Keeping Adverse Event Records for Six Years

Six years is a long time to keep anything organized, especially for a small cosmetics business where the person handling customer emails today might not be the same person handling them in year four. MoCRA's recordkeeping expectations around adverse events aren't just about responding to a complaint when it comes in, they're about being able to produce a coherent record years later if the FDA ever asks. That's a filing system problem as much as a compliance one.

What actually counts as an adverse event

An adverse event, in this context, is any health-related reaction a consumer reports in connection with using your product, ranging from mild irritation to something serious enough to need medical attention. It doesn't have to be something you agree was caused by your product. If a customer tells you they had a reaction, that's a report worth logging, even if your own read is that it was probably unrelated, a preexisting allergy, or user error like leaving a product on far longer than directed.

Serious adverse events, generally ones involving significant harm such as hospitalization, disfigurement, or worse, carry their own more urgent reporting expectations to the FDA. But even non-serious reports need to be logged and retained, because a pattern of similar minor complaints across a product line can itself become a serious safety signal over time, and that pattern is only visible if the individual reports were captured consistently.

Building a log you can actually maintain for six years

The failure mode here usually isn't malice, it's drift. Someone sets up a spreadsheet, it works fine for the first year, then a new hire doesn't know it exists, and complaints start arriving through three different channels, an email inbox, a Instagram DM, a marketplace review, without ever reaching the log. Design for that reality from the start.

A workable adverse event record should capture:

Field	Why it matters
Date received	Establishes the timeline for retention and any follow-up
Product name and lot/batch number	Ties the report to a specific manufacturing run
Nature of the reaction	Rash, burning, swelling, breathing issue, etc, in the consumer's own words plus your categorization
Channel it arrived through	Email, phone, review, social media, so you can audit whether a channel is being missed
Consumer contact info (if available)	For any necessary follow-up, retained per your privacy obligations
Severity assessment	Whether it meets the threshold for a serious adverse event
Actions taken	Refund, follow-up questions asked, whether it was escalated internally
Resolution status	Open, closed, escalated

Centralizing intake across channels

If complaints can arrive through customer service email, a contact form, social media comments, or marketplace reviews, you need someone with responsibility for sweeping all of those channels regularly and funneling anything that looks like an adverse event into the single central log. A complaint sitting unanswered in a Instagram DM for three months isn't just a customer service failure, it's a recordkeeping gap.

Practical setup that tends to hold up over time:

• One person or role, not just "whoever sees it first," owns the adverse event log
• A simple standing checklist for anyone touching customer communications: does this look like a health-related reaction, and if so, does it belong in the log
• A quarterly sweep where someone specifically re-reads reviews and social mentions looking for anything that slipped through in real time

Retention format matters too

Six years is long enough that file formats and storage locations can quietly become obsolete or inaccessible. A spreadsheet stored on a single laptop that later gets replaced, or a shared drive that gets reorganized, is a real risk. Back the log up somewhere durable and make sure more than one person knows where it lives and how to access it.

Where this connects to your broader filing picture

Adverse event records don't live in isolation from the rest of your compliance paperwork, they sit alongside your product listings and safety substantiation as part of the overall picture the FDA can ask to see. Keeping them organized, dated, and centralized is less about any single complaint and more about being able to tell a coherent six-year story if you're ever asked to.

Cosmetic Comply doesn't manage adverse event logs directly today, since that side of MoCRA sits outside product notification and ingredient screening, but if you're building out your US compliance file more broadly, having your ingredient and formula records clean and centralized through the same kind of disciplined system pays off the same way adverse event logs do, when someone eventually asks to see the paper trail.

A six-year requirement rewards whoever builds the boring, unglamorous system on day one and just keeps feeding it.