Why Failure Investigations Still Break Down for Cosmetic Manufacturers, and What MoCRA Changes About the Stakes

Key Insight

CAPA remains the number one cited observation by the FDA for 2024 among companies that received an official action indicated (OAI) designation from inspections, according to Keisha Thomas of the FDA speaking at the FDLI Enforcement, Litigation and Compliance Conference in December 2024. The finding applies across regulated industries, but for cosmetic manufacturers it lands at a particularly consequential moment.

The Modernization of Cosmetics Regulation Act of 2022 (MoCRA), the first substantial update to US cosmetics regulation since 1938, introduced formal adverse event reporting requirements, facility registration, product listing obligations, and forthcoming GMP rules that will bring FDA’s quality system expectations for cosmetics significantly closer to those that already apply to drugs and devices. For cosmetic manufacturers that have operated without formal investigation and CAPA systems, MoCRA is not just new paperwork: it is a structural shift in what the FDA can observe and enforce.

Supporting Data

The pattern of CAPA failures in FDA inspections is well-documented and consistent. According to Compliance Architects’ analysis of FDA inspection trends, several recurring deficiencies appear across companies of all sizes:

Inconsistent implementation across sites and product lines is the most common systemic gap. Companies with multi-site or multi-region manufacturing often have CAPA processes defined on paper but not applied uniformly in practice.

Inadequate trend analysis is the second most frequently cited gap. FDA expects robust data mining and trend analysis to identify recurring quality problems before they escalate to significant failures. Many companies lack either the systems or the trained personnel to do this reliably.

Incomplete investigations are the third category. According to FDA’s inspection data and the ECA Academy’s review of April 2026 Warning Letters, investigators frequently encounter investigations that document what happened without adequately establishing why it happened. A February 2024 FDA Warning Letter to Cosmetic Specialty Labs, Inc. explicitly requested “a comprehensive, independent assessment of your overall system for investigating deviations, discrepancies, complaints, OOS results, and failures” alongside improvements in “investigation competencies, scope determination, root cause evaluation, CAPA effectiveness, and Quality Unit oversight.”

A particularly instructive recent example comes from an April 2026 Warning Letter to Active Cosmetics Manufacturing Inc., highlighted by the ECA Academy. FDA cited the manufacturer for releasing product batches after out-of-specification (OOS) microbiological results were followed by passing retests, with no formal investigation into the original OOS result. FDA’s position, consistent across Warning Letters for years, is that “passing retest results alone cannot serve as the basis for invalidating OOS results.” The remediation FDA requested was telling: not a better form, but a better system, including independent retrospective reviews, stronger root cause evaluation, and improved Quality Unit oversight.

The MoCRA context adds a new dimension. Serious adverse events associated with cosmetic products must now be reported to the FDA within 15 business days of the manufacturer receiving information about the event, and records of health-related adverse events must be kept for at least six years. Those adverse event records are inspectable. A cosmetic manufacturer that receives a consumer complaint about a skin reaction, fails to properly investigate it, and then faces an FDA inspection now has a compliance exposure that did not exist under the pre-MoCRA framework.

Analysis

The persistence of CAPA as the top FDA inspection finding is not a mystery, and it is not because the regulated community doesn’t know CAPA exists. The breakdown happens at the points where CAPA requires the most difficult organisational behaviours: thorough investigation when the business is under schedule pressure, genuine root cause analysis when the obvious explanation is more comfortable, and documented corrective actions that get implemented and verified rather than filed and forgotten.

For cosmetic manufacturers specifically, the structural challenge is that the industry operated for decades without the quality system infrastructure that pharmaceutical and device companies were required to build. Where a drug manufacturer has formal OOS investigation procedures, a cosmetics company may have informal complaint-handling practices. Where a device manufacturer has a documented CAPA procedure reviewed in every FDA inspection, a cosmetics company may be setting one up for the first time in response to MoCRA.

The core gap: A failure investigation system that functions under routine conditions tends to break down under the conditions where it matters most: high-volume production pressure, complex multi-factor failures, and situations where the “obvious” cause would implicate a production process or supplier relationship that the business prefers not to revisit.

The ECA Academy’s analysis of the Active Cosmetics Warning Letter identifies four failure modes that recur across inspection findings and are directly applicable to cosmetic manufacturers building or upgrading their systems:

First, the tendency to treat retesting as investigation. When an OOS result is followed by a passing retest, many organisations close the inquiry. FDA’s consistent position is that the OOS result itself requires investigation: was it a laboratory error, a sampling issue, or a genuine signal from the product? Each answer leads to a different corrective action.

Second, the scope problem. Investigations that address the specific batch or lot in question, without asking whether the same root cause could affect other batches, products, or processes, produce CAPAs that are technically complete but practically insufficient. FDA expects a “comprehensive drug product impact assessment” (or, by analogy for cosmetics, a product quality impact assessment) covering all potentially affected material.

Third, the “probable cause” problem. An investigation that identifies a likely cause without evidence to support that identification produces preventive actions that address the wrong thing. If the actual root cause was a raw material supplier control failure but the investigation documents “human error” because it was more convenient, the CAPA will not prevent recurrence.

Fourth, the QU oversight gap. Quality Unit oversight of investigations is itself an FDA expectation, not optional. Where the QU is understaffed, undertrained, or deprioritised in the investigation workflow, the entire system degrades.

Impact

For cosmetic manufacturers, the combination of MoCRA’s adverse event reporting requirements and the FDA’s established inspection focus on CAPA creates a specific exposure chain:

A consumer complaint triggers an adverse event report (15-business-day timeline under MoCRA). The adverse event report and all related records are now inspectable by FDA under MoCRA’s expanded inspection authority. An FDA inspection reviews the manufacturer’s investigation of the adverse event. If that investigation is superficial, incomplete, or produces a CAPA that isn’t implemented or verified, the inspection finding is now inside a regulatory framework with genuine enforcement teeth, including mandatory recall authority that MoCRA gave the FDA for the first time.

Public access to adverse event reports submitted under MoCRA, without requiring a Freedom of Information Act request, also increases civil litigation exposure. A manufacturer whose adverse event report documents a complaint about a skin reaction and whose quality records show an inadequate investigation has created a discoverable paper trail in any subsequent product liability case.

The GMP rule that MoCRA required FDA to finalise by December 2025 has been delayed and is currently listed as a long-term action. However, FDA inspectors are already applying quality system expectations informed by existing pharmaceutical GMP frameworks when inspecting cosmetic facilities. The absence of a final cosmetic GMP rule has not produced a period of enforcement grace; it has produced a period of uncertainty in which manufacturers do not know exactly what the final requirements will look like, but inspectors are already looking.

Recommendations

Build the investigation system before the adverse event arrives. MoCRA’s 15-business-day adverse event reporting requirement is a deadline that runs from when the manufacturer receives information about the event. A manufacturer that receives a consumer complaint about a serious skin reaction and spends the first two weeks figuring out its investigation procedure has already consumed most of the reporting window before any actual investigation has begun.

Treat every adverse event report as a CAPA trigger. Under MoCRA, serious adverse events are defined specifically and must be reported. But every reportable event should also be fed into the CAPA system. A manufacturer who reports an adverse event to FDA without initiating a formal investigation into the product or process that caused it has met the reporting obligation but created a future inspection gap.

Separate the initial complaint investigation from the root cause analysis. These are two distinct activities. The initial investigation assesses whether an event is reportable and what immediate containment is needed. The root cause analysis, which may take longer, determines why the event occurred and what systemic change is needed to prevent recurrence. Conflating them under time pressure produces shortcuts in both.

Invest in scope assessment as a formal investigation step. Every investigation should include a documented assessment of whether the same root cause could affect other batches, products, or processes. This is what FDA means when it asks for an impact assessment, and it is consistently absent in investigations that generate repeat findings.

Verify CAPA effectiveness. Corrective and preventive actions that are implemented but not verified are a documented liability. Verification of Effectiveness (VoE) checks should be built into the CAPA procedure with specific timelines and criteria, not left as a theoretical final step that is rarely completed.

Future Outlook

The cosmetic GMP rule that MoCRA required by the end of 2025 is now listed as a long-term regulatory action, with no proposed date. Crowell and Moring’s analysis from April 2026 notes that FDA is expected to issue a proposed fragrance allergen labelling rule in May 2026, and that the GMP rule delay reflects broader regulatory resource constraints, not a reduced priority.

For cosmetic manufacturers, this means the transition period between the pre-MoCRA world and a fully formalised GMP-regulated world is longer than originally expected. That extended timeline is not a reason to delay building quality systems: it is an opportunity to do so before enforcement intensity increases, with the adverse event reporting infrastructure (which is already in effect) creating the audit trail that inspectors will review when GMP rules are eventually finalised and enforced.

The industry direction is clear regardless of the specific rulemaking timeline. FDA’s authority over cosmetics has been permanently expanded. Adverse events are now reportable and inspectable. Recall authority exists. The quality system expectations that pharmaceutical manufacturers have lived with for decades are arriving in cosmetics on a schedule that MoCRA set and that the FDA is working toward, even if more slowly than the statute required.