You can audit a skincare manufacturer’s certifications by first confirming which certificates match your target market, then verifying each one is valid, in-scope and issued by an accredited body — not by trusting a logo on a website. For most export-focused brands, the practical shortlist is ISO 22716 (cosmetic GMP), GMPC, US FDA establishment registration, EU CPNP notification and China NMPA filing. Below is how to read each one and what to check before you sign.
Which certifications actually matter for a skincare manufacturer?
Not every certificate on a factory’s wall is relevant to your product. The ones that tend to matter for cross-border skincare are tied to how the product is made and where it will be sold.
| Certificate | What it signals | Where it applies |
|---|---|---|
| ISO 22716 | Cosmetic Good Manufacturing Practice | Global baseline |
| GMPC / GMPC-US | US-oriented GMP expectation | United States, often referenced |
| FDA establishment registration (VCRP) | US facility and product listing, not approval | United States |
| EU CPNP notification | Mandatory pre-market notification | European Union |
| China NMPA filing / registration | Filing for general cosmetics | Mainland China |
Why does this matter? A GMP certificate is the part of a factory’s credibility you cannot see on the shelf. It is what protects you when a batch behaves differently from the sample, because traceability and complaint handling are exactly the systems a GMP audit checks.
What does each certificate actually cover?
A common mistake is to read "certified" as "approved for my market." The certificates below govern different things, and none of them is a verdict on whether your formula works.
- ISO 22716 is a cosmetic GMP standard. It sets out how the product is manufactured — hygiene, traceability, complaint handling — not whether the formula is effective.
- GMPC follows a similar logic; many Chinese factories hold GMPC-US alongside ISO 22716, which satisfies buyers used to the US framing.
- FDA establishment registration (VCRP) lists the facility and product with the FDA. It is a registration step, not pre-market approval, and it does not mean the FDA endorsed your formula.
- EU CPNP is a notification portal. Filing it is mandatory before sale in the EU, but it is an administrative step rather than a safety certificate.
- China NMPA filing / registration is required for general cosmetics before import; certain claims or ingredients can trigger registration or extra review.
How do you verify a certificate is real and current?
A logo on a homepage proves little. Treat each certificate as a claim that needs its own evidence.
- Ask for the actual certificate PDF, not a cropped screenshot.
- Check the accrediting body and the scope — does it cover your product type and the site that will actually make your order?
- Confirm the validity dates; certificates expire and are sometimes shown years after they lapsed.
- Where an official lookup exists (FDA VCRP, the CPNP reference, NMPA), cross-check the registration or filing number.
- Watch for certificates issued to a different legal entity or a different site than the one producing your batch.
What are the red flags during a facility audit?
Some warnings show up before you ever see the production floor.
- A certificate is shown, but no valid number or accrediting body is named.
- A GMP certificate covers storage only, not manufacturing.
- The factory cannot show batch records, incoming-material control or a complaint-handling process.
- You are pressured to skip documentation "to save time."
- Your order is subcontracted to a site that does not hold the certified status.
How should you match certifications to your target market?
One certificate rarely covers every market, so align the paperwork with where you will actually sell. Keep a simple matrix: list each target market in one column and the required certificate in the next, then tick whether your shortlisted factory holds the current version for that site.
- European Union: CPNP notification is mandatory and ISO 22716 is the expected GMP benchmark.
- United States: FDA establishment registration plus solid manufacturing documentation; drug-style claims change the rules entirely.
- Mainland China: NMPA filing or registration is required before import.
- Southeast Asia: requirements differ by country (for example, notification in Thailand and Malaysia), so confirm per market.
- Assume a certificate from one region does not automatically satisfy another — verify for each target.
A practical tip: keep your own certificate file per factory — the PDF, the scope page, the validity dates and the lookup reference in one place — so you can re-check before every reorder instead of trusting memory.
If you are comparing contract manufacturers and want a second read on which certificates actually match your launch markets, our technical team can review your shortlist against your target regions before you commit.