Somewhere between the sample you approved and the pallet on your dock, a document arrives that most brand owners skim. It is the certificate of analysis, and it is the only point in the process where saying no is cheap.
In December 2025, the FDA sent a warning letter to Private Label Skin Care, Inc. of Canoga Park, California. The finding is worth reading twice: after the contract manufacturer notified the firm of elevated impurities, the firm kept distributing affected batches and only recalled after the FDA intervened. The agency cited the brand for failing to establish an adequate quality control unit with authority to approve or reject components.
The FDA held the company whose name was on the label responsible for the quality decision. Not the factory.
What the document is, and what it is not
A specification is the agreement. A COA is the evidence that one particular batch met it. Without a written specification, the COA is a page of numbers with nothing to compare them against, and a passing result means only that the lab found what it found.
The FDA’s draft cosmetic Good Manufacturing Practices guidance, first issued in 1997 and still draft today, recommends that batch production records document every ingredient by name, code, lot number, and quantity, every production step, in-process sampling, the finished lot number, and the accept-or-reject status. Finished product testing should verify identity, compliance with physical and chemical specifications, microbial contamination, and chemical hazards.
That list is your checklist, whether or not a binding US rule ever arrives. MoCRA’s GMP rule was statutorily due in December 2025 and has not been proposed; the Spring 2025 Unified Agenda moved it to long-term actions with no target date. In its absence, ISO 22716 is the standard buyers actually audit against.
The lines to read first
Microbial results. ISO 17516:2014 is the only international standard setting numeric microbial limits for cosmetics. Category 1 products, meaning those for children under three, the eye area, or mucous membranes, cap total aerobic count at 100 CFU per gram or milliliter. Category 2, everything else, caps it at 1,000. Both require absence of E. coli, Pseudomonas aeruginosa, Staphylococcus aureus, and Candida albicans in one gram.
Here is the trap. USP chapter 1111, which many contract labs apply by analogy, sets a total aerobic count of 100 and a separate yeast and mold count of 10 for cutaneous preparations. That yeast and mold line is far tighter than ISO 17516’s single combined count, so a batch can pass ISO and fail a USP-style specification. Find out which standard your spec cites before you argue with anyone about a result. USP chapters 61 and 62, meanwhile, are test methods rather than limits: if your COA cites them without an acceptance criterion, the number is floating.
The FDA sets no numeric microbial limits for cosmetics at all. Its position is that a product is adulterated if prepared, packed, or stored under conditions where it may have become contaminated.
pH. This is the cheapest number on the page and the one most likely to catch a mischarged batch, because pH moves when a raw material lot is wrong, a dosing step is off, neutralization is incomplete, water quality drifts, or microbial activity has started.
It is also the number most often reported uselessly. pH is temperature dependent in two separate ways: the electrode’s response changes with temperature, and the sample’s actual chemistry changes with it. Mettler-Toledo’s pH theory guide gives a clean example, a dilute sodium hydroxide solution reading 11.17 at 20 degrees Celsius and 10.83 at 30. That is a real chemical shift, not measurement error.
For surfactant systems, the convention is potentiometric measurement of a diluted solution, and published shampoo work reports results on 10% solutions. So “pH 5.5” on its own is not a specification. “pH 5.2 to 5.8, measured on a 10% aqueous solution at 25 degrees Celsius” is one.
Different formats sit in different windows for real formulation reasons, which is why a number that looks alarming in isolation may be exactly right for the product. A true soap bar is alkaline by chemistry, and the discussion of ph of soap is a useful illustration of why a spec range has to be set against the format rather than against a generic ideal.
Heavy metals. The FDA recommends a maximum of 10 ppm lead in externally applied cosmetics, in a draft guidance announced in December 2016. Most contract manufacturers write to Health Canada’s schedule instead, which treats lead above 10 ppm, arsenic and cadmium above 3 ppm, antimony above 5 ppm, and mercury above 1 ppm as technically avoidable.
What belongs in the file but not on the COA
Challenge testing. Preservative efficacy testing is a formula-level test, not a per-batch line. USP 51 runs 28 days and, for topical aqueous products, requires at least a 2-log bacterial reduction by day 14 with no increase through day 28. ISO 11930:2019 samples at days 7, 14, and 28. Budget five to six weeks from sample receipt to report, and repeat it whenever the formula, preservative system, packaging, or pH changes.
Stability. ISO/TR 18811:2018 deliberately declines to specify conditions or acceptance criteria, leaving the manufacturer to justify a protocol. The industry’s own Colipa and CTFA guideline is refreshingly blunt: there is very little generally applicable published research supporting specific accelerated methods for predicting cosmetic shelf life. Anyone who tells you three months at 45 degrees Celsius equals a year on a shelf is quoting a rule of thumb, not a validated conversion.
Retention is a contract term, not a law
For cosmetics there is no US retention number. The FDA’s draft guidance says only that samples of approved lots are retained for an adequate period. For anything that is also an OTC drug, 21 CFR 211.170 requires reserve samples held one year past expiry, or three years after distribution where no expiry is declared. The EU requires the product information file for ten years after the last batch was placed on the market.
So negotiate the number into your manufacturing agreement. Shelf life plus one year is a defensible floor, three years where no expiry is declared, ten if you might ever sell into Europe.
The short version
Write the specification before the run. Read the COA against it, line by line, before release. Ask what standard each limit comes from and what method produced each number. Keep the supplier COAs, because under MoCRA they form part of the safety substantiation file you are required to maintain.
Good partners expect this. Development-stage conversations with a serious co-manufacturer, whether you are commissioning a beverage, a lotion, or custom soap, usually start with specifications and testing protocols rather than price, precisely because the spec is what everything else gets measured against later.
