Which Supplier Documents to Keep for a Cosmetic Audit

Nobody thinks about their filing system until someone asks for a document they don't have handy. An audit, whether it's a formal regulatory inspection, a retailer's compliance check, or an insurance requirement, tends to surface exactly which supplier records you actually kept versus which ones you meant to keep. Getting organized before that moment, rather than during it, is the difference between a calm afternoon and a stressful week.

The core documents worth keeping per ingredient

For each raw material or ingredient you use, a reasonably complete file includes:

• Safety data sheet (SDS). The 16-section document describing the substance's composition, hazards, and handling. This is your primary source for INCI name and CAS number confirmation.
• Certificate of Analysis (CoA). Batch-specific proof that the particular lot you received met the supplier's stated specifications. Keep the CoA tied to the batch or lot number you actually used in production, not just a generic one from the supplier's website.
• Supplier specification sheet. Often includes the trade name, INCI name, typical use level, and sometimes a CAS number, useful for cross-checking against the SDS.

Documents at the formula and product level

Beyond individual ingredients, an auditor may want to see:

• The finished formula with percentages. A clear record of every ingredient by INCI name and its concentration or concentration range in the finished product.
• Your notification record. For Canada, this means your Cosmetic Notification (CN) number and the details filed through the Cosmetic Notification System, along with any amendments or discontinuations filed as the product changed.
• Batch production records. Linking a specific manufacturing run to the raw material lots used in it, which is what makes a recall or a targeted investigation possible without pulling every unit you've ever made.
• Label proofs. Copies of the actual label as printed, including ingredient list, batch code, and any claims made, so you can show what was actually on the product a customer received.

How long to hold onto things

There's no single universal retention period that covers every document in every market, and this is genuinely one of those areas where checking current guidance for your specific market matters, since expectations can differ and can change. That said, a sensible general practice many makers follow is to retain supplier documentation and batch records for as long as the product is on the market, plus a reasonable window afterward, often measured in years rather than months, to cover the realistic window in which a complaint, an adverse event report, or a retailer audit might reach back to a specific batch. If you're operating under something like ISO 22716 good manufacturing practice guidance, that framework generally expects a documented, defensible recordkeeping system rather than an ad hoc one, which is a good bar to hold yourself to even if you're a small operation.

A simple retention table to start from

Document	Tied to	Why it matters in an audit
SDS	Ingredient (general)	Confirms INCI/CAS, hazard info
CoA	Specific batch/lot	Proves that batch met spec
Formula sheet	Product	Shows what's actually in the finished product
Batch production record	Manufacturing run	Links raw material lots to finished units
Notification/CN record	Product, as filed	Shows what was declared to the regulator
Label proof	Product, as printed	Shows what the consumer actually saw

Why this matters beyond just "passing" an audit

The real value of keeping these records isn't performing compliance for an inspector. It's that if something does go wrong, a customer reaction, a batch that turns out off-spec, a question about whether a Hotlist substance was properly screened, having a clean paper trail lets you actually answer the question quickly instead of reconstructing it from memory or scattered emails. A recall, if one is ever needed, depends entirely on being able to trace a specific batch back to specific raw materials and forward to specific customers or retail locations.

For makers running several SKUs with overlapping ingredients, keeping this organized by hand gets tedious fast, especially tracking which CoA belongs to which production run. Cosmetic Comply keeps your ingredient mapping, INCI and CAS data, and filing history attached to each product, and lets you duplicate a past filing for a minor product variant, so at least the notification side of your paper trail stays consistent rather than scattered across old emails and folders.