How FDA Inspects Cosmetic Facilities Under MoCRA

Before MoCRA, FDA's ability to walk into a cosmetic facility and demand records was genuinely limited compared to what it could do with a food or drug manufacturer. That gap closed considerably once MoCRA took effect, and it's worth understanding what changed if you're running any kind of cosmetic manufacturing or processing operation, even a small one.

Why FDA's cosmetic authority used to be weaker

Historically, FDA's oversight of cosmetics ran on a much lighter framework than its oversight of food or drugs. Facility registration was voluntary in practice for a long time, records access authority was narrower, and there wasn't a unified national system tying registered facilities to the specific products they made. MoCRA (the Modernization of Cosmetics Regulation Act of 2022) was built specifically to close that gap.

What changed with facility registration

MoCRA requires cosmetic facility registration and product listing with FDA, tied to a named responsible person for each product. That single change matters more for inspection purposes than it might seem, because it gives FDA a reliable map of which facilities exist, what they make, and who's accountable for each product, rather than relying on ad hoc discovery.

Some small businesses are exempt from registration and listing, though as covered elsewhere on this blog, certain product categories lose that exemption regardless of company size. If your facility is required to register, it's now sitting in a system FDA can reference directly when planning inspection activity.

What an inspection actually looks for

A facility inspection under the current framework is generally interested in a few core things:

• Registration accuracy. Does what's actually being manufactured on-site match what's registered? Discrepancies here are an easy, obvious finding.
• Safety substantiation records. MoCRA requires safety substantiation for cosmetic products, and an inspector can ask to see the actual documentation behind that substantiation, not just a claim that it exists.
• Adverse event recordkeeping. MoCRA requires recordkeeping around adverse events, and inspectors can review whether a facility is actually logging and handling reports appropriately, not just claiming to.
• General manufacturing conditions. Sanitation, ingredient handling, and process controls, in the same spirit as ISO 22716 good manufacturing practice guidance, even where that specific standard isn't directly cited as a legal requirement.

What a small facility should actually expect

If you're a small operation, an inspection doesn't feel like a surprise raid in most cases. It typically follows a pattern:

1. Notice or a scheduled visit, though FDA does retain authority for unannounced inspections in appropriate circumstances.
2. A walkthrough of your actual production space, checking it against what's registered.
3. A records request, covering safety substantiation, ingredient sourcing, and adverse event logs.
4. A findings discussion, where any gaps get flagged, sometimes with a timeline to correct them before escalation.

The single biggest practical risk for a small facility isn't usually a dramatic safety failure. It's disorganization: records that exist somewhere but aren't readily producible, a registration that hasn't been updated to reflect a new product line, or an adverse event that got handled informally and never logged anywhere an inspector can find it.

Getting your own house in order before anyone knocks

The most useful thing a small maker can do isn't waiting to see what an inspection turns up. It's building the habit of treating registration, safety substantiation, and adverse event logs as living documents that get updated as your product line changes, not paperwork you did once at launch and never touched again.

A simple internal checklist worth keeping current:

• Facility registration matches your actual current product list
• Safety substantiation exists and is filed per product, not as one vague folder
• Adverse event reports, however few, are logged with dates and outcomes
• Ingredient sourcing records are retrievable, not scattered across supplier emails

Where this connects to your broader compliance picture

MoCRA facility and product obligations sit alongside, not instead of, whatever else applies to your specific product and market. If you're also selling into Canada, your CNF filings are a completely separate track with their own deadlines. Cosmetic Comply's Canada notification workflow, mapping ingredients to INCI and CAS, screening restricted substances, and filing through a real compliance reviewer, is built to keep that side clean, with US MoCRA support in development, so the recordkeeping habit you build for one market carries over more easily to the next.