By FDA's Standard, Keeping a Certificate Is Not Testing

What is the signal?

On 2 June 2026 the FDA issued a warning letter (reference 722596) to Revlon Group Holdings, LLC for its facility at 1501 Williamsboro St., Oxford, North Carolina. It followed the agency's review of records submitted in response to a 8 September 2025 request, and it described significant violations of Current Good Manufacturing Practice regulations for finished pharmaceuticals.

The findings are specific. The firm failed to test samples of each component for identity and for conformity with written specifications for purity, strength and quality, and in particular had not demonstrated that it appropriately tested incoming talc components used in manufacturing. Identity testing on talc followed a United States Pharmacopeia method but did not conform to the current method, being incomplete in that identifications B and C were missing. Asbestos testing was performed by the supplier, and no evidence was provided that the firm conducts asbestos testing at its own facility. The letter also found that the quality control unit did not effectively exercise its responsibility to ensure the acceptability of components, and did not ensure that the test procedures and specifications for talc were scientifically sound and appropriate.

Reporting fills in the picture. Relying on a supplier's certificate of analysis is permitted only where the manufacturer validates the reliability of those results; the talc specification approved by the quality unit was reported to be missing quantitative limits and microbiological limits for yeast and mould; and the supplier's certificate recorded microbial results only as "conform", without quantitative data. The FDA required a written response outlining corrective actions within 15 working days, and test results on retained talc samples within 30 days, or finished-product testing where retains were unavailable.

On 28 September, Representative Yvette D. Clarke led nine members of the U.S. House in a public letter to Revlon Group Holdings CEO Michelle Peluso. The letter raised the concern that Black women and girls would be disproportionately exposed to carcinogenic chemicals in contaminated beauty products. The matter, in other words, did not end inside an FDA administrative process; it carried into a congressional inquiry.

A line has to be drawn here. The legal basis for this action was CGMP for finished pharmaceuticals, not cosmetic GMP. In the United States a product can be both a cosmetic and a drug, and the FDA publishes separate guidance on that distinction. On the cosmetic side, MoCRA directed the FDA to establish GMP regulations with statutory deadlines of 29 December 2024 for a proposed rule and 29 December 2025 for a final rule, and the FDA has published draft guidance on cosmetic good manufacturing practices. A warning letter is also an action against one company's one facility, not a statistic about industry averages or frequency, and in the public version the FDA redacted both the product and the suspected contaminant. What to read is not a number but a standard of judgement: the range a regulator accepts as "tested" is narrower than keeping certificates on file.

1. Receiving a certificate and running a test are different things

A supplier certificate arriving with a raw material is a familiar routine. The problem is the moment that document is used as evidence that you verified something. The structure the FDA described in the Revlon case is simple: the supplier performed the asbestos testing, and the company did not independently establish those results.

Relying on certificates is not itself prohibited. According to reporting, that reliance is permitted only where the manufacturer validates the reliability of the certificate's results. What is required, then, is not one sheet of paper but a basis for why this supplier's numbers can be trusted. Where that basis is not recorded, the documents accumulate while the verification stays empty.

For a brand, that distinction turns into a single sentence in the contract: who performs raw-material testing for our product, who confirms the reliability of a supplier certificate where one is used and by what method, and with whom that record is kept. Leave any of the three blank and that blank becomes the dispute when something goes wrong.

• Whether your materials are separated into items you test yourselves and items accepted on a certificate
• Whether the method for confirming reliability is written down for the certificate-based items
• How many days it takes to receive raw-material test records on request
• Who notifies you when a raw-material supplier changes

2. A specification that only says "conform" is close to no specification

The other point reported in the Revlon case concerned the content of the specification itself. The talc specification approved by the quality unit was missing quantitative limits and microbiological limits for yeast and mould, and the microbial entry on the supplier's certificate was recorded only as "conform", without figures.

This is a common sight in practice: the specification lists the item but no numeric acceptance criterion. Without a limit, any result becomes a pass, and the meaning of "conform" differs by supplier. That gap is the first thing to snag when export documents are being assembled or a customer audit arrives.

So what to check at the planning stage is not whether a specification exists but whether the limits are written as numbers. Microbial limits, impurity limits, and the method and acceptance criteria for identity testing have to appear as figures and named methods for the document to function as a standard. Which pharmacopoeia or recognised method applies should be written down too, along with a check that the current edition of that method is in use. The identity finding in the Revlon case was exactly that: a pharmacopoeia method was followed, but not the current one.

3. Sort first for the materials where the risk comes from the material

The same level of verification cannot be attached to every raw material. Cost and schedule grow, and the items that matter get buried. So the first job is sorting: separating materials where contamination risk comes from the origin and refining of the material itself from those where it does not.

The talc at issue in the Revlon case is the archetype. Mineral materials can carry associated minerals depending on where they are mined, which is why the FDA treats talc as a separate topic among cosmetic ingredients and has published reports on asbestos testing of talc-containing cosmetic products. Mineral pigments, clays and botanical extracts should be approached on the premise that naturally derived materials can vary from batch to batch.

Once the sorting is done, formulation choices change. Where there is more than one route to the same colour payoff or texture, and one of them uses a material with a heavy verification burden, you weigh whether the product concept can carry that burden. Making this judgement before the formula is locked costs less. Change a material just before launch and the stability testing has to be built again.

• How many mineral, clay or botanically derived materials the formula contains
• Whether origin and refining information is available for those materials
• Whether the specification controls the attributes that can vary by batch
• Whether alternative materials achieving the same effect are on the table during formula review

4. In the United States the same product may be a drug

That this action came under CGMP for finished pharmaceuticals is not a detail to pass over. A product classified as a cosmetic in Korea may fall under the U.S. OTC drug category, and that classification changes the level of manufacturing and testing control required. The FDA provides separate guidance for deciding whether a product is a cosmetic, a drug, or both.

In practice the line is drawn by claim language and functional ingredients. The moment a concept moves into territory the United States treats as drug category, such as sun care, dandruff or sweat control, the standards to be met can differ product by product even within the same line-up. If the brief does not record which category a product is headed for, you end up coming back to trim the claims or change the formula later.

And regardless of what stage cosmetic GMP rulemaking has reached, the conditions for making product today do not change. MoCRA directed the FDA to establish cosmetic GMP regulations, with statutory deadlines of 29 December 2024 for a proposed rule and 29 December 2025 for a final rule, and the FDA has published draft guidance on cosmetic good manufacturing practices. However the details settle, a gap in raw-material test records and specifications was never explainable before that either.

5. Without retained samples you cannot answer

The most operational demand in the warning letter came last. The FDA asked for test results on retained talc samples within 30 days, and said that where retains were unavailable, finished-product testing should take their place. That sentence shows plainly the difference between having retained samples and not having them.

With raw-material retains, you can test the material you actually received and answer now. Without them, you have to test finished product already made and distributed, and that testing widens in scope and becomes harder to interpret. It also becomes harder to argue that the issue was confined to a particular batch.

What a brand should check now is simple: who keeps raw-material and finished-product retains, for how long, and whether those conditions are in the contract. Retention periods and quantities vary by product and by commercial terms, so do not assume a general number; confirm the current basis with the manufacturer. Fail to settle it at first production and tracing gets harder with every reorder.

• Whether the holder and retention period for raw-material and finished-product retains are in the contract
• Whether a batch number traces back to the raw-material supplier and the test record
• Whether a submission route is defined for export documents or customer audit requests
• How records transfer when the manufacturing site or a raw-material supplier changes

The first question for the brief

Do not write 'this is going to the United States, so let us keep the paperwork tidy'. Write one sentence instead: among this product's raw materials, which items do we test ourselves, and which do we accept on a supplier certificate? If you cannot answer that item by item, your quality records currently exist only as a quantity of documents.

One thing to add. The Revlon case arose at a large company's own plant. Scale of equipment and headcount does not automatically close a gap in certificate verification. What to ask when choosing a manufacturing partner is not for a list of installed equipment but which incoming-material attributes they test in house, which they accept on a certificate, and who approves that judgement.

Then add one more line. If you were asked for the asbestos or microbial test result for a raw material in a batch produced three years ago, within how many days and in what document could you send it? If that answer is blank, what needs work now is not the product concept but the raw-material specification and the sample-retention terms.