing parameters — order of addition, mixing temperature, shear rate, cooling curve — are what produce the texture customers come back for. If the contract assigns you the formula but not the procedure, you cannot move production to another plant and get the same product. Get process ownership in writing before any formulation is exchanged.
Total cost, not unit price. The quote is the smallest number in the relationship. Establish who absorbs scrap, rework, retesting, and recall, then ask whether tooling and mold fees are quoted up front or surface in a later clause, and whether testing is billed per batch or bundled.
Unit pricing is only the entry. Private-label work is often discussed in a broad $2–$8/unit band depending on category, packaging, and volume, per brand-owner reports — but the number that decides the outcome is what a failed batch costs. One of the more frequently repeated accounts runs like this: the cheapest quote wins, batches start drifting around month six, the brand moves production, and switching cost lands at roughly three times what the price gap saved. Treat it as anecdote rather than a statistic. Then notice how many versions of the same account exist.
Jurisdiction and ethics. This dimension rarely kills a deal. It decides ties. Check SA8000 status and whether a SMETA or equivalent audit has been run. Note that SA8000:2026 has been published by Social Accountability International, so suppliers may hold certificates against different editions during the transition — ask which edition, and what the transition plan is. For EU-bound product, REACH-IT is where substance registrations and notifications are handled, and a supplier who has never filed there starts your EU dossier from zero. The EU Corporate Sustainability Due Diligence Directive is moving ethical compliance from preference toward contractual obligation for larger buyers; sell into a retailer carrying CS3D obligations and your supplier's audit record becomes your exposure.
No supplier scores well on all seven. Expect every candidate on a shortlist to be weak on at least one dimension. What you are really choosing is which weakness you can monitor contractually, and which one you would pay to fix for as long as the relationship lasts.
Turning the Scorecard Into a Decision
Score each dimension, then do not average them. An averaged score conceals precisely the failure that matters: a supplier can look strong on six dimensions and still be unusable because the certificate names the wrong entity. Apply the veto first, rank afterwards.
If two candidates finish within a point of each other, break the tie on communication — the one dimension you can still test for free. Send the sharp technical question to both; how each answers is the last signal you get before it starts costing money.
Keep the slow-running items moving while the fast ones resolve. How a supplier handles a paid sample tells you more than a completed questionnaire, so get it started while the shortlist is still open.
Decide two things before you compare another quote. The first is whether your realistic run size clears the floor described above — if it does not, a stock formula on standard packaging usually beats a custom program you will struggle to reorder economically. The second is market. A supplier built around US MoCRA registration and listing is not automatically able to support an EU Responsible Person and CPNP notification.
Once the shortlist narrows to one name, the seven dimensions stop being the work. What follows is the pre-deposit verification sequence: the document set and payment structure that keep a decision you spent three weeks making from being undone by a single wire transfer.
If your shortlist is down to two or three names and you would rather compare them on these seven dimensions than on unit price, request a seven-dimension supplier review. Send the product category, target market, formula route, and volume band; it comes back as a gap list rather than a quote: what is verifiable now, what is missing, and which gaps get expensive to close later.
Price is the one dimension that resolves itself once the other six are answered. Work in that order.
References / Sources
- ISO 22716:2007 — Cosmetics — Good Manufacturing Practices (GMP), current confirmed edition — https://www.iso.org/standard/36437.html
- U.S. FDA — Deadline for Registration and Listing of Cosmetic Product Facilities and Products (MoCRA) — https://www.fda.gov/cosmetics/cosmetics-news-events/deadline-registration-and-listing-cosmetic-product-facilities-and-products-what-does-deadline-mean
- ANAB — Product Certification Bodies Accreditation Directory — https://anab.ansi.org/resource/product-certification-bodies-accreditation-directory/
- European Chemicals Agency (ECHA) — REACH-IT — https://reach-it.echa.europa.eu/
- Social Accountability International — SA8000 Standard — https://sa-intl.org/programs/sa8000/
