ISO 22716 Audit Checklist: Where European Cosmetics Manufacturers Most Often Fall Short

Most GMP non-conformances cited during cosmetics audits don’t trace back to a manufacturing defect or a contaminated batch. They trace back to a procedure that wasn’t followed, a record that wasn’t dated, or a deviation that was flagged but never closed. In over a decade of working with European cosmetics manufacturers — from artisan skincare workshops in Lyon to mid-size contract manufacturers in Belgium — that pattern holds remarkably consistent.

ISO 22716:2007 is not a technically demanding standard. It is a documentation and discipline standard. And that distinction matters enormously when you’re preparing for a GMP audit.

Why ISO 22716 Is Not Optional for EU Cosmetics Manufacturers

Article 8 of EU Cosmetics Regulation (EC) No 1223/2009 makes it explicit: cosmetics placed on the EU market must be manufactured in accordance with good manufacturing practice. Commission Decision 2013/674/EU, published in November 2013, formally identifies ISO 22716:2007 — the Guidelines on Good Manufacturing Practices for Cosmetics — as the reference standard presumed to satisfy that GMP requirement.

What that means in practice: if your product is on the EU market and a competent authority initiates a GMP inspection — France’s DGCCRF, Germany’s BfArM, or another national body — ISO 22716 is the framework they’ll use. The standard covers 15 chapters, from personnel and premises to subcontracting, complaints, and internal audit. Non-conformances under any chapter can trigger corrective action requirements, and in serious cases, product withdrawal.

The standard is deliberately non-prescriptive. It doesn’t specify exact batch record formats or room dimensions. That flexibility is intentional — but it also means many manufacturers underestimate how much documented evidence they need to actually demonstrate compliance. Flexibility doesn’t mean freedom from documentation.

The 5 Most Common ISO 22716 Non-Conformances

Over years of audit preparation and readiness assessments, the same five gap categories surface again and again. None of them are obscure. All of them are avoidable.

1. Incomplete or unsigned batch manufacturing records. ISO 22716 Chapter 9 requires that production records capture every significant step — quantities weighed, equipment used, environmental conditions, and operator sign-off at each stage. What auditors repeatedly find are records with blank columns, missing signatures, or entries completed retrospectively from memory. A batch record that looks finished on paper but has no in-process operator sign-off is a non-conformance. Completing records after the fact — even the same day — creates a credibility problem that experienced auditors will spot immediately.

2. Inadequate raw material traceability. Chapter 6 covers raw material management, including identity testing, supplier qualification, and lot traceability. A very common gap: manufacturers rely on supplier certificates of analysis (CoAs) as their sole identity verification, with no in-house confirmation testing performed. For botanical ingredients in particular — extracts, essential oils, plant-derived actives — regulators expect at least organoleptic or basic physicochemical identity testing at goods receipt. CoAs alone, without any internal verification, are consistently cited as insufficient. Your supplier can issue a CoA for anything; your job is to confirm it.

3. Cleaning validation that exists on paper but not in practice. Chapters 4 and 5 require cleaning procedures for equipment and premises to be validated. What frequently happens is that a written cleaning procedure exists in the quality management system, but no validation records confirm its effectiveness. Written procedures without supporting efficacy data are a common audit flag — particularly for shared equipment used across multiple product types or across products with different risk profiles (fragranced vs. fragrance-free, pigmented vs. unpigmented).

4. Deviation management with no closed-loop closure. Chapter 14 requires deviations to be documented and investigated. Many manufacturers have systems for raising deviations. Far fewer have systems for verifying that corrective actions actually worked. Auditors will specifically look for deviations older than 90 days with no closure documentation — that pattern is a direct indicator of quality system maturity, or the lack of it. An open deviation from 8 months ago with no closure record is, frankly, worse than the original deviation. It tells the auditor that the system raised a flag and then ignored it.

5. Internal audit gaps. Chapter 15 requires manufacturers to conduct regular internal audits of the GMP system itself. Two failures appear consistently: audits that were conducted but poorly documented (no formal report, no tracking of individual findings against owners and deadlines), and audit programs that haven’t run in over 12 months. In a DGCCRF inspection I’m familiar with, a 14-month gap in the internal audit programme was cited as a major non-conformance — even though the facility had otherwise adequate manufacturing practices. The absence of a functioning internal oversight mechanism signals systemic risk, regardless of what the process floors look like.

Your 12-Point Pre-Audit Documentation Checklist

Before any third-party GMP audit — whether for ISO 22716 certification, retailer qualification, or export market compliance — run through these 12 documentation checkpoints:

1. Quality Manual — Current version, dated, approved, with visible version history
2. Organisational chart and responsibility matrix — Named individuals against each GMP responsibility
3. Supplier qualification files — Approved vendor list, qualification evidence, and current CoAs for every active raw material
4. Raw material specifications — For every material in production, with defined acceptance criteria
5. Batch manufacturing records (last 12 months) — Complete, signed, with no blank fields or retrospective entries
6. Cleaning validation reports — For each piece of production equipment, with documented efficacy data
7. Environmental monitoring records — Temperature, humidity logs for all storage and production areas
8. In-process and finished product testing results — Linked to corresponding batch records by lot number
9. Deviation log — All deviations recorded with open/closed status clearly indicated
10. CAPA register — Actions raised, assigned owners, deadlines, and effectiveness verification records
11. Internal audit reports (last 24 months) — Formal reports, findings listed, closure status tracked
12. Training records — Every operative with documented GMP training, competency verification, and dates

None of these are exotic. Every one of them is explicitly required by ISO 22716. And yet, in a typical readiness assessment, we find between 3 and 6 of these 12 points require remediation before an audit can proceed with confidence. The gaps are almost never in the manufacturing itself — they’re in the surrounding evidence.

What CAPA Really Means Under ISO 22716

Corrective and Preventive Action (CAPA) doesn’t appear as a dedicated chapter in ISO 22716 — it’s woven across multiple chapters as a recurring obligation. That architectural choice trips up manufacturers who expect a single CAPA clause to work from. The intent is that the entire system is CAPA-driven.

What auditors want to see is a functioning closed-loop system: something goes wrong, it gets documented, the root cause is identified (not just the symptom), a corrective action is assigned with a deadline and a named owner, and — critically — the effectiveness of that action is later verified. The verification step is where most CAPA systems break down. Many manufacturers close a CAPA when the action is completed. ISO 22716’s actual intent is that you close it when you’ve confirmed it worked.

Here’s a concrete example. A raw material lot fails identity testing at goods receipt. The immediate action is quarantine and return. The corrective action might be to update the supplier qualification criteria and retrain the purchasing team. But the verification — 90 days later — is to review the next five procurement decisions and confirm that the updated criteria were actually applied. That verification record is what an auditor wants to see on file. Without it, the CAPA is a completed task, not a resolved risk.

If your CAPA register currently has more than 5% of actions marked “complete” with no effectiveness verification on record, that’s a material gap worth addressing before your next external audit.

ISO 22716 Certification and Its Value Beyond the EU

One practical point for manufacturers targeting export markets: ISO 22716 certification isn’t just a domestic compliance tool. It’s a market access accelerator.

Health Canada recognises ISO 22716-based GMP for cosmetic products sold in Canada. The US FDA’s Modernization of Cosmetics Regulation Act of 2022 (MoCRA) introduced mandatory GMP requirements for US-marketed cosmetics — and while FDA continues finalising its implementing rule, ISO 22716 is widely expected to serve as the substantive framework. The UK Cosmetics Regulation, post-Brexit, imposes equivalent GMP expectations. And several ASEAN markets explicitly accept ISO 22716 certification as evidence of GMP compliance for market entry.

A single, well-documented ISO 22716 quality management system, properly maintained, can credibly support regulatory filings in at least 6 different markets. The investment in getting the documentation right once — rather than scrambling to patch it market by market — pays for itself in time savings alone, well before you factor in the avoided cost of a failed audit.

The audit you’re preparing for today is the easiest one you’ll ever face. Every gap you find and close now is a non-conformance that won’t appear in a formal report, won’t trigger a regulatory clock, and won’t reach your retail buyers or distributors. Run the 12-point checklist this quarter. Close the open deviations. Get the internal audit programme back on schedule. Those steps aren’t bureaucracy — they’re the difference between a GMP certificate that opens export markets and an inspection report that closes doors.

---

Written by Nour Abochama, Quality & Regulatory Advisor, Care Europe | VP Operations, Qalitex. Learn more about our team

Talk to our team about EU market entry and GMP audit readiness. Contact us

Related from our network

• ISO 17025-accredited testing for cosmetic raw materials and finished products — Qalitex Laboratories provides third-party analytical testing to support GMP supplier qualification and batch release under ISO 22716.
• Health Canada GMP compliance for cosmetic and NHP products sold in Canada — Androxa supports Canadian market entry for European brands navigating Health Canada’s Good Manufacturing Practice requirements.