Blog

You are currently viewing ISO 22716 for Cosmetics Manufacturers: HSA’s SMF Comes First

ISO 22716 for Cosmetics Manufacturers: HSA’s SMF Comes First

  • Post author:
  • Post category:Skincare

ISO 22716:2007 is the international GMP guideline for finished cosmetic products, and it covers manufacture, control, storage and shipment while leaving out research and development and distribution. If you want to comply, start with a gap analysis against its clauses and prepare a Site Master File, because that document anchors any regulator or buyer assessment.

TL;DR:

  • Certification is not issued by ISO; independent bodies assess documentation and site operations, and certificates can last up to three years with annual surveillance audits.
  • For Singapore manufacturers, HSA’s voluntary scheme requires a Site Master File, and assessment timelines typically range from a few months to about six months.
  • Contract manufacturers, EU exporters, and major retail suppliers face buyer demands; small direct brands can start with the Site Master File and QC evidence.
  • Sites already certified to ISO 9001 can reuse document control, internal audits, and management review, adding cosmetic controls such as line clearance and batch hygiene.
  • A visual cleaning check alone rarely satisfies auditors; verify shared equipment with swabs or rinse water tests and record the results.
Harmonyskinlab
Build Skincare with GMP-Certified Manufacturing
Harmony Skin Lab is a Singapore-based GMP-certified manufacturer offering product design, customized formulation, quality control, and packaging solutions.

Visit Harmony Skin Lab

Table of Contents

What ISO 22716 covers and who needs to apply it

ISO 22716:2007 is the internationally accepted guideline for good manufacturing practices in cosmetics. It was confirmed in 2022 and sets out what a well-run site looks like from raw material receipt through to shipment of the finished product. The text is short, and the printed standard runs to only a couple of dozen pages, which is part of why it scales to both small workshops and large plants.

The boundaries matter. The standard does not apply to research and development or to distribution of finished products, so a brand that only formulates in a lab or only resells stock sits outside it. Everything that happens on the production floor and in the warehouse before the product leaves your control sits inside it.

In practice, the standard is relevant to:

  • Manufacturers of finished cosmetic products, whether they make their own brands or work under contract.
  • Contract packagers and fillers who handle product before it reaches the market.
  • Sites that store and ship finished goods on behalf of a brand owner.
  • Private label brands that want to judge whether their manufacturing partner meets a recognised benchmark.

The standard is a guideline, not a statute. Whether it becomes a hard requirement depends on your buyers and your export markets, which later sections cover.

What are the core ISO 22716 requirements?

The clauses translate into practical checks. Run your own site against each one and note where the evidence is thin.

  1. Personnel and hygiene. Staff are trained for their tasks, responsibilities are defined in writing, and gowning and handwashing procedures are followed, as practitioner guidance on the standard describes.
  2. Premises and equipment. The facility layout limits contamination, equipment is cleaned and maintained to a schedule, and cleaning is recorded.
  3. Raw materials and packaging. Incoming goods are checked, quarantined until released, stored correctly and traceable to an approved supplier.
  4. Production SOPs and batch control. Written procedures cover each step, labelling is controlled and line clearance prevents mix-ups between products.
  5. Quality control and stability. The QC laboratory uses validated methods, release criteria are fixed in advance, and HSA’s advisory for suppliers expects testing for prohibited or restricted ingredients and microbial contaminants.
  6. Documentation and traceability. Batch records and retention rules let you trace any unit back through its ingredients, which makes complaints and recalls manageable.
  7. Complaints, non-conforming product and recall. Procedures for handling complaints, rejected batches, reprocessing and recall exist in writing and are rehearsed, not just filed.

Pro Tip: Pick one finished batch at random and trace it backwards from the shipping record to every raw material lot. If you cannot trace it promptly, your traceability needs work before any auditor arrives.

What does “ISO 22716 certified” actually mean?

ISO publishes the guideline but does not issue certificates. Certification is carried out by independent third-party bodies, and the result is a statement that your processes conform to the guideline, not a licence granted by ISO itself.

A typical certification path runs through these stages:

  • An optional preliminary audit or gap analysis to see where you stand.
  • A Stage 1 review of your documentation.
  • A Stage 2 on-site audit of how the site actually operates.
  • Issue of the certificate, valid for up to three years.
  • Annual surveillance audits and recertification at the end of the cycle.

Many buyers expect GMP compliance, and in some markets major retailers and distributors increasingly ask for ISO 22716 evidence during supplier onboarding, even where no law demands it. That makes certification a commercial requirement in practice.

In Singapore, HSA operates a voluntary GMP certification scheme for local cosmetic manufacturers. Applicants submit a Site Master File for assessment, and HSA publishes its GMP certificate details for local manufacturers alongside templates and guidance notes. Timelines usually run from a few months to about six months, depending on how mature your existing systems are.

How do you implement ISO 22716 step by step?

Treat implementation as a project with an owner, a schedule and a definition of done. This sequence works for most sites:

  1. Run a gap analysis against each clause of the standard and your current quality system. Note every missing record, not just missing procedures.
  2. Prepare the Site Master File. HSA’s SMF guidance says it must hold factual GMP information about the site’s activities, the types of products made, licences, any hazardous substances and the facilities in detail.
  3. Write or update SOPs, batch records and supplier files. Match what the documents say to what operators actually do on the floor.
  4. Collect test evidence. Gather stability and microbial results and validated QC methods so they can be shown on request.
  5. Run internal audits and close every finding with a recorded corrective action.
  6. Hold a management review, then book an external verification or certification audit if buyers or export plans require one.

For a manufacturer with basic quality systems, the time from kick-off to a completed initial assessment can vary with the site and its existing systems. Complex multi-line sites take longer, mostly because documentation takes longer than anyone budgets.

Pro Tip: Build the SMF early, even as a rough draft. Writing it forces you to describe your site factually, and the gaps it exposes are usually the same ones an auditor would find.

Is the investment in ISO 22716 worth it commercially?

For many manufacturers, yes, though the case differs by customer base. Experts at SGS describe implementation as strategic risk management that builds recognition and consumer trust and helps demonstrate safety and quality to buyers and regulators.

The benefits tend to show up in several areas:

  • Buyer and regulator confidence, which helps in export negotiations and large retail procurement.
  • Lower contamination, adulteration and recall exposure, because testing and recording requirements catch problems earlier.
  • Fewer batch failures, since documented processes remove guesswork between shifts.
  • Clearer supplier expectations and better traceability when something goes wrong.

It becomes close to essential for contract manufacturers, for exporters selling into the EU, and for anyone supplying large retailers. A small brand selling only through its own channel may reasonably phase the work, starting with the SMF and QC evidence. Our overview of the benefits of working with a GMP skincare manufacturer goes further on the commercial side.

How does ISO 22716 fit with ISO 9001?

If you already run ISO 9001, you have done a good share of the groundwork. Certification bodies recommend integrating the two because document control, internal audits and continuous improvement are shared foundations.

Start by mapping each ISO 22716 clause to a process you already operate, and rewrite only where a real gap appears. Then combine the internal audit programme and the management review, so your team prepares one cycle instead of two. The cosmetic-specific additions, such as batch hygiene controls, line clearance and cosmetic complaint handling, sit on top of the existing framework rather than replacing it.

What training and competency assessment does ISO 22716 expect?

The standard expects people to be trained for the work they do, and it expects you to be able to prove it. Practitioner guidance stresses that training covers both the GMP principles and the specific procedures each role performs.

A workable programme has several layers:

  • Induction. Every new starter, including temporary staff and visitors who enter production areas, learns hygiene rules, gowning and site access before touching product.
  • Role training. Operators, filling staff, warehouse handlers and QC analysts each get training on the SOPs they follow, delivered by someone competent in that task.
  • Competency checks. Sign-off comes from observation or a short practical test, not just a signature on an attendance sheet. A QC analyst, for example, should demonstrate a method on a known sample before reporting results.
  • Refresher cycles. Retrain when an SOP changes, after a deviation linked to human error, and at a fixed interval you define.

Keep a training matrix that links each role to its required SOPs, with dates and the name of the assessor. Auditors usually ask to see the record for a person they have just watched on the line, so keep records retrievable by name.

Which hygiene practices matter most in cosmetic manufacturing?

Hygiene in a cosmetics plant is mainly about keeping microbes and cross-contamination out of products that often contain water and nutrients. The standard is risk-based and aims to prevent contamination and mix-ups, so your practices should follow where the real risk sits.

Practical measures include:

  • Personal hygiene. Handwashing before entering production, clean protective clothing, hair covers and no jewellery. Staff with infections or open wounds are kept off exposed product.
  • Zoning. Separate raw material handling, manufacturing, filling and packing areas, with controlled movement between them.
  • Cleaning and sanitation. Written, scheduled cleaning of vessels, hoses, filling heads and surfaces, with the cleaning agent, contact time and verification recorded.
  • Water systems. Treat process water as an ingredient. Define how it is produced, stored, sanitised and monitored.
  • Pest control. A documented programme with inspection records.
  • Waste handling. Waste leaves production areas on a defined route that does not cross clean zones.

Cleaning verification is where many sites fall short. A visual check alone rarely satisfies an auditor, so add swabs or rinse-water tests for equipment that touches multiple products.

What does good supplier qualification look like?

Raw materials and packaging are where many quality problems begin, and experts at SGS point to supplier qualification programmes as a common gap in real audits. A defensible approach has several parts:

  • Approved supplier list. Only suppliers who have passed your qualification buy from you, and the list is reviewed on a schedule.
  • Qualification by risk. A supplier of a preservative or a colourant gets more scrutiny than a supplier of outer cartons. Use questionnaires, certificates and, for critical items, an audit.
  • Specifications. Every material has a written specification agreed with the supplier, and certificates of analysis are checked against it.
  • Incoming inspection. Check identity, quantity, labelling, seal integrity and certificate match on receipt. Hold material in quarantine until released.
  • Periodic testing. Verify supplier certificates by testing a proportion of deliveries yourself.
  • Performance review. Track rejects, late deliveries and complaints per supplier, and act when trends appear.

For packaging, add dimensional checks and compatibility with the formula, because a bottle that reacts with its contents can fail a stability study months later.

What do implementation challenges look like in practice?

Rather than a single named case, here are three patterns that recur when sites move towards ISO 22716, based on the gaps experts report most often.

Reprocessing without a procedure. A filling line rejects a batch for a minor fault and operators rework it, as they always have. The standard expects a written procedure for reprocessing, and SGS notes this is a frequent gap. The fix is a short SOP that says who authorises reprocessing, how it is recorded and what extra testing follows.

No independent quality unit. In small companies the production manager also releases batches. Separate the release decision from the pressure to ship, even if that means a part-time quality role with clear authority.

Documents that describe an ideal, not reality. Teams write polished SOPs that nobody follows. The remedy is to walk the line with the SOP in hand, correct the document to match safe practice, and retrain where practice needs to change.

In each case the solution was cheap compared with the cost of a failed audit or a recalled batch. Our guide to HSA GMP and skincare manufacturing standards covers the local expectations behind these examples.

Three ISO 22716 gaps and corrective actions

How should document control work under ISO 22716?

Document control means everyone uses the current version of every procedure, and you can show what was in force on any past date. The standard’s documentation and traceability requirements, along with HSA’s expectation of record-keeping and defect reporting, shape a simple set of rules:

  • Unique identification. Each document has a title, number, version and effective date.
  • Approval before use. A named, competent person reviews and approves each document, and the approval is recorded.
  • Controlled distribution. Operators work from the issued copy. Withdrawn versions are removed from work areas and archived.
  • Change control. Every change has a reason, an approver and a training step before the new version takes effect.
  • Batch records. Each batch has a record that captures materials used, equipment, process steps, checks and the release decision. Corrections are made with a single line, initials and date, never erased.
  • Retention. Define how long records are kept, and make sure that period covers at least the shelf life of the product plus a margin.

An electronic system helps, but a disciplined paper system passes an audit just as well. What fails is a mix of both with no rule on which is master.

Why we say GMP readiness works best as a shared effort

In our view, the best GMP programmes are built with the client rather than handed over as a template. A site that writes its own SOPs, understands its own records and has walked its own line follows the system far more reliably than one that adopted someone else’s binder. We are a GMP-certified OEM/ODM skincare manufacturer. We work with clients on documentation and audit readiness instead of pushing one fixed process onto every operation.

— Edmund

How we help manufacturers become GMP-ready

We support brands and manufacturers across skincare R&D and manufacturing, design and packaging, including formulation, QC and stability testing and documentation support. If you want a clear picture of where your site stands before an audit, current details are on our site, or you can ask us for a manufacturing quote.

Harmonyskinlab

FAQ

What is the ISO standard for cosmetics?

The ISO standard for cosmetics GMP is ISO 22716:2007. It gives guidelines for the production, control, storage and shipment of finished cosmetic products and was confirmed in 2022.

What is the difference between ISO 9001 and ISO 22716?

ISO 9001 is a general quality management standard for any organisation, while ISO 22716 is a GMP guideline written specifically for cosmetics manufacturing. They share foundations such as document control and internal audits, so integrating the two reduces duplicated effort.

What are the 5 P’s of Good Manufacturing Practices?

The 5 P’s are commonly given as people, premises, processes, products and procedures, though wording varies between sources. ISO 22716 does not use that list by name, but its clauses on personnel, premises and equipment, production, materials and documentation cover the same ground.

Is ISO 22716 certification mandatory?

Not by itself. ISO publishes a guideline, and in Singapore HSA’s GMP certification scheme is voluntary. Buyers and export markets may still require evidence of GMP compliance.

Sources