GMP vs ISO 9001: What Each Certification Actually Covers

Two different questions, two different certifications

ISO 9001 answers the question 'does this company have a consistent, documented quality management system?' GMP (Good Manufacturing Practice — in cosmetics, formalized as ISO 22716) answers a narrower, more specific question: 'does this factory's physical process reliably produce a safe, uncontaminated cosmetic product, batch after batch?' They're quoted together so often that buyers sometimes assume one implies the other. It doesn't. A company can run an excellent ISO 9001 quality management system for, say, a logistics business, with nothing to do with sanitary production of a topical product.

What ISO 9001 actually certifies

ISO 9001 is a general-purpose quality management standard used across almost every industry — manufacturing, services, software, logistics. It certifies that an organization has defined processes, tracks and corrects non-conformances, gathers customer feedback, and continuously improves against documented objectives. It says nothing specific about cleanrooms, microbial contamination control, personnel hygiene near production, or cosmetic-specific raw material handling. A factory can be excellently ISO 9001 certified and still have no formal system for prevent cross-contact between two different fragrance formulas run on the same line.

What GMP actually certifies

GMP, and specifically ISO 22716 for cosmetics, is built entirely around the physical and procedural controls needed to make a safe, consistent cosmetic product: facility layout and cleanability, personnel hygiene and gowning, approved-supplier raw material systems, documented batch manufacturing records, in-process quality checks, and controlled storage. It's an operational standard, not a management-philosophy standard — an auditor walks the production floor, checks batch records against what actually happened, and inspects the physical conditions raw materials and finished goods are stored under.

Where they overlap

Both standards share a documentation-first mindset: neither trusts a verbal assurance that something was done correctly, both want a signed record. Both also expect a defined corrective- and preventive-action process, so that when something goes wrong, there's a documented investigation and a fix, not just a quiet re-do. That overlap is why factories that are strong on one tend to be reasonably strong on the other — but 'reasonably strong' isn't the same as certified, and a buyer should confirm both independently rather than assuming.

Why a cosmetics factory needs both, not either

ISO 9001 gives a buyer confidence in the business behind the factory — that complaints get tracked, that suppliers get evaluated, that the company has a functioning management system rather than ad hoc habits. GMP/ISO 22716 gives confidence in the product itself — that what comes out of the tank and off the filling line is what the label says it is, safely and consistently. A factory with only ISO 9001 can be well-managed and still produce contaminated batches if its physical process controls are weak; a factory with only GMP can make a clean product but struggle to scale or correct systemic issues without a broader quality management system behind it.

What to ask when a supplier claims 'GMP certified'

Ask which specific standard backs the claim — ISO 22716 is the internationally recognized cosmetics GMP standard, but 'GMP certified' is sometimes used loosely to describe a self-assessment rather than a third-party audit. Ask for the certificate, the certifying body, and the scope of the audit (some certifications cover only part of a facility). Our Rawang facility holds both ISO 9001 and cosmetics GMP standards, audited independently — details on how that translates into day-to-day quality control are on our quality assurance page.