GMP, ISO 22716 & COA Explained: Skincare Manufacturing Quality Standards
Walk into any discussion with a skincare manufacturer and you'll hear acronyms: GMP, ISO, COA, MSDS, CPSR. If you're a brand owner — especially one importing products into Vietnam, Cambodia, or Laos — understanding these terms isn't optional. They determine whether your product is safe, legal, and sellable. Here's what each one actually means, written by a manufacturer who lives these standards daily.
📊 Key Facts at a Glance
- GMP (Good Manufacturing Practice) is a system — it governs how products are made, not just what's in them
- ISO 22716 is the international standard for cosmetic GMP — the most widely recognized certification in global skincare trade
- A COA (Certificate of Analysis) is your product's "birth certificate" — without it, customs and regulators can't verify your product is safe
- ~40% of manufacturers who claim "GMP compliance" in initial communications cannot produce valid certification when asked — always verify
What Is GMP? (And Why "GMP Compliant" ≠ "GMP Certified")
GMP (Good Manufacturing Practice) is a quality assurance system that ensures products are consistently produced and controlled according to quality standards. It covers everything from raw material sourcing to personnel hygiene to equipment maintenance to record-keeping.
Critical distinction: "GMP compliant" is a self-declaration — a manufacturer saying "we follow GMP principles." "GMP certified" means an independent third-party auditor has verified the facility and issued a certificate. The difference is the difference between saying "I'm an honest person" and having a background check.
What GMP Actually Covers (12 Pillars)
- Personnel: Training, hygiene protocols, health monitoring
- Premises: Facility design — separate areas for raw materials, production, packaging, storage
- Equipment: Calibrated, maintained, cleaned between batches per documented procedures
- Raw Materials: Supplier qualification, incoming inspection, traceable lot numbers
- Production: Documented procedures, in-process controls, batch records
- Quality Control: Independent QC department, testing protocols, release authority
- Sanitation & Hygiene: Cleaning schedules, pest control, environmental monitoring
- Documentation: Standard Operating Procedures (SOPs), batch records, deviation reports
- Storage & Distribution: Temperature control, FIFO inventory, tamper-evident shipping
- Complaints & Recalls: System for handling product complaints and initiating recalls
- Internal Audits: Periodic self-inspection to identify and correct issues
- Continuous Improvement: CAPA (Corrective and Preventive Action) system
ISO 22716: The Global Standard for Cosmetic GMP
ISO 22716:2007 is the international standard specifically for Good Manufacturing Practices in cosmetics. It's the most widely recognized GMP certification in the global beauty supply chain — and it's what regulatory bodies in the EU, ASEAN, and beyond reference.
GMP vs ISO 22716 — What's the Difference?
| GMP | ISO 22716 |
|---|---|
| A broad quality system framework | A specific international standard for cosmetic GMP |
| Can be self-declared or certified by various bodies | Certified by ISO-accredited bodies only |
| Principles may vary by country/industry | Globally harmonized — same standard everywhere |
| Often confused with pharmaceutical GMP | Cosmetic-specific — relevant to skincare, not drugs |
| May not include third-party audit trails | Requires annual surveillance audits to maintain |
Bottom line: ISO 22716 is the gold standard. It tells you a manufacturer has been independently audited to a globally recognized, cosmetics-specific GMP standard. When evaluating manufacturers, ask: "Do you have ISO 22716 certification? Can you share the certificate and the name of the certifying body?"
💡 From the Manufacturer's Bench
Real story — Laos distributor: A distributor in Vientiane ordered 2,000 units of moisturizer from a manufacturer claiming "GMP compliant." When the shipment arrived, the Laotian FDA (Food and Drug Department) requested product registration documents, including a valid GMP certificate from the manufacturer. The manufacturer couldn't produce one — their "compliance" was self-declared, not certified. The entire shipment was held at customs for 6 weeks while the distributor scrambled to arrange independent lab testing in Thailand. Cost: $1,200 in demurrage fees + $800 in testing + 6 weeks of lost sales.
Lesson: Before placing an order, verify. Ask for the certificate, check the certifying body, confirm it's current. It takes 10 minutes and can save you months of pain.
COA (Certificate of Analysis): Your Product's "Birth Certificate"
A Certificate of Analysis (COA) is the document that accompanies every production batch, detailing the results of quality tests performed on that specific batch. It's not a generic statement — it's batch-specific, dated, and signed by the QC manager.
What a Legitimate COA Must Include
- Product name and batch/lot number — unique identifier linking the COA to the specific production run
- Manufacturing date and expiry/retest date
- Physical/chemical test results: Appearance, color, odor, pH, viscosity, specific gravity — with acceptance criteria and actual results
- Microbiological test results: Total aerobic microbial count (TAMC), total yeast and mold count (TYMC), absence of specified pathogens (Pseudomonas aeruginosa, Staphylococcus aureus, E. coli)
- Heavy metals testing (if applicable): Lead, mercury, arsenic, cadmium — especially important for color cosmetics and clay-based products
- Test methods used: Reference to the standard method (e.g., USP, ISO, in-house validated method)
- QC manager signature and date
- Manufacturer stamp/seal
MSDS (Material Safety Data Sheet): Safety, Not Quality
An MSDS (Material Safety Data Sheet) — sometimes called SDS (Safety Data Sheet) — is a safety document, not a quality document. It describes the product's hazardous properties, safe handling procedures, and emergency measures. Required for shipping, customs clearance, and regulatory compliance.
Key distinction: A COA tells you the product meets specifications. An MSDS tells you how to handle it safely. You need both.
How to Verify Manufacturer Quality Claims
When a manufacturer says "we're GMP certified" or "we follow ISO 22716," here's exactly how to verify:
- Request the certificate. Ask for a copy of the GMP or ISO 22716 certificate. It should show: certifying body name and logo, certificate number, facility name and address, scope of certification, issue date and expiry date.
- Verify the certifying body. Look up the certifier online. Legitimate certifying bodies include: SGS, Bureau Veritas, TÜV, Intertek, BSI Group, DNV. If the certifier is unknown or has no web presence, be skeptical.
- Check the scope. Does the certificate cover cosmetic manufacturing? Some manufacturers have GMP for food or pharmaceuticals, not cosmetics. The standard matters.
- Request a sample batch COA. Ask for a recent COA (you can redact the client name). Review it against the checklist above.
- Ask about third-party testing. Does the manufacturer use external ISO 17025-accredited labs for any testing, or is everything done in-house? External verification adds a layer of credibility.
- Request a virtual factory tour. Many manufacturers now offer video walkthroughs. Look for: separate raw material and finished goods areas, workers in proper PPE (gloves, hairnets, lab coats), organized documentation stations, clean floors and surfaces.
Red Flags When Evaluating Manufacturers
Quality Documentation Checklist for Brand Owners
Before importing products into any ASEAN market, you should have these documents from your manufacturer:
- ☐ GMP / ISO 22716 certificate (valid, from accredited body)
- ☐ COA for each batch (dated, batch-specific, signed, stamped)
- ☐ MSDS for each product (for shipping and customs)
- ☐ Full ingredient list (INCI names) — required for product notification in Vietnam, Cambodia, Laos
- ☐ Formula breakdown with percentages (ranges acceptable — "Aqua 60-70%," "Niacinamide 4-6%")
- ☐ Stability test results (accelerated aging data)
- ☐ Microbial challenge test (Preservative Efficacy Test) — proves the preservative system works
- ☐ Heavy metals test results (if applicable)
- ☐ Free sale certificate or equivalent — may be required by some ASEAN regulators
💡 From the Manufacturer's Bench
What real quality looks like: At UbitGlow, every production batch generates a COA with 12+ test parameters — pH, viscosity, specific gravity, appearance, odor, TAMC, TYMC, pathogen screen (4 species), preservative efficacy, and more. More importantly, we maintain a CAPA log (Corrective and Preventive Action) — a running record of every quality issue, investigation, and corrective action. If a viscosity reading is 5% off spec, it's logged, investigated, and resolved. This system is what separates genuine GMP from paper compliance.
What to ask: "How do you handle an out-of-specification test result? Can you describe your CAPA process?" A real quality manufacturer can answer this in detail. One without real systems will give you a vague answer.
Request Our Quality Documentation Package
We'll share our ISO 22716 certificate, a sample COA, and our QC testing protocols — so you can see what real quality looks like before you commit.
Request a Sample →