Why Your First Challenge Test Failed (And How to Pass ISO 11930 on the Second Try)

The USD 450 Lab Report That Said "Fail": What Actually Went Wrong

A Spanish indie skincare brand on our 100-kg Phenoxyethanol account shipped three 50 ml samples of a new vitamin C serum to a Barcelona microbiology lab in September 2026. Six weeks and EUR 420 later, the ISO 11930 report came back with a Criterion A fail — Pseudomonas aeruginosa (ATCC 9027) regrew to 4 × 10³ CFU/g by Day 28 after a clean Day 7 kill.

The brand's first instinct was to raise the preservative dose from 0.8% Phenoxyethanol + 0.2% Ethylhexylglycerin to 1.0% + 0.3%. That instinct would have failed the second run too. The real culprit was the brand's co-manufacturer re-using purified water from an unlined polyethylene storage tank; Pseudomonas biofilm in the tank seeded the formula faster than the preservative system could neutralise fresh colony-forming units.

The fix was a 0.15% Tetrasodium Glutamate Diacetate (GLDA) chelator addition plus a water-system audit at the co-man. The second ISO 11930 run passed Criterion A at Day 28 with a 4.1-log reduction. Total cost of the misdiagnosis: one wasted lab run, a six-week launch delay, and roughly EUR 2,000 in reformulation plus retesting fees.

This article walks through the ISO 11930 protocol the way an indie brand owner needs to understand it — not as a microbiology textbook, but as a procurement document that tells you which questions to ask before you ship samples to a lab.

What Does ISO 11930 Actually Measure?

ISO 11930:2019 (full title: Cosmetics — Microbiology — Evaluation of the antimicrobial protection of a cosmetic product) measures how much your preservation system can reduce a deliberately-added microbial inoculum over 28 days, strain by strain. The test does not measure in-use contamination resistance, nor does it predict shelf-life stability under thermal stress. It measures one thing: log reduction of a known challenge over time.

A technician inoculates each 20 g aliquot of your product with approximately 10⁵-10⁶ CFU/g of one of five reference strains, then counts surviving colonies at Day 2 (optional), Day 7, Day 14, and Day 28. The log reduction at each timepoint is compared against the pass threshold for the chosen criterion. The published standard is maintained by ISO Technical Committee 217 (Cosmetics) and is referenced directly in European Commission SCCS Notes of Guidance SCCS/1647/22 for preservative evaluation.

The 28-day window is a compromise between regulatory practicality and real shelf-life prediction. Products that pass ISO 11930 at Day 28 may still contaminate after 12 months of in-use handling in a jar; the test is a necessary floor, not a complete safety guarantee. Supplementary in-use testing is recommended for jar-packaged leave-on products, but is not part of ISO 11930 itself.

Criterion A vs Criterion B: Which One Does Your Product Need?

ISO 11930 offers two pass criteria. Criterion A is the strict path — the preservation system must stand alone against microbial challenge. Criterion B is relaxed by roughly 1 log at each timepoint, but requires additional supporting evidence (lower-risk packaging, usage pattern, or production controls) documented in the Cosmetic Product Safety Report.

Choosing the wrong criterion is a common and expensive mistake. Submitting a sensitive-skin facial serum under Criterion B saves nothing if the CPSR assessor rejects the data and demands a Criterion A re-run. Equally, forcing a Criterion A pass on a shower gel costs preservative headroom you could have spent on milder surfactants or lower-concentration preservation.

The decision wizard below encodes the practical rules Onerchemical sees contract labs apply in 2026-10 — product type, market, and audience combined to generate the test protocol and the add-ons your assessor will ask for.

What Happens Across the 28-Day Timeline?

The 28-day timeline is not a continuous experiment — labs typically count colonies at four discrete timepoints. Understanding what each timepoint tests helps you interpret a borderline report without over-reading noise.

What a Day 7 bacterial fail usually means

A Day 7 bacterial fail (R < 3 for E. coli, S. aureus, or P. aeruginosa) typically means the primary preservative concentration is insufficient for the formula pH, or the preservation system is incompatible with another formula component. Common patterns include organic acid preservatives (benzoic, sorbic) losing dissociation above pH 5.5, or non-ionic preservatives being sequestered by high-HLB surfactants.

What a Day 28 regrowth signal usually means

Regrowth after a clean Day 7 or Day 14 kill — the pattern that cost our Barcelona brand EUR 2,000 — points to one of three root causes: biofilm-forming contamination (Pseudomonas), insufficient chelator for iron-dependent organisms, or preservative depletion by raw-material bioburden. The remediation is almost never "more primary preservative"; it is usually a chelator pair or an upstream material audit.

Before You Ship Samples: What Is on the Pre-Submission Checklist?

Half of first-run failures Onerchemical sees in indie brand reports are preventable with a 20-minute pre-submission audit. Labs will test what you send; they will not catch upstream mistakes.

1. Formula pH measured and recorded. Measure at 23 ± 2°C with a calibrated electrode, not pH strips. Record on the sample submission form; many preservation failures correlate with a 0.3-0.5 unit pH drift during stability.
2. Water activity (Aw) for anhydrous or low-water formulas. If Aw < 0.75, flag the Microbial Risk Assessment option (ISO 11930 Annex A). Aw < 0.6 typically justifies a full MRA substitute for the challenge test.
3. Batch size documented. Pilot batches below 500 g often concentrate preservative loss into air-exposed surfaces; the challenge test should use batches representative of production scale.
4. Container material matches production. PET bottle versus PP airless pump versus glass jar will produce different challenge test results for the same formula. Ship samples in the production packaging, not generic lab vials.
5. Preservative COA bundle attached. Lot numbers, assay values, and heavy-metal / solvent residue results for every preservative in the formula. Labs will not test the preservatives, but assessors will cross-reference your CPSR against them.
6. Raw-material bioburden (TAMC / TYMC) within spec. Total Aerobic Microbial Count < 10³ CFU/g, Total Yeasts and Moulds < 10² CFU/g per ISO 17516. Botanical extracts routinely fail this and need audit before formulation.
7. Protocol choice declared. ISO 11930 Criterion A or B, with or without USP <51> parallel, re-inoculation protocol if applicable, wipe protocol for wet wipes. Changing protocol mid-test triggers a full re-run.

How Do You Read a Challenge Test Report Beyond Pass/Fail?

A "Pass" verdict is not always a comfortable pass. Five red flags routinely appear on reports that technically clear the threshold but should prompt a formulation review before scaling to production.

• Red flag 1 — Borderline log reduction at any timepoint. A 3.1-log bacterial reduction at Day 7 is a pass; a 3.1-log reduction with the Day 28 count 10% higher than Day 14 is a system under strain. Scale production variation will cross the pass/fail line.
• Red flag 2 — Single strain outlier. If four strains clear by 4 logs and one strain barely passes at 3 logs, the formula has a known weakness. Investigate the chemistry of the outlier strain versus the preservation system.
• Red flag 3 — Day 28 regrowth within pass range. Any upward CFU count between Day 14 and Day 28 is the "no increase" criterion being borderline-met. Investigate biofilm risk and chelator adequacy before shipping to production.
• Red flag 4 — Aspergillus brasiliensis near detection limit at Day 28. Mould counts within an order of magnitude of the detection limit indicate the preservation system is working but has limited headroom; raw-material lot variation may trip future batches.
• Red flag 5 — Lab did not test Day 2 or did not report initial inoculum recovery. Cheaper labs skip Day 2 and do not confirm initial inoculum recovery; both are optional under ISO 11930 but their absence makes the report difficult to interpret or defend to a CPSR assessor.

ISO 11930 vs USP <51> vs EP 5.1.3 vs CTFA M-3: When Is Each One Required?

The four major challenge test protocols share the same 5-strain panel but diverge on log-reduction thresholds, timepoints, and the regulatory contexts that accept them. Choosing the wrong one — or defaulting to just ISO 11930 for a US retail launch — creates compliance friction that costs weeks of back-and-forth.

For most indie brands shipping EU + US + ROW, the practical recommendation is ISO 11930 Criterion A plus USP <51> in parallel. The incremental lab cost is roughly USD 150-250 and the US retailer onboarding paperwork is already in your hand. Save EP 5.1.3 for pharma-adjacent products and skip CTFA M-3 unless a specific retailer still asks for it on the specification sheet.

Which Markets Legally Require a Challenge Test — and Which Only Expect One?

No major market mandates a specific challenge test method by name in primary legislation. Every major market expects demonstrable preservation efficacy as part of the safety dossier. The gap between "mandated" and "expected" is where indie brands get surprised.

EU and UK

As of 2026-10, EU Regulation 1223/2009 Article 10 and Annex I Part B require the Cosmetic Product Safety Report (CPSR) to include microbiological specifications and preservation efficacy data. ISO 11930 is the most-accepted method among qualified CPSR assessors; alternative methods must be scientifically justified in writing. UK Cosmetic Regulation inherits the EU framework post-Brexit with the same expectations and the same ISO 11930 default.

United States

As of 2026-10, the Modernization of Cosmetics Regulation Act (MoCRA) 2022 does not mandate a specific challenge test method, but requires facility registration, product listing, and good manufacturing practice compliance. US retailers (Target, Ulta, Sephora, Amazon's premium beauty programs) include USP <51> on their specification checklists for shelf approval. FDA does not test cosmetic preservation routinely, but will cite a brand under adverse event reporting if microbial contamination causes consumer injury.

China

As of 2026-10, China 《化妆品安全技术规范》(2015 edition) does not reference ISO 11930 directly but requires microbiological testing per Chinese Pharmacopoeia Appendix methods. NMPA-filed products supplied with an ISO 11930 report plus an IECIC-compliant preservative selection usually clear the Technical Dossier Review. Challenge test data from accredited Chinese labs (CMA / CNAS marked) carries equivalent weight to international reports for NMPA filings.

Japan and Korea

As of 2026-10, Japan Pharmaceutical Affairs Law treats general cosmetics (化粧品) under industry self-regulation; the Japan Cosmetic Industry Association guidance accepts ISO 11930. Quasi-drug (医薬部外品) products carry a higher evidence burden with a 3-week extended protocol per the Pharmaceutical Society of Japan guideline. Korea KFDA follows a similar general-cosmetic / functional-cosmetic split, with ISO 11930 the accepted baseline.

Where Should You Run the Test — Independent Lab, In-House, or Contract Manufacturer?

Three paths are available to an indie brand, with different cost, credibility, and turnaround trade-offs. The decision usually comes down to whether the report needs to defend a CPSR assessment or just screen formula iterations during development.

Independent ISO 17025 lab

Independent, ISO 17025-accredited microbiology labs produce the gold-standard report CPSR assessors and retailers accept. Cost ranges from USD 350-600 per SKU for a single ISO 11930 run in 2026-10 at EU and US indie-friendly labs. Turnaround from sample arrival to signed report is typically 5-6 weeks. Report defensibility is highest, and the lab assumes liability for test validity.

Contract manufacturer in-house lab

Many Chinese and European contract manufacturers run challenge tests in-house as part of their formulation development service. Cost is often bundled into the formulation fee or priced at USD 150-300 per SKU. Report defensibility varies; assessors may require independent re-testing if the CMO is also the formula owner. Useful for formulation iteration, less useful for compliance.

Brand in-house screening

Technically possible, practically rare. Running ISO 11930 in-house requires a biosafety cabinet, calibrated incubators at 22.5 ± 2.5°C and 32.5 ± 2.5°C, documented reference strains with controlled passage history, and a trained microbiologist. Capital outlay runs USD 25,000-60,000 before the first test. For almost all indie brands, the economics favor contract testing.