Cosmetic Manufacturer CAPA and Failure Investigations: 40+ Statistics 2026

VelSafe Insights

Failure Investigations and CAPA in Cosmetic Manufacturing: 40+ Statistics Under MoCRA Through 2026

CAPA deficiencies have appeared in 64% of FDA warning letters issued between 2022-2024 and CAPA has been the number one FDA inspection citation since fiscal year 2010. The Modernization of Cosmetics Regulation Act of 2022 (MoCRA) – the most significant change to U.S. cosmetic regulation since 1938 – has introduced mandatory serious adverse event reporting (within 15 business days), six-year record retention, mandatory facility registration and product listing, and an upcoming binding GMP regulation. With FDA’s enforcement of these requirements beginning in July 2024 and adverse event reports already tripling, cosmetic manufacturers face an investigation and CAPA environment fundamentally more demanding than what existed before 2022. This article compiles 40+ statistics on MoCRA’s enforcement status, what CAPA failure looks like in FDA’s own words, how root cause analysis breaks down, and what effective investigation programs do differently through 2026.

40+ Statistics

MoCRA 2024-26 Enforcement

CAPA #1 FDA Citation Since 2010

Root Cause Analysis Methods

64%

of FDA warning letters issued between 2022 and 2024 included CAPA deficiency citations – second only to validation failures and appearing in the FDA’s top 10 inspection observations every year since 2015

Assyro AI / FDA Group Warning Letter Analysis, March 2026

Increase in adverse event reports from the cosmetics industry since MoCRA’s mandatory serious adverse event reporting requirement took effect, per FDA’s own update on MoCRA implementation

FDA / Diaz Trade Law, May 2026

Since 2010

CAPA has been the number one FDA inspection citation every fiscal year – a 15-year consecutive run that reflects a structural gap in how quality systems treat investigation and corrective action

FDA Group Warning Letter Analysis; Invensis Learning, 2026

Before MoCRA, the U.S. cosmetics industry operated under a regulatory framework that had not been meaningfully updated since 1938. Product facility registration was voluntary. Adverse event reporting was not required. FDA had no mandatory recall authority. Quality standards were guidelines, not enforceable requirements. The result was an industry where failure investigation and CAPA systems – where they existed at all – were designed for internal quality management rather than regulatory compliance. That is no longer the case.

MoCRA’s serious adverse event reporting requirement, its six-year record retention mandate, its mandatory facility registration and product listing (enforced from July 2024), and the forthcoming binding GMP regulation mean that cosmetic manufacturers must now maintain investigation and CAPA programs that can withstand FDA scrutiny. The playbook for what that scrutiny looks like is well-documented in the pharmaceutical CAPA enforcement record: CAPA has been the top FDA inspection citation every year since 2010, appearing in 64% of warning letters between 2022 and 2024. The failures FDA cites are consistent, predictable, and preventable. Below we compile 40+ statistics on MoCRA’s enforcement posture, CAPA failure patterns from FDA’s own warning letters, root cause analysis methodology, and what effective investigation programs look like in 2026.

Editor's Choice: Key CAPA and MoCRA Statistics for Cosmetic Manufacturers

15 business days

MoCRA’s mandatory deadline for reporting serious adverse events to FDA. This is the trigger for opening a formal investigation: the event must be reported and documented, meaning the investigation must begin immediately – not after the report is filed. (MoCRA Section 605; FDA guidance)

6 years

Mandatory record retention requirement under MoCRA Section 605 for safety substantiation, complaint records, and investigation documentation. Investigation records that don’t exist or can’t be produced become evidence of inadequate quality systems. (MoCRA Section 605; Respect Manufacturing, 2026)

1 million+

Unique active cosmetic product listings on FDA’s database as of mid-2026, along with 15,000 unique active facility registrations – the first-ever comprehensive FDA map of the U.S. cosmetics manufacturing landscape. (FDA / Diaz Trade Law, May 2026)

Not a better form

ECA Academy’s May 2026 analysis of FDA’s April 2026 warning letters on CAPA failures: “the regulator is not asking for a better form; they are asking for a better system.” FDA’s requested remediation is systemic – independent retrospective reviews, stronger root cause evaluation, and Quality Unit oversight. (ECA Academy, May 2026)

0.41%

of total cosmetic products listed with FDA contained PFAS as of August 2024, per FDA’s own analysis using mandatory product listing data. MoCRA’s December 2025 PFAS safety report covered the 25 most commonly used PFAS in U.S.-marketed cosmetics. (FDA / Lumanity, May 2026)

July 1, 2024

FDA’s enforcement start date for mandatory facility registration and cosmetic product listing requirements under MoCRA. The six-month delay from the original January 2024 date (announced November 2023) has now expired – enforcement is fully active. (FDA; Diaz Trade Law, May 2026)

1. MoCRA in 2026: What Has Changed and What Is Still Coming

MoCRA Implementation Timeline: Active Requirements vs. Pending Rules

Active – July 2024

Mandatory facility registration and product listing enforcement began July 1, 2024. All domestic and foreign facilities making cosmetics sold in the U.S. must register. All products must be listed including full ingredient disclosure. FDA is enforcing these requirements.

Active – Ongoing

Mandatory serious adverse event reporting: reports must be submitted within 15 business days of receiving a serious adverse event report. Record retention: six years for safety and complaint records. Mandatory recall authority: FDA can now order mandatory recalls without voluntary cooperation.

Pending – GMP Rule

MoCRA requires FDA to issue binding GMP regulations for cosmetics. Expected by late 2025, but has not yet been finalized as of mid-2026. Companies are advised to align with ISO 22716 (cosmetics GMP international standard) as the likely foundation for what the final rule will require.

Withdrawn/Reissue – Talc/Asbestos Testing

FDA proposed asbestos testing methods for talc on December 27, 2024, then withdrew the proposed rule on November 28, 2025, citing agency priorities. A revised proposed rule is expected but timing is uncertain. Talc-containing cosmetic manufacturers face elevated litigation risk in the interim.

Active – PFAS Report

FDA published its December 2025 PFAS safety report reviewing information for the 25 most commonly used PFAS in U.S.-marketed cosmetics. 0.41% of listed products contained PFAS as of August 2024. PFAS in cosmetics remains a growing enforcement and litigation priority.

Sources: National Law Review / Foley (May 2026); Lumanity (May 2026); Diaz Trade Law (May 2026)

MoCRA is the most significant change to U.S. cosmetic regulation since the FD&C Act of 1938 – a period of over 80 years during which cosmetics were regulated under a framework fundamentally unchanged. The law broadens FDA’s authority, expands industry obligations, and is reshaping how cosmetics are brought to market, monitored, and recalled. (National Law Review, May 2026; Foley and Lardner, May 2026)
FDA has already achieved significant visibility into the cosmetics market through MoCRA’s registration and listing requirements: as of mid-2026, the FDA database shows 15,000 unique active facility registrations and over one million unique active cosmetic product listings. This is the first comprehensive FDA map of the U.S. cosmetics manufacturing landscape – and it is the database that will drive inspection targeting under Elsa and other risk-based systems. (FDA / Diaz Trade Law, May 2026)
Adverse event reports from the cosmetics industry have increased by more than threefold since MoCRA’s mandatory serious adverse event reporting requirement took effect. This surge is a direct consequence of mandatory reporting replacing a voluntary system – the underlying event rate has not necessarily increased, but the reporting rate has, creating a much richer signal for FDA enforcement targeting. (FDA / Diaz Trade Law, May 2026)
FDA is expected to continue increasing its cosmetic enforcement activity throughout 2026 and beyond. The National Law Review (May 2026) and Foley and Lardner (May 2026) both note that FDA is sharpening its focus on high-risk cosmetic ingredients and using the new public product listing database to drive transparency and, indirectly, enforcement. The combination of mandatory listing data and Elsa AI targeting means high-risk facilities can be identified before an inspector arrives. (National Law Review, May 2026)

2. How CAPA Fails: The Patterns FDA Cites in Warning Letters

Failure 1: Not Extending the Investigation

ECA Academy’s May 2026 analysis of FDA warning letters: investigations attributed problems to a single batch or event without extending to other lots made under the same conditions on the same equipment. FDA explicitly cites the failure to broaden scope as a CAPA inadequacy.

Failure 2: Training and SOP as the Only CAPA

The most common inadequate CAPA pattern: the corrective action consists of revising a procedure and retraining employees, without demonstrating how these steps prevent recurrence of the specific failure mode identified. FDA consistently finds this insufficient when root cause has not been identified.

Failure 3: Acting Only After FDA Identifies Gaps

ECA Academy analysis: FDA cited manufacturers who only performed extended investigation work “after FDA identified gaps,” without explaining why the investigation wasn’t initially broadened when systemic issues were evident. Reactive expansion of investigations after the inspector arrives is a cited deficiency, not a remedy.

Failure 4: No Effectiveness Verification

CAPA programs that close actions without verifying whether the corrective action actually prevented recurrence. Effectiveness checks that measure completion rather than improvement. This is the most common way a CAPA system generates paper compliance while the underlying problem persists.

CAPA has been the number one FDA inspection citation every fiscal year since 2010 – a 15-year consecutive run. According to FDA Group’s warning letter analysis cited by Invensis Learning (May 2026), CAPA deficiencies have appeared consistently in the top 10 inspection observations for this entire period, reflecting a structural gap rather than a cyclical enforcement priority. (FDA Group; Invensis Learning, May 2026)
Inadequate CAPA systems appeared in 64% of FDA enforcement actions against drug manufacturers in 2024 alone, second only to validation failures. While these figures come from the drug manufacturing enforcement record, cosmetic GMP requirements under MoCRA are expected to generate similar enforcement patterns once the binding GMP rule takes effect. (Assyro AI / FDA analysis, March 2026)
ECA Academy’s May 2026 analysis of FDA’s April 2026 warning letters is precise about what FDA expects: “investigations must be thorough, well-documented, scientifically sound, and timely, and they must translate into CAPA that is appropriately scoped and effective.” The failure chain FDA cites is when any link in this sequence breaks – shallow investigation, inadequate scope, training-only CAPA, or no effectiveness verification. (ECA Academy, May 2026)
ECA Academy’s September 2025 analysis of four warning letters published in that period found a specific pattern: microbial deviations not adequately investigated, with products released for distribution despite evidence of objectionable organisms. In one case, a second positive finding for the same organism triggered only a retest and partial rejection – not a root cause investigation of why the contamination recurred. This is the investigation failure that precedes the CAPA failure. (ECA Academy, September 2025)
The FDA Group’s audit intelligence (January 2025) identifies the fundamental problem with most CAPA systems: teams treat CAPA as a compliance requirement rather than an actual problem-solving tool. This mindset creates predictable cascading failures: every deviation becomes a potential CAPA (overwhelming the system); documentation becomes more important than resolution; teams focus on closing CAPAs rather than preventing recurrence; root cause analysis becomes a checkbox exercise; effectiveness checks measure completion rather than improvement. (The FDA Group, January 2025)

3. The Five Most Common CAPA Deficiencies in FDA Observations

Failure to thoroughly investigate problems

Investigations that identify a proximate cause without tracing it to root cause. Scope limited to the immediate event without examining other lots, systems, or time periods where the same failure mode could have occurred.

Inadequate root cause analysis

Root cause identified as “operator error” or “deviation from procedure” without investigating why the error occurred or why the procedure was not followed. Symptom-level conclusions that do not enable systemic corrective action.

Ineffective or incomplete corrective actions

CAPA that consists only of retraining and SOP revision without addressing the systemic cause. Actions that correct the immediate instance but do not prevent recurrence because the underlying system deficiency was not addressed.

Lack of verification that actions prevented recurrence

CAPA closed without an effectiveness check that demonstrates the problem has not recurred under the same conditions. Verification based on documentation of completion rather than evidence of performance improvement.

Poor documentation and trending

Failure to use CAPA data to identify trends across incidents. Individual CAPAs closed in isolation without aggregating the data to identify systemic failure categories that require process or system-level intervention beyond individual case correction.

Source: Invensis Learning / FDA Group Warning Letter Analysis (May 2026); FDA warning letters cited in ECA Academy analysis (May, September 2025)

These five deficiency categories appear across FDA’s enforcement record for drug, device, and OTC product manufacturers – and will apply equally to cosmetic manufacturers once binding GMP regulations are finalized under MoCRA. The underlying failure dynamics are structural, not industry-specific: they reflect how quality management systems behave when compliance pressure dominates over problem-solving culture. (FDA Group; Invensis Learning, 2026)
For cosmetic manufacturers, the most operationally critical of the five deficiencies is trending failure. Under MoCRA’s mandatory adverse event reporting, FDA will have access to reported complaint and adverse event data that cosmetic manufacturers may not be systematically analyzing for internal trends. An FDA investigator who has identified a clustering pattern across adverse event reports before the inspection – and finds the manufacturer’s CAPA program has not detected that same pattern internally – has a clear basis for citing both the investigation failure and the CAPA deficiency. (MoCRA adverse event data implications; FDA targeting analysis)

4. Root Cause Analysis Tools: What Works and When to Use Each

5 Whys

Iterative questioning that asks “why” five or more times to trace a symptom to its root cause. Best for relatively straightforward, linear cause-and-effect chains. Weakness: can oversimplify complex multi-factor problems if terminated too early or followed in only one causal direction.

Fishbone (Ishikawa) Diagram

Cause-and-effect diagram organizing potential causes into categories (Machine, Method, Material, Man, Measurement, Environment). Useful for complex problems with multiple contributing factors. Encourages multidisciplinary input. Best used in team-based investigations where cross-functional knowledge is available.

FMEA (Failure Mode and Effects Analysis)

Proactive risk assessment tool that identifies potential failure modes before they occur and assigns Risk Priority Numbers (RPNs) based on Severity, Occurrence, and Detectability. Most powerful as a preventive tool. Can be applied reactively after an incident to verify whether the failure mode was previously identified and whether existing controls were adequate.

Fault Tree Analysis (FTA)

Top-down deductive analysis using Boolean logic gates to map all paths that could have led to a failure event. Most rigorous for complex systems with multiple interacting failure modes. Produces a visual logic tree that can identify both single-point failures and combined-failure scenarios.

The fundamental principle underlying all effective root cause analysis tools is the same: a CAPA is only as good as the root cause analysis that feeds it. The most common reason CAPA fails – per all major quality system analyses – is that the investigation did not identify the true root cause before the corrective action was designed. An action plan built on an incorrect or incomplete root cause will not prevent recurrence regardless of how well-documented it is. (JJC Group, December 2025; ECA Academy, 2026)
The 5 Whys is the most widely deployed root cause tool but also the most commonly misapplied. Teams that stop at two or three “why” iterations, or that follow the most obvious causal path while ignoring parallel causal chains, produce root cause conclusions that identify symptoms rather than system failures. For cosmetic manufacturing failures involving microbial contamination, formulation deviations, or equipment performance, 5 Whys must be applied in conjunction with scientific data – not as a substitute for laboratory investigation. (SmartCAPA; FDA Group, 2025)
FMEA has specific relevance for cosmetic manufacturers preparing for MoCRA’s GMP rule. Applying FMEA to existing manufacturing processes identifies failure modes that should be formally assessed for their RPN before an inspection – or before a complaint signals that the failure mode has realized. FMEA used reactively after an incident can evaluate whether the failure mode was known and what controls were assumed to prevent it. (SmartCAPA; Center for Professional Innovation and Education, 2025)
The FDA Group’s January 2025 CAPA tips specifically recommend including both quality representatives and experienced operators in the initial investigation assessment. Operators often identify subtle changes in equipment behavior that preceded the deviation, while quality personnel verify documentation and regulatory compliance. Excluding production knowledge from the investigation consistently produces incomplete root cause conclusions. (The FDA Group, January 2025)

5. MoCRA Investigation Triggers: What Requires a Formal Investigation Under the New Framework

Serious adverse event – must report within 15 business days and investigate immediately

Product recall – mandatory recall authority now exists; investigation must support the recall decision

Microbial or chemical contamination finding – scope must extend to other lots, same equipment, same conditions

Out-of-specification result – investigation before release decision; cannot release without completed investigation

Complaint trending – adverse event data must be trended; clusters trigger investigations even without individual serious events

MoCRA defines “serious adverse event” as any event associated with a cosmetic product that results in (1) death, (2) serious injury (hospitalization, persistent or significant disability, congenital anomaly, or risk of death), or (3) any adverse event that requires inpatient hospitalization, medically important event, or other events of a serious nature. The 15-business-day clock begins when the responsible person (manufacturer, packer, or distributor) first receives the report – not when they determine the event is “probably” product-related. (MoCRA Section 605; FDA guidance)
FDA’s mandatory recall authority under MoCRA is new. Prior to MoCRA, recalls were voluntary; FDA could only request that a manufacturer recall and had to pursue court action to compel it. Mandatory recall authority fundamentally changes the investigation dynamic: a manufacturer that cannot produce adequate investigation documentation supporting a distribution suspension or recall decision faces both a product safety risk and a new enforcement mechanism that did not exist before 2022. (Lumanity, May 2026; MoCRA)
MoCRA’s records access authority allows FDA to request records relevant to cosmetic product safety. Six-year record retention is mandatory under Section 605. Investigation records, CAPA documentation, adverse event reports, and complaint files that are missing, incomplete, or produced in non-retrievable formats create an enforcement exposure independent of the underlying quality event they were meant to document. (MoCRA Section 605; Respect Manufacturing, 2026)
For OTC cosmetic products – sunscreens, acne treatments, dandruff shampoos – the investigation framework combines MoCRA’s cosmetic requirements with OTC drug manufacturing standards. Active Cosmetics Manufacturing Inc. received one of FDA’s April 2026 warning letters specifically because its investigation of a contamination event did not extend to other lots made under the same conditions – a finding that applies equally to cosmetic-only manufacturers preparing for MoCRA GMP compliance. (ECA Academy, May 2026)

6. Preparing for the MoCRA GMP Rule: What ISO 22716 Requires Now

ISO 22716

International cosmetics GMP standard. The likely foundation for FDA’s forthcoming binding GMP rule under MoCRA. Covers production, control, storage, and shipment of cosmetics.

Section 4.8

ISO 22716 CAPA requirement: establish procedures for identifying, investigating, and correcting nonconformities and preventing recurrence. Documentation of investigations and actions is required.

Cosmetics Direct

FDA’s online portal for facility registration and product listing. MoCRA’s digital compliance infrastructure enabling real-time FDA visibility into the U.S. cosmetics manufacturing ecosystem.

Not yet finalized

Binding GMP rule under MoCRA was expected by late 2025 – not yet issued as of mid-2026. Manufacturers implementing ISO 22716 now are building compliance ahead of the eventual requirement.

MoCRA mandates that FDA issue binding GMP regulations for cosmetics. The rule was expected by late 2025 but has not been finalized as of mid-2026. ISO 22716 is the international cosmetics GMP standard and the most likely model for what the final rule will require. Companies implementing ISO 22716 now are building the compliance infrastructure that will be mandatory once the rule is finalized – rather than facing a remediation cycle after enforcement begins. (National Law Review, May 2026; Respect Manufacturing, 2026)
ISO 22716 Section 4.8 requires that cosmetic manufacturers establish procedures for identifying, investigating, and correcting nonconformities, and for preventing their recurrence through CAPA. The documentation requirement is explicit: investigation findings and corrective actions must be documented. This requirement is substantively aligned with what FDA expects in the pharmaceutical and OTC drug context, and will generate enforcement expectations for cosmetics once binding. (ISO 22716; industry analysis)
FDA’s guidance for MoCRA compliance emphasizes that safety substantiation data, batch records, and traceability logs that prove product safety must be maintained. These are the same records that support investigation and CAPA programs: batch records establish the conditions under which nonconformances occurred; traceability logs identify affected lots; safety substantiation provides the scientific basis for assessing whether a deviation constitutes a safety risk. (MoCRA guidance; Respect Manufacturing, 2026)
FDA moved the Office of Cosmetics and Colors from CFSAN to the Office of the Chief Scientist in 2024 “to better align with its core mission” – a structural signal of elevated institutional focus on cosmetics. Combined with the Cosmetics Direct database, the Elsa AI targeting system, and MoCRA’s new enforcement authorities, the cosmetics inspection environment of 2026 is materially more demanding than 2021. (Lumanity, May 2026)

7. What an Effective Cosmetic Manufacturer CAPA Program Looks Like in 2026

Risk-based triage – not every deviation needs a CAPA, but the triage criteria must be documented

Multi-disciplinary investigation teams – quality + operations knowledge required

Scope extension protocol – every investigation must assess whether other lots or systems are affected

Effectiveness verification with defined criteria – not “SOP revised” but “zero recurrence in X batches”

Trending and signal detection – adverse event reports and complaints must be aggregated, not managed individually

Effective CAPA programs for cosmetic manufacturers in 2026 start with risk-based triage: a documented, objective system for determining whether an event requires a full CAPA or a correction. Applying CAPA to every minor deviation overwhelms the system and produces superficial investigations across the board. Applying CAPA only to the most serious events without a documented triage rationale creates the same FDA exposure as having no process at all. (The FDA Group, January 2025; quality system best practices)
ECA Academy’s May 2026 analysis articulates FDA’s requested remediation pattern from the April 2026 warning letters: independent retrospective reviews, stronger investigation competencies, better root cause evaluation, CAPA effectiveness verification, and stronger Quality Unit oversight. Note the order: the investigation precedes the CAPA, and the Quality Unit oversight frames both. Effective programs ensure each element is in place before the investigation opens, not assembled reactively after FDA issues observations. (ECA Academy, May 2026)
For MoCRA-specific adverse event investigation, the most critical operational requirement is speed combined with completeness. The 15-business-day reporting clock means cosmetic manufacturers cannot afford the multi-week investigation timelines common in pharmaceutical settings for routine deviations. Investigation SOPs must be pre-designed with templates, responsibility assignments, and documentation frameworks that allow rapid but rigorous initial assessment within days of event receipt. (MoCRA 15-day requirement; investigation program design)
Trending is the quality system capability most likely to differentiate cosmetic manufacturers that are ready for MoCRA enforcement from those that are not. FDA now has access to the industry’s adverse event reporting data through MoCRA’s reporting requirement. An investigator who identifies a signal in that data that the manufacturer’s own trending program has not detected is observing a failure of the quality system, not a reporting gap. Monthly review of adverse events and complaint data by category, ingredient, and product line is the minimum trending frequency for cosmetic manufacturers with significant product volumes. (MoCRA adverse event data; quality trending best practices)

Key Takeaways for Cosmetic Manufacturers and Quality Teams

CAPA has been the #1 FDA citation since 2010 – and MoCRA just raised the stakes for cosmetics

CAPA deficiencies appearing in 64% of FDA warning letters and 15 consecutive years as the top inspection citation reflect structural inadequacy in how quality systems handle failure investigation and corrective action. Cosmetic manufacturers who built quality systems for voluntary compliance – without enforceable GMP, mandatory reporting, or FDA records access – must now redesign those systems for an environment where all three exist. The pharmaceutical industry’s CAPA enforcement record is the playbook for what FDA will apply to cosmetics once the binding GMP rule is finalized.

MoCRA enforcement is active – the voluntary era is over

Facility registration and product listing enforcement began July 1, 2024. Adverse event reports have already tripled. FDA has mandatory recall authority. Records access allows FDA to request six years of investigation and complaint records. With 15,000 registered facilities and 1 million+ product listings now in FDA’s Cosmetics Direct database, and Elsa AI analysis targeting high-risk facilities, the cosmetics inspection environment of 2026 is categorically different from 2021. The transition from the voluntary era to the enforcement era has already happened – the question is whether individual manufacturers have adapted.

FDA is not asking for a better form – it is asking for a better system

ECA Academy’s May 2026 analysis of FDA’s April 2026 warning letters is direct: FDA’s remediation requests target the quality system, not the documentation. Independent retrospective reviews, stronger investigation competency, better root cause evaluation, CAPA effectiveness verification, and Quality Unit oversight – these are systemic capabilities, not process improvements. Cosmetic manufacturers who respond to MoCRA compliance requirements by adding forms and checklists without building investigation capability and quality culture will generate better paperwork while remaining at enforcement risk.

The 15-day reporting clock requires pre-designed investigation infrastructure

MoCRA’s 15-business-day deadline for reporting serious adverse events begins when the responsible person first receives the report – not when they decide it is probably product-related, not when they complete the investigation, and not when they have assembled a quality team. Cosmetic manufacturers who do not have pre-designed serious adverse event investigation SOPs, clear role assignments, templated documentation frameworks, and established escalation protocols will be building those systems under the reporting clock. Build them before the first event arrives.

FDA has your adverse event data – your trending program must detect signals before FDA does

MoCRA’s mandatory adverse event reporting means FDA is accumulating industry-wide adverse event data that it will analyze for signals. If an FDA investigator identifies a pattern in that data that the manufacturer’s own trending program has not detected and acted on, the investigation failure is an open and documented finding. Monthly trending review of adverse events and complaints by product category, ingredient, and lot number is the minimum program necessary to demonstrate that the quality system is functioning as a detection mechanism rather than as a filing system.

Implement ISO 22716 now – the binding GMP rule will require it

MoCRA’s binding GMP rule has not been finalized as of mid-2026, but it is coming. ISO 22716 – the international cosmetics GMP standard – is the most likely foundation for that rule. Every element of ISO 22716’s CAPA requirements (Section 4.8), investigation documentation requirements, and quality system structure that a cosmetic manufacturer implements before the rule is finalized represents compliance infrastructure that will not need to be built under enforcement pressure after the rule takes effect. Manufacturers who build to ISO 22716 now will face a certification or inspection, not a remediation cycle, when binding GMP arrives.

Sources

MoCRA and FDA Regulatory Sources

CAPA, Investigation, and Root Cause Analysis Sources