A brand that receives an ISO 22716 certificate from a factory has received a statement about one audit, at one site, on one date, not a promise about every batch the factory will ever fill. The document proves the auditor was shown a system that met the standard on the day; it does not prove the next production order ran inside that system. Reading the certificate as a batch guarantee is the first mistake a new buyer makes, & it is the mistake that costs the most later when a question arrives about a product already on sale.
This article sets out how a brand should read an ISO 22716 audit report: where the scope stops, how long the certificate stays useful, what a finding actually tells you, & what the report can never tell you on its own. It is written for the person who has to decide whether to approve a supplier, not for the person who wrote the standard. The wider document set a brand should hold alongside the audit is covered in our guide to OEM documents, & the difference between the build models a factory offers is set out in our OEM, ODM & private label explainer.
Why a certificate is only a view of the audit scope
A certificate is a photograph of a system at a moment. The standard sets good manufacturing practice for cosmetics; the certificate says a named site was assessed against it on the audit date. It covers the premises, the people, the documents the auditor could see, & the steps the auditor chose to sample. It does not cover the order you place next year, the line you never visited, or the partner site the factory used for one step.
The practical effect is that the certificate ages from the day it was issued. An audit done two years ago describes a site that may have changed staff, lines, material sources, or managers since. The date on the certificate is the start of the question, not the end of it. A brand should write the audit date next to the certificate & ask what has changed in the building since that day.
This matters because the cost of a gap appears long after the paperwork is filed. A retailer audit, a market authority request, or a customer complaint can arrive eighteen months after launch, & at that point the only useful document is one that describes the system as it stands, not as it stood when the photographs were taken. A certificate read as a running warranty hides that gap.
Audit scope: drawing the site boundary
ISO 22716 is applied to a site. A certificate that names one legal entity & one address does not cover a second building across the road where filling happens, nor a warehouse run by a different company. The scope line on the certificate is the first place to look, & a brand should read it before reading anything else, because the name on the purchase order is not always the name on the certificate.
Many factories subcontract steps. Printing, secondary packing, or bulk manufacture may sit with a partner whose own certificate is separate. The brand's product can pass through three sites, each holding its own paper, & only one of them carries the name on the order. Ask which steps happened where, & ask for the certificate of each site that touched the product, because a single certificate rarely covers a subcontracted chain.
The trap is a certificate that lists "manufacture of cosmetics" without naming the forms. A site approved for liquids may not be approved for the anhydrous balm you planned, & a site approved for bottles may not cover the capsule format you want. Scope is specific to the form; read it as a list of what was seen, not as a blanket cover for everything the factory ships.
Certificate validity: what the dates mean
A certificate carries an issue date & an expiry. The expiry is set by the certifying body, not by the brand, & the brand should record it in the document register so a renewal is not missed. A certificate past expiry is not evidence of a current system; it is evidence of a system that was current once, & a site that lets a certificate lapse between orders is a site the brand is buying from on faith.
The accreditation behind the certificate matters as much as the date. A certificate issued by a body recognised in the brand's target market carries weight with that market's authority; a certificate from an unknown body may satisfy the brand's file but not the retailer's questionnaire. The brand should confirm which bodies the destination accepts before relying on the paper, because a certificate the market will not read is a certificate with no function.
Some certificates are valid only for the site & the standard named. A factory that also holds a different scheme for a different product line should not be read as covered by the cosmetics certificate. The brand should ask for the specific certificate that matches the product & the site, rather than assume one certificate covers all output, because the assumption is exactly where a scope gap hides.
Findings, observations, corrective actions
An audit report lists what the auditor found. Findings range from a missing signature to a broken temperature record, & each is normally graded. The grade tells the brand how serious the gap was, not whether it was closed. A report with no findings is possible, but a report with findings that were all closed is more useful than a clean report that hides nothing because it looked at little.
The corrective action is the part a brand should read closely. A finding without a dated correction, a named owner, & evidence of the fix is a finding that may still be open. The brand should ask for the corrective action record, not only the certificate, because the certificate can be issued before every item is resolved, & a closed headline can sit above an open file.
A useful report shows the root cause, not only the symptom. "The log was not signed" is a symptom; "the log had no space for a signature & the training did not cover it" is closer to a cause. The brand that reads only the headline grade misses the difference between a one-off slip & a system gap, & the difference is what decides whether the problem returns on the next order.
Major findings compared with minor findings
Audit schemes grade findings by the risk they pose to product quality or to the standard. A major finding normally points to a breakdown that could affect the product; a minor finding points to a lapse with limited reach. The grade is the auditor's call, & the brand should read the reasoning, not only the label, because two auditors can grade the same gap differently.
The practical distinction is what each grade requires. A major finding usually blocks certification until closed; a minor finding may allow issuance with a plan to fix. A brand that sees a major finding should regard the site as not yet approved for the affected step, & should ask for proof the step was brought into line before placing an order that depends on it.
A cluster of minor findings in one area can matter more than a single major elsewhere. Ten small gaps in traceability add up to a system that cannot answer a recall question, even if none alone looks serious. The brand should weigh the pattern, not the count, & should note where the gaps sit, because a pattern names the weak process a headline grade will not.
How a supplier audit report is produced
An audit is a visit, a document review, & an interview, normally on site. The auditor samples records, walks the line, & checks that the written system matches the practised one. The report reflects what was sampled; a site that prepares one line well & runs others loosely can look strong on the day, & a brand that never asks the sampling plan reads a narrow view as a wide one.
The brand should ask who performed the audit. A report from the factory's own staff is an internal check, not an independent one; a report from a recognised third party carries more weight with a market authority. The brand should know which kind it holds, & should state which kind its retailer requires, because the two are not interchangeable in a submission.
The depth of the sample sets the value of the report. An audit that reviewed every batch record for a quarter tells more than one that reviewed two. The brand should ask the sampling plan, because the conclusion is only as wide as the sample, & a narrow sample supports a narrow claim that a broad launch should not rest on.
What an audit report can prove
A clean audit with closed findings proves the site had a working system at audit time. That is a real asset: it shows the factory could name its materials, record its batches, & correct a gap when one appeared. For a brand choosing a first supplier, it is the strongest single document in the file, & it answers the question a retailer asks first.
The report also proves intent. A site that holds a current certificate, a corrective action log, & a schedule of internal audits is one that regards the standard as routine rather than as a hurdle. The brand can read the paper trail as a signal of how the site will behave on a normal Tuesday, not only on audit day, & that signal is worth more than a one-page statement.
For a market submission, the audit supports the broader file. Authorities that ask for evidence of good manufacturing practice accept a current certificate as part of the dossier, & a retailer that runs its own questionnaire will cross-check the brand's certificate against its list. The report earns its place by answering a question the authority already has, not by creating a new one.
What an audit report cannot prove
The report cannot prove that your batch was made inside the system. It proves the system existed; it does not prove the order you placed was run by it. A site can hold a fine certificate & still ship a batch made on a line it forgot to document. The batch record, not the audit, is what ties your product to the system, & a brand that skips the batch record owns a gap it cannot see.
The report cannot prove stability. Good manufacturing practice covers how a product is made, not how long it stays good; those are separate files. A brand that reads an audit as stability evidence has mixed two duties, & will find the gap when a shelf-life claim is challenged with no real-time data behind it. The audit & the stability study answer different questions.
The report cannot prove the formula is yours, the claim is lawful, or the label is correct. Those sit with the specification, the claim file, & the artwork check, none of which an audit of the site covers. The certificate is one leg of a stool; a brand that stands on it alone falls, & the fall happens at the point a second document was expected & missing.
Questions to ask before you rely on a report
Before a brand files an audit as proof, it should ask four things. Which site & which steps does the certificate name? Is the body recognised where the product will sell? Are the findings closed with evidence? Has anything changed since the audit date? Each question turns a flat yes into a usable fact the brand can file with the certificate.
A fifth question is who will hold the answer. The brand should name the person inside its own team who owns the supplier file, & should confirm they stay in post longer than the launch. A certificate filed by someone who has left is a document no one will find when the question arrives, which is the worst time to discover the file is cold & the name on it has moved on.
A sixth question is renewal. The brand should set a calendar entry before the expiry, & should ask the factory for the renewed certificate as a condition of repeat orders. A site whose certificate lapses between orders is a site the brand is buying from on faith, & faith is not a control a market authority will accept in place of a current document.
Audit documents a brand should hold together
A certificate is stronger next to the records it points to. The table below sets common audit-related documents against the question each answers, what it proves, & what it cannot. The rows are a working list, not a fixed rule; the exact set depends on the market & the product, & should be confirmed with the competent authority & a qualified professional before the product is placed on sale.
| Document | Question it answers | What it proves | What it cannot prove |
|---|---|---|---|
| ISO 22716 certificate | Did the site meet the standard on audit day | The system existed at audit time | Nothing about later batches |
| Audit report with findings | What the auditor saw & noted | Specific gaps observed | Whether the gaps were closed later |
| Corrective action record | Was a finding addressed | Closure of a named item | That the fix holds over time |
| Supplier declaration | Does the supplier state conformance | A stated position | Independent verification of the claim |
| Batch manufacturing record | How a specific order was made | Trace to material lots | The site system as a whole |
| Certificate of analysis | Did a lot meet release limits | Lot-level test results | The full factory process behind it |
| Internal audit schedule | Do checks repeat | A cadence of review | The depth of each check done |
The table is a comparative map, not a set of fixed values. A brand should regard the documents as a linked set, because a certificate without the corrective action record behind it, or a batch record without the audit that framed the system, leaves a question the other half would have answered. The useful test is whether one batch code can be walked through the whole set without asking anyone to interpret a note.
What to put in the brief
State the markets the product will reach, because that single line changes which certificate body the file must carry & how deep the audit evidence needs to be. Name the person inside your team who will own the supplier file, & confirm they stay in post past the launch, so the document is alive when the question arrives rather than cold in an archive no one opens.
- The markets the product will sell in, & any planned within two years.
- The site & steps you expect the factory to perform, including any subcontracted work.
- Whether you need the audit certificate per site or accept a group certificate with named sites.
- The certifying body your market or retailer recognises for this product.
- The corrective action records you require, & how closed findings are evidenced.
- The document owner inside your team & how long they hold the file.
- The renewal date you will track, & who requests the updated certificate.
- The linked records you want with the audit: batch record, certificate of analysis, retention register.
Then agree how a certificate request will be handled once production is routine. The useful arrangement is a named contact at the factory, a defined response time for a document request, & a quarterly reconciliation that confirms the certificate, the corrective action log, & the batch register still agree with each other before the expiry passes unnoticed.
Where our capability fits
We hold a current site certificate & the corrective action log behind it, & we can show which steps happen on our site & which pass to a named partner with its own paper. Where a step is subcontracted, we name it at the brief stage so the brand knows which certificate covers which part of the product, & we supply the batch record that ties your order to the system the audit described.
We work with brands on private label (your brand on a proven base), OEM/ODM contract manufacturing & full custom formula development, & the audit file is built with the batch record from the first order. Our lines include a clear botanical facial toner, a botanical facial treatment oil & a centella gentle cleanser, each produced under the same documented system with retention samples kept for the labelled life.
Tell us the markets & the sites your product touches, & we will come back with the certificate, the corrective action record & the batch evidence you need before launch. Start at our inquiry page, email capsulebiotech@163.com, or message the right team on WhatsApp: Capsule Series (capsules only) +86 158-7655-5319, Cosmetics Series (serum, hair care, body care, fragrance) +86 158-7655-5319.
General manufacturing information, not regulatory or legal advice. Audit scope, certificate validity & the bodies each market recognises vary by product & by destination, & the applicable position should be confirmed with the competent authority & a qualified professional before a product is placed on sale.