Are You Ready for a MoCRA Audit? 5 Things FDA Can Now Demand From Your Cosmetic Brand

The regulatory landscape for the beauty and personal care industry has undergone its most significant transformation since 1938. With the enactment of the Modernization of Cosmetics Regulation Act of 2022 (MoCRA), the era of voluntary FDA compliance is officially over. For Chief Compliance Officers and VPs of Regulatory Affairs, the shift from "self-regulation" to "federal oversight" requires a fundamental restructuring of internal systems.

MoCRA grants the FDA unprecedented authority over cosmetic products, bringing them closer to the regulatory rigor seen in the pharmaceutical and medical device sectors. If your brand has operated under the assumption that cosmetics are "low risk" from a regulatory enforcement perspective, that calculation must change immediately. The FDA now has the power to access your internal records, mandate product recalls, and even suspend facility registrations.

This article outlines five specific areas where the FDA’s new authorities will most likely impact your operations during an inspection or audit.

1. Safety Substantiation: Beyond the Ingredient Deck

Under MoCRA, the "responsible person": typically the brand owner whose name appears on the label: is legally required to ensure and maintain records supporting "adequate substantiation" of safety for every product marketed in the U.S.

The FDA’s definition of "adequate substantiation" is intentionally broad but scientifically demanding: it requires "tests, studies, research, analyses, or other evidence" that experts consider sufficient to support a reasonable certainty that a product is safe.

What the FDA Can Demand:

During an inspection, the FDA may request your Safety Substantiation Files. These are no longer just optional marketing dossiers; they are required legal records. You must be prepared to show:

• Toxicological Profiles: Data on individual ingredients and the finished formulation.
• Clinical Data: Results from irritation or sensitization studies (e.g., HRIPT).
• Stability and Micro Testing: Evidence that the product remains safe throughout its intended shelf life.

2. Serious Adverse Event Reporting: The 15-Day Clock

Perhaps the most operationally challenging aspect of MoCRA is the new mandatory reporting requirement for serious adverse events (SAEs). A "serious" event includes anything from infections and significant disfigurement to hospitalizations or death.

The timeline is aggressive. The responsible person must report any SAE to the FDA within 15 business days of receiving the information. Furthermore, any new medical information related to that event received within one year of the initial report must also be submitted within 15 business days.

What the FDA Can Demand:

The FDA now has the authority to inspect your adverse event records. They will look for:

• Standard Operating Procedures (SOPs): Documentation of how you intake, triage, and categorize consumer complaints.
• Completeness of Records: Evidence that you have maintained all adverse event records (serious and non-serious) for at least six years.
• Decision Logic: Documentation explaining why an event was categorized as "non-serious" if the FDA's investigators disagree with your assessment.

3. Fragrance Allergen Transparency

For decades, the specific components of a "fragrance" or "flavor" were protected as trade secrets. MoCRA changes the rules of engagement. While the FDA is still in the process of finalizing the specific list of allergens that must be disclosed, the requirement for label transparency is already codified.

What the FDA Can Demand:

Labels must now include contact information (website or phone) to facilitate adverse event reporting. Moving forward, as the FDA issues its final rule on fragrance allergens, they will demand:

• Ingredient Breakdown: Access to documentation from your fragrance houses confirming the presence (or absence) of specific allergens.
• Label Compliance: Proof that your packaging reflects the most current regulatory requirements for allergen disclosure.

4. Mandatory Facility Registration and Product Listing

In the past, the Voluntary Cosmetic Registration Program (VCRP) was exactly that: voluntary. MoCRA has replaced it with a mandatory system. Every facility that manufactures or processes cosmetics for the U.S. market must register with the FDA, and every product must be listed.

What the FDA Can Demand:

• Registration Numbers: Proof of a valid FDA facility registration, which must be renewed every two years.
• Product Listing Numbers: A comprehensive list of ingredients for every product, including any updates made to the formulation throughout the year.
• Linkage: Documentation connecting specific products to the specific facilities where they were manufactured.

5. Expanded Records Access and Mandatory Recall Authority

One of the most significant "teeth" in MoCRA is the expansion of the FDA's records access. If the agency has a "reasonable belief" that a cosmetic product is likely to be adulterated or misbranded: and that it poses a threat of serious adverse health consequences: they can access and copy your records.

This is no longer limited to just the safety data; it can extend to manufacturing logs, distribution records, and quality control data.

What the FDA Can Demand:

• The Audit Trail: Full visibility into your supply chain and manufacturing processes.
• Recall Records: If the FDA determines there is a risk, they can request a voluntary recall. If the company refuses, MoCRA gives the FDA the power to mandate a recall. You must be able to prove you have a robust recall system in place to execute such a demand.

Strategic Considerations for Executive Leadership

For brands managing hundreds of SKUs, MoCRA compliance cannot be handled via spreadsheets. Forward-thinking companies are integrating their regulatory obligations into enterprise systems like Veeva, MasterControl, or Medidata to ensure an immutable audit trail.

Navigating these new requirements requires a blend of scientific rigor and legal strategy. A gap analysis of your current safety files and adverse event intake procedures is no longer a "best practice": it is a necessity for risk mitigation.

At The FDA Law Solution, we help cosmetic brands move from reactive fire-fighting to proactive regulatory strategy. Whether you are an emerging biotech-beauty startup or an established multinational, the FDA’s new eyes are on your files.

For assistance with MoCRA compliance audits or developing your safety substantiation protocols, contact our team today.

---

Disclaimer: The information on this blog is for general informational purposes only and does not constitute legal advice. Reading these posts or contacting us through this site does not create an attorney-client relationship. Because FDA regulations and legal standards change quickly, this content may not reflect the most current developments. Always consult with a qualified attorney regarding your specific legal or regulatory situation.