Korean ODM Stability Testing: How Indie K-Beauty Founders Should Read ICH Q1A, ISO 11930, and ISO 17516 Reports Before Production (2026)
By the ALTA MEET editorial team | K-beauty ODM consulting
When a Korean ODM emails you a sample-approval package, three documents tend to land in your inbox before the production deposit hits the invoice: an accelerated stability report, a preservative challenge test report, and a microbiological limits report. Most first-time indie founders open the PDFs, scan for the word "PASS," and move on. That is the single most expensive shortcut you can take at the sample-to-production gate.
These reports are not formalities. They are the only documentary evidence you will have, two years from now, that the formula you launched is the same formula your ODM tested. They are also what your retailer compliance team, your insurance underwriter, your MoCRA safety substantiation file, and your EU Responsible Person will ask for. Reading them correctly is the difference between catching a quiet pH drift at 90 days and recalling a batch from Ulta four months after launch.
This guide walks through how to read the three reports you are most likely to receive from a Korean ODM partner in 2026: ICH Q1A (R2) accelerated stability, ISO 11930 preservative efficacy (challenge test), and ISO 17516 microbiological limits. Voice of the founder: I have read close to two hundred Korean ODM stability packages over the past eight years. The pattern of what good labs include, what they leave out, and what you need to push back on is unusually consistent.
Key Takeaways
ICH Q1A (R2) was written for pharmaceuticals, but Korean ODMs and global cosmetic labs widely use its 40°C ± 2°C / 75% RH ± 5% RH accelerated condition as a reference for cosmetic stability. A 6-month accelerated study is the common minimum.
ISO 11930:2019 (with the 2022 amendment) is the cosmetic preservative challenge test. It uses a 5-organism panel and tests at days 0, 7, 14, and 28. Criterion A is the strong-preservation pass; Criterion B is the conditional pass that requires packaging-based control.
ISO 17516:2014 sets microbiological limits on the finished product: ≤10³ CFU/g for general leave-on, ≤10² CFU/g for eye-area, mucosal, and under-3 products, with required absence of E. coli, S. aureus, P. aeruginosa, and C. albicans in 1 g.
A Korean ODM stability report that does not also include challenge test data and microbiological limits data is incomplete. Ask for all three before you wire the production deposit.
The most common founder mistake is reading only the appearance and pH columns. Preservative depletion, viscosity drift outside ±15%, and any time-point microbial recovery are the real failure flags.
For your MoCRA safety substantiation file (enforced more strictly through 2026), keep the raw reports plus the ODM's signed cover letter naming the lot tested. Do not rely on a one-page summary.
Why Reading the Reports Is the Real Diligence Step
Korean ODM labs run these tests internally or contract out to an accredited third party. The report itself is a snapshot of one lot tested under one set of conditions, often a sample lot, not the lot you will sell. Your job at the sample-approval to production gate is to read the report well enough to know:
Was the testing done on the same formula you actually approved? (Compare INCI and percentages line by line.)
Was the package the same as your production package? (A formula that passes in a glass jar can fail in a PCR-plastic pump bottle because of oxygen permeability, light transmission, and headspace.)
Were the results inside the accepted limits at every time point, or did the lab call a borderline result a pass?
Were any time points missing or substituted? (This is the single most common quiet red flag.)
Korean ODM labs are not trying to deceive you. They are trying to ship. If you do not ask, they will not slow the production schedule to rerun a borderline 90-day reading at your expense.
Prerequisites Before You Open the Reports
Before you start reading any of the three reports, make sure you have three things in front of you. Without them, the numbers in the reports do not mean anything because you have nothing to compare them against.
The exact INCI list and percentages of the formula you signed off on. Korean ODMs sometimes test on a slightly older formula version when the timeline is tight. If the INCI on the stability report differs from the INCI on your final spec sheet, even by one preservative, the data is not directly applicable.
The packaging spec of your production order. Stability data is only valid for the package it was tested in. If the lab tested in 50 ml glass and you are filling 30 ml PP airless, you need either a packaging stability study or written acknowledgment that the data is interim.
Your target market regulatory requirement. US MoCRA, EU (EC) No 1223/2009, UK SCPN, Korea MFDS, and Japan PMDA do not all require the same documentation depth. EU PIF is the strictest of the major Western markets and requires the challenge test as a mandatory part of the safety assessment file.
Step 1: Reading the ICH Q1A (R2) Accelerated Stability Report
ICH Q1A (R2) is the International Council for Harmonisation guideline for pharmaceutical stability testing. The cosmetic industry has adopted its accelerated condition (40°C ± 2°C / 75% RH ± 5% RH) as a reference standard because it correlates reasonably well with real-time shelf-life prediction using Arrhenius kinetics.
A typical Korean ODM accelerated stability report contains these columns:
Time pointAppearanceColorOdorpHViscosityCentrifugeNotes T0 (initial)PassPassPass5.428,000 cPStableReference T1 (1 month)PassPassPass5.327,400 cPStable T2 (2 months)PassPassPass5.326,800 cPStable T3 (3 months)PassPassPass5.225,900 cPStable T6 (6 months)PassPassPass5.124,500 cPStableAccelerated end
What to look for, line by line:
Time points. A complete accelerated study has at least T0, T1, T3, and T6. T2 and T4 are common but not always present. If the report jumps from T0 to T3 to T6, that is acceptable if it follows the lab's standard protocol. If T6 is missing and only T3 is reported, ask why. ICH Q1A (R2) defines 6 months as the standard accelerated minimum.
pH stability. A widely used acceptance window for cosmetic emulsions is ±0.5 pH units from T0. The report above drifts from 5.4 to 5.1 over 6 months, which is inside that window. If pH drifts more than 0.5 units, especially downward in a product containing acidic actives like vitamin C, ascorbic acid, or AHAs, that is a real failure signal because preservative efficacy is pH-dependent. A formula preserved at pH 5.0 may not be preserved at pH 4.3.
Viscosity stability. A common acceptance window is ±15% from T0. The example above moves from 28,000 cP to 24,500 cP, which is roughly a 12.5% drop, inside the window. If viscosity drops more than 15%, the emulsion is beginning to break, even if visual appearance still looks fine. Bottle-pump products with viscosity drift become unusable in real consumer hands long before they look separated.
Appearance and color. Subjective columns. Korean ODM labs typically rate appearance against the T0 standard kept refrigerated. "Pass" means matches T0. If you see notes like "slight yellow tint" or "minor sediment at bottom" anywhere in the column, that is the lab being honest, and it is a signal worth pushing on.
Centrifuge cross-check. A common screen is 3,000 rpm for 30 minutes at T0, T3, and T6. Stable means no visible separation. If centrifuge is "stable" at T0 but "slight separation" at T3, the emulsion system is degrading even if pH and viscosity still look fine.
What is missing in many reports: real-time stability data. Accelerated is a predictor, not a substitute. Korean ODMs increasingly include 25°C ± 2°C / 60% RH ± 5% RH real-time data alongside accelerated, with readings at 0, 3, 6, 12, and 24 months. If you are launching a product with a 30-month PAO claim, you eventually need 12-month real-time data to support that claim with EU regulators. Ask whether the lab is running real-time in parallel and when the 12-month readout will be available.
Step 2: Reading the ISO 11930 Preservative Challenge Test Report
ISO 11930:2019 (with the 2022 A1 amendment) is the cosmetic preservative efficacy test, often called the challenge test or PET. The lab deliberately contaminates your product with high concentrations of five specific microorganisms and measures how quickly your preservative system kills them.
The 5-organism panel is fixed:
OrganismTypeWhat it represents Staphylococcus aureusGram-positive bacteriumSkin contamination from user hands Escherichia coliGram-negative bacteriumFecal contamination, water-borne Pseudomonas aeruginosaGram-negative bacteriumWater-system contamination, hardest to kill Candida albicansYeastHuman-source yeast contamination Aspergillus brasiliensisMouldEnvironmental and packaging mould
The test starts at day 0 with the inoculum count (typically 10⁵ to 10⁶ CFU/g for each organism), then reads recovery counts at day 7, day 14, and day 28.The two evaluation criteria:
CriterionBacteria (day 7)Bacteria (day 14 and 28)C. albicans (day 7)C. albicans (day 14 and 28)A. brasiliensis (day 14)A. brasiliensis (day 28) Criterion A≥ 3 log reductionNo increase from day 7≥ 1 log reductionNo increase from day 7No increase from day 0≥ 1 log reduction Criterion B≥ 3 log reduction by day 14No increase from day 14No increase from day 0 by day 14No increase from day 14No increase from day 0No increase from day 14
What this means in practice: Criterion A is a strong, fully self-preserving formula. Criterion B is conditional and requires either packaging-based contamination control (an airless pump, a single-use sachet) or written justification in the safety assessment. A product passing only Criterion B and shipped in an open-jar package is a safety-substantiation problem you do not want to argue about with FDA.
What to look for in the report:
The actual CFU counts at day 7, 14, and 28 for each organism, not just "PASS." If the report shows "PASS" with no numbers, ask for the raw data. A Criterion A pass with day-7 reductions of 4.5 logs for each bacterium is meaningfully different from a Criterion A pass that just barely cleared 3 logs on day 7 with a count that crept back up by day 28.
A. brasiliensis is the hardest organism for water-based formulas to kill. If the day-28 result on A. brasiliensis is borderline or shows recovery, that is the most common signal that the preservative system is weak. Reformulating with a stronger antifungal pair (such as an organic acid plus a permitted ester) is often the fix.
If the formula is fragrance-free, low-pH, surfactant-based, or otherwise considered intrinsically self-preserving, the lab may apply Method B of ISO 29621 (the microbiological risk assessment that exempts certain products from challenge testing). The ODM should hand you that justification document, not skip the test silently.
What is missing in many reports: the package effect. The challenge test is run on the bulk formula, not the formula in the production package. A product that passes Criterion A in bulk can still fail in a 200-day-aged airless pump if oxygen permeation depletes the preservative. Ask whether the lab also tested challenge on a sample held in the production package for 90 days.
Step 3: Reading the ISO 17516 Microbiological Limits Report
ISO 17516:2014 sets the microbiological acceptance limits on the finished product as released. The challenge test (ISO 11930) tells you whether the preservative system works when stressed. ISO 17516 tells you whether the actual filled product is clean enough to ship.
The limits are in two categories:
Product categoryTotal viable aerobic mesophilic countRequired absence in 1 g/ml Category 1: eye area, mucous membranes, children under 3≤ 10² CFU/g (100 CFU/g)E. coli, S. aureus, P. aeruginosa, C. albicans Category 2: all other leave-on and rinse-off≤ 10³ CFU/g (1,000 CFU/g)E. coli, S. aureus, P. aeruginosa, C. albicans
What to look for in the report:
Category classification. The lab should explicitly state the category. A K-beauty essence used around the eyes (think the under-eye application step common in 10-step routines) is debatable. A conservative ODM will class it Category 1 and apply the 10² CFU/g limit. If your formula is borderline and the lab applied Category 2, ask whether the lab considered the application area in the classification decision.
Actual count, not just "compliant." The 10³ CFU/g limit is the ceiling, not the target. A well-preserved product released from a Korean ODM should typically read <10 CFU/g (below detection limit) or <100 CFU/g. A reading of 850 CFU/g is technically compliant but very close to the ceiling, which means the production line was not as clean as it should have been or the preservative is barely keeping up.
Absence test results. The four specified pathogens must be absent in 1 g. The report should show "absent in 1 g" or "<1 CFU/g" for each. If any pathogen is detected at any level, the batch fails ISO 17516. There is no acceptable threshold for these four organisms in a finished cosmetic.Lot identification. The report must name the lot tested. If your production order will be a different lot, ask the ODM to repeat ISO 17516 on the production lot at release. Lot-to-lot variability in microbial count is real, and you want the data on the lot you will sell, not on a sample run.
Founder Note
"I'm Liz, I run altameet from Manhattan, NYC. I have seen indie founders sign off on production with stability reports they could not have read in detail because no one ever showed them what the columns mean. If you want a quick gut-check on whether the report sitting in your inbox is complete enough to commit to production, I'll grab 15 minutes free with you and read it with you."
What Each Report Actually Costs the ODM
Korean ODMs do not always itemize testing costs on the quote. They are bundled into the development fee or the unit cost. Knowing the rough numbers helps you push back if a lab tries to skip a test for "cost reasons."
TestTypical lab cost range (USD per formula)Duration Accelerated stability (ICH Q1A reference, 6 months at 40°C/75% RH)$300 to $8006 months (with intermediate readouts) Real-time stability (25°C/60% RH, 12 month minimum readout)$400 to $1,20012 to 36 months ISO 11930 preservative challenge test$500 to $1,5005 to 6 weeks ISO 17516 microbiological limits (per release lot)$80 to $2005 to 7 days Packaging compatibility study (per package SKU)$300 to $7003 to 6 months
For a single SKU launch with one production package, the full stability and microbiology package usually lands between $1,500 and $4,000 of pure lab cost, depending on whether the ODM uses an in-house lab or an external accredited lab. Most reputable Korean ODMs absorb this into the development fee, which is one reason MOQs and per-unit pricing matter at small volumes: the testing cost amortizes over the production lot.
Common Founder Mistakes When Reading These Reports
After eight years of reading these packages with founders, the same handful of mistakes show up across categories.
Mistake 1: scanning only for "PASS" and not reading the actual time-point data. A Criterion B pass on ISO 11930 with a borderline day-28 A. brasiliensis count is technically a pass but a fragile one. The number matters, not the verdict.
Mistake 2: accepting an accelerated stability report alone for an EU launch. EU PIF requires support for the shelf-life claim. Accelerated alone is interim. You need real-time data, even if at the time of launch you only have 6 or 12 months of real-time and the rest is projected.
Mistake 3: assuming ISO 17516 was run on the production lot when the report names a "pilot lot" or "R&D lot." Microbial counts depend on the production line cleanliness on the day of fill. Sample-lot data does not guarantee production-lot results.
Mistake 4: ignoring packaging. A formula that passes every test in 100 ml glass is a different product in 30 ml PETG with a pump dispenser. The plastic, the dispenser mechanism, the headspace, and the seal all interact with the formula. Ask whether the testing was done in the production package or in a generic test container.
Mistake 5: not getting the lab's signature and accreditation on the report. A Korean ODM in-house lab is often ISO 17025 accredited or KOLAS accredited. The report should say so. If it does not name the accreditation, ask. For MoCRA safety substantiation, an accredited lab's signed report carries more weight than an unsigned PDF.
Mistake 6: treating challenge test results as immutable for the life of the formula. If you reformulate (even a minor preservative percentage adjustment), the ISO 11930 results are no longer valid. The test should be repeated. Many indie founders quietly tweak preservative percentages between launch and reformulation to fix supply chain issues and forget that the challenge test data they have on file is now stale.
Founder Note Two
I will mention this once more because it is the single most useful thing you can do at this gate: if you have a Korean ODM stability package sitting in your inbox right now and you are not sure what to ask, book your free 15-min K-beauty manufacturing gut-check and I will read it with you live. Most of what I do on these calls is point at the columns that say "Pass" but actually mean "borderline" and tell you what to ask the ODM lab manager.
How These Reports Connect to MoCRA, EU, and Korea MFDS FilesThe three reports are not independent. They feed into the larger safety substantiation file for each market you launch in.
For the US under MoCRA: the Responsible Person must maintain records supporting adequate safety substantiation for every product. FDA does not prescribe a specific test protocol, but in practice ISO 11930 challenge test data, stability data showing no degradation that would affect safety, and ISO 17516 microbiological data on the production lot together form the core of a defensible safety file. 2026 marks the year MoCRA enforcement intensifies past registration to substantiation file inspection.
For the EU under Regulation (EC) No 1223/2009: the Product Information File (PIF) must include microbiological specifications of raw materials and finished product, a preservative efficacy test (challenge test) result, and stability testing supporting the shelf-life or PAO (period after opening) claim. The PIF is signed off by the Responsible Person assessor (a qualified safety assessor). Missing or incomplete reports here will block the assessor from signing.
For Korea under MFDS: the Cosmetics Act and the Korean MFDS Notification 2026-16 (amended March 2026) cover safety standards and test methods. Functional cosmetic products undergo additional MFDS examination. For the standard cosmetic category, internal documentation including stability and microbiological data is held by the Korean manufacturer (the ODM) and the responsible cosmetic distributor.
For Japan and other markets: PMDA requires submission of stability and microbiological data depending on the product category. ASEAN markets generally follow ASEAN Cosmetic Directive requirements that align broadly with EU principles.
A single Korean ODM stability package can support multiple markets if you frame the requirements upfront. Make sure the ODM lab knows which markets you are targeting before they start testing, so the report includes the data each market requires.
What a Good Korean ODM Stability Package Looks Like
A complete, defensible package from a Korean ODM partner at the sample-approval to production gate should include all of the following:
Cover letter naming the formula version, lot number, package SKU, and target markets.
ICH Q1A (R2) reference accelerated stability report with T0, T1, T3, and T6 time points minimum. Real-time 25°C/60% RH data at T0, T3, T6, and T12 if available.
ISO 11930 challenge test report with raw CFU counts at day 0, 7, 14, and 28 for each of the 5 organisms, and a clear statement of Criterion A or Criterion B pass.
ISO 17516 microbiological limits report on the production-relevant lot, with category classification, total viable count, and absence-test results for the 4 specified pathogens.
Packaging compatibility data, or a written acknowledgment that the production package will require its own stability study.
Lab accreditation statement (ISO 17025 or KOLAS) and signature of the responsible analyst.
The raw chromatograms or counts behind any summary table, available on request.
If any of those are missing, ask. A reputable Korean ODM will not push back on the request because the work has already been done and the document exists somewhere in the project file.
FAQ
Q: My Korean ODM says ICH Q1A is for pharmaceuticals, not cosmetics, and they use their own internal protocol. Is that a problem?
A: No, but ask to see the internal protocol document. Most Korean ODM internal protocols are very close to ICH Q1A conditions (40°C/75% RH accelerated) because the global cosmetic industry has converged on those conditions. The issue is not the protocol name, it is whether the conditions, time points, and acceptance criteria are documented in writing and applied consistently.
Q: Can I use my Korean ODM's challenge test result for my EU launch, or do I need to retest in the EU?
A: ISO 11930 is an international standard. A report from a Korean lab that follows ISO 11930:2019 (with the 2022 A1 amendment) is accepted by EU Responsible Persons and safety assessors. What matters is the test method, the accreditation, and the raw data. You do not need to retest in the EU just because the lab is in Korea.
Q: How long is challenge test data valid?
A: Until the formula changes. The challenge test is specific to the formula composition. Any change to preservative type, preservative percentage, pH (when it materially shifts), or surfactant system invalidates the data. A change in fragrance house alone usually does not, but ask the safety assessor.
Q: My ODM ran centrifuge at 3,000 rpm for 30 minutes at T0 only. Should they have run it at T3 and T6 too?
A: Repeating centrifuge at T3 and T6 is the more thorough approach because emulsion stability can degrade over time even when the visual appearance still looks fine. Some Korean labs do this routinely. If the ODM only ran centrifuge at T0, ask them to repeat it at T6, especially for water-in-oil systems.
Q: What if my real-time stability data is only 6 months but I want to claim 24-month shelf life?A: Accelerated stability at 6 months under ICH Q1A reference conditions is often used as a predictor for 24-month real-time shelf life, using the Arrhenius approximation. For internal documentation and US MoCRA, this projection is generally accepted at launch with the commitment to continue real-time stability. For EU PIF, the safety assessor may require interim updates with real-time data as it accumulates.
Q: My ODM's report shows Criterion B pass on challenge test. Should I reject the formula?
A: Not necessarily. Criterion B is acceptable when paired with appropriate packaging control (airless pump, single-use sachet, tube with backflow prevention) and documented in the safety assessment. If your production package is an open jar or a dropper bottle with significant headspace, then yes, push back and ask for reformulation to Criterion A.
Q: How much should I budget for stability and microbiology testing on a single SKU launch?
A: For a single SKU with one production package, plan for $1,500 to $4,000 in lab costs covering accelerated stability, real-time stability initial readout, ISO 11930 challenge test, ISO 17516 release testing, and basic packaging compatibility. Most Korean ODMs include this in the development fee at MOQs of 3,000 units or higher.
Working With ALTA MEET
We sit on the founder side of the table when Korean ODMs hand over the stability and microbiology package. We read the reports line by line, flag the borderline columns, push back on missing time points, and translate the lab's "PASS" verdicts into actual diligence questions you can ask before wiring the production deposit. This is what we do across heartleaf essences, galactomyces ferment serums, snail mucin moisturizers, and the long tail of K-beauty indie launches.
If you have a Korean ODM stability package on your desk right now and you are not sure what to ask, book a free 15-min gut-check with Liz. Bring the PDF, we will read it together.
Sources
ICH Q1A(R2) Stability Testing of New Drug Substances and Products. ICH database
ISO 11930:2019 Cosmetics, Microbiology, Evaluation of the antimicrobial protection of a cosmetic product. ISO catalogue
ISO 17516:2014 Cosmetics, Microbiology, Microbiological limits. ISO catalogue
Regulation (EC) No 1223/2009 on cosmetic products. EUR-Lex
US Food and Drug Administration, Modernization of Cosmetics Regulation Act of 2022 (MoCRA). FDA
Korea Ministry of Food and Drug Safety (MFDS) cosmetics regulations. MFDS English portal
ISO/TR 18811:2018 Cosmetics, Guidelines on the stability testing of cosmetic products. ISO catalogue
Reviewed for accuracy by ALTA MEET's formulation consulting team. Last revised 2026-06-11.
