Cosmetic Manufacturer CAPA and Failure Investigations: 40+ Statistics 2026

CAPA remains the number one cited observation by FDA for 2024 among companies that received an Official Action Indicated (OAI) designation from inspection. For cosmetic manufacturers, this finding arrives in a newly consequential context: the Modernization of Cosmetics Regulation Act of 2022 (MoCRA) introduced formal adverse event reporting requirements, inspectable quality records, and a GMP rulemaking process that will eventually formalise quality system expectations for the entire industry. The combination of FDA’s established CAPA enforcement focus and MoCRA’s expanding authority creates a specific compliance risk profile for cosmetic manufacturers that did not exist before 2023.

CAPA: top FDA OAI finding in 2024

MoCRA serious adverse event reporting window

Recurring CAPA failure modes across FDA cosmetic inspections

1938

Last major US cosmetics legislation before MoCRA in 2022

Supporting Data

The pattern of CAPA failures in FDA inspections is well-documented and consistent. According to Compliance Architects’ analysis of FDA inspection trends, several failure modes repeat across industries and are particularly prevalent in cosmetics.

The four recurring CAPA failure modes in cosmetic inspections

Treating retesting as investigation. When an OOS result is followed by a passing retest, many organisations close the inquiry. FDA’s consistent position is that a passing retest does not explain why the original result was OOS, and closing without root cause identification is not an investigation.

Scope limited to the affected batch or lot. Investigations that address only the specific product in question, without assessing whether the same root cause could affect other batches, product lines, or sites, consistently draw FDA criticism. The scope question must be documented and answered, not assumed away.

Probable cause without supporting evidence. An investigation that identifies a likely cause without evidence to support that identification produces preventive actions that may be entirely misdirected. FDA expects root cause conclusions to be supported by data, not assertion.

Quality Unit oversight gap. Quality Unit oversight of investigations is an FDA expectation, not optional. Where the QU is understaffed, undertrained, or operationally marginalised, the investigation function reflects that weakness. FDA treats QU oversight failures as systemic, not as individual event failures.

Inconsistent implementation across sites and product lines is the most common structural gap. Companies with multi-site or multi-region manufacturing often have CAPA procedures on paper that are applied unevenly in practice, with the result that the same type of quality event is investigated with different rigour at different locations.

Inadequate trend analysis is the second most frequently cited gap. FDA expects data mining and trend analysis to identify recurring quality problems before they produce individual OOS events or adverse complaints. A quality system that only reacts to individual events, rather than identifying patterns in aggregate data, is operating below FDA’s baseline expectation.

A particularly instructive example is a 2026 Warning Letter issued to Active Cosmetics Manufacturing Inc., highlighted by the ECA Academy. FDA found that the manufacturer’s CAPA system failed to adequately investigate the root causes of multiple quality defects, failed to assess whether corrective actions had actually prevented recurrence, and failed to extend the scope of investigation to related products. The Warning Letter describes a CAPA system that was procedurally present but analytically hollow.

Common Assessment Finding

A failure investigation system that identifies a probable cause, implements a corrective action, and closes the record without verifying effectiveness is not a CAPA system. It is a documentation system that happens to use CAPA forms. FDA’s inspectors distinguish between the two by looking at recurrence rates, scope assessments, and the quality of root cause analysis documentation, not at procedure titles or form templates.

Analysis

The persistence of CAPA as the top FDA inspection finding is not a mystery. The breakdown is not in knowing that CAPA is required. It is in execution: the gap between having a CAPA procedure and having a CAPA system that consistently produces accurate root cause identification, targeted corrective action, and verified effectiveness.

For cosmetic manufacturers specifically, the structural challenge is that the industry operated for decades without the quality system infrastructure that pharmaceutical and medical device manufacturers have built over 30 to 40 years of FDA enforcement. MoCRA’s arrival does not immediately create that infrastructure. It creates the expectation of it, and FDA’s inspection authority to verify it.

MoCRA and CAPA: the combined exposure

Event

MoCRA trigger

CAPA intersection

Consumer complaint

Serious AE: 15-day report

AE report and investigation records are both inspectable; an inadequate CAPA is a compounded finding

OOS result

Potential AE trigger if related to distributed product

Investigation scope must assess whether distributed product is affected; scope failure compounds into potential AE reporting failure

Recall or field action

Inspectable under MoCRA facility registration

CAPA records documenting what investigation preceded the recall decision are subject to FDA review

Public access to adverse event reports submitted under MoCRA, without requiring a Freedom of Information Act request, also increases civil litigation exposure for cosmetic manufacturers. A consumer adverse event report that triggers an inadequate investigation creates a documented record of the inadequacy, available without FOIA to plaintiffs’ counsel.

The GMP rule that MoCRA required FDA to finalise by December 2025 has been delayed and is currently listed as a long-term action. FDA inspectors are, however, already using existing CGMP authority and established quality system principles as the basis for inspection findings, regardless of the formal rule’s status.

Impact

Enforcement risk

A consumer complaint triggers an adverse event report. The report and all related records are now inspectable. An inadequate investigation documented in those records becomes a CAPA finding compounded by a MoCRA compliance finding.

Litigation exposure

MoCRA adverse event records are publicly accessible without FOIA. An inadequate investigation creates a documented record of the inadequacy available to plaintiffs’ counsel without formal discovery.

Regulatory trajectory

The GMP rule is delayed but the direction is unchanged. FDA’s authority over cosmetics is permanently expanded. Manufacturers building quality systems now are ahead of those waiting for the final rule text.

Recommendations

Build the investigation system before the adverse event arrives

MoCRA’s 15-business-day adverse event reporting requirement is a deadline that runs from the date of awareness. An organisation that does not have investigation procedures in place when a serious adverse event is received will be unable to meet that deadline with a substantive response.

Treat every adverse event report as a CAPA trigger

Even where a single adverse event does not meet the formal MoCRA definition of a serious adverse event, it may represent a signal that should trigger investigation and trend analysis. The question is not just “must we report this?” but “what does this tell us about product quality or design?”

Separate the initial complaint investigation from root cause analysis

These are two distinct activities. The initial investigation assesses what happened and whether a reportable event occurred. Root cause analysis then determines why it happened. Conflating the two produces investigations that are too shallow to identify systemic causes.

Document scope assessment as a formal investigation step

Every investigation should include a documented assessment of whether the same root cause could affect other batches, lots, product lines, or facilities. This assessment should be explicit, not implicit. If the scope is narrow, the record should explain why.

Verify CAPA effectiveness with defined criteria

Define what evidence will confirm the corrective action worked, over what time period, and what the acceptance criterion is. “No further complaints” is not an adequate effectiveness criterion unless it is specified in advance with a monitoring window.

Future Outlook

The cosmetic GMP rule that MoCRA required by the end of 2025 is now listed as a long-term regulatory action with no proposed date. For cosmetic manufacturers, this means the transition period between the pre-MoCRA world and a fully formalised GMP-regulated world is longer than originally anticipated. But the direction is not in doubt.

FDA’s authority over cosmetics has been permanently expanded. Adverse events must be reported. Facility registrations are required. Records are inspectable. The quality system infrastructure that MoCRA’s GMP rule will eventually formalise is the same infrastructure that FDA inspectors are already using existing authority to evaluate. Manufacturers who treat the GMP rule’s delay as a reason to defer quality system investment are making a decision that may be difficult to reverse under enforcement pressure.