PET / Challenge Testing (ISO 11930)

A Preservative Efficacy Test, usually called a challenge test or PET, deliberately contaminates a cosmetic product with known quantities of bacteria, yeast and mould, then measures over 28 days how quickly and how completely the product’s preservative system kills them. It answers a single question that no formulation record can answer on its own: if this product is contaminated in use, will it protect itself and the consumer, or will it become a growth medium?

Oxford Biosciences conducts the test in its own microbiology laboratory to ISO 11930:2019. The result is a section of the Product Information File in its own right, and the data feeds directly into the Cosmetic Product Safety Report.

Regulatory basis

In the EU and UK, Annex I, Part A, Section 3 of Regulation (EC) No 1223/2009 requires the safety information to contain the microbiological specifications of the substance or mixture and of the cosmetic product, and states that particular attention shall be paid to cosmetics used around the eyes, on mucous membranes in general, on damaged skin, on children under three years of age, on the elderly and on people with compromised immune responses. The same section requires the results of the preservation challenge test.

The Regulation names the requirement; ISO 11930 is the technical means by which it is met. The current edition is ISO 11930:2019, Cosmetics, Microbiology, Evaluation of the antimicrobial protection of a cosmetic product. It replaced the 2012 edition and is the reference method cited in the SCCS Notes of Guidance and in the Cosmetics Europe guidance on microbiological quality.

The companion standard for finished product release is ISO 17516:2014, which sets the microbial content limits: no more than 10² CFU per gram or millilitre for products intended for children under three, the eye area or mucous membranes, no more than 10³ CFU per gram or millilitre for all other products, and absence of Escherichia coli, Pseudomonas aeruginosa, Staphylococcus aureus and Candida albicans in 1 g or 1 mL. A product that passes ISO 17516 is clean when it leaves the factory. A product that passes ISO 11930 stays clean once the consumer has opened it. Both are needed.

Outside the EU and UK, the same data serves ASEAN Cosmetic Directive notifications, GCC registrations under GSO 1943, Australian and New Zealand supply, and the safety substantiation record that section 3505 of MoCRA requires for products sold in the United States, where USP <51> is the domestic equivalent and the ISO 11930 report is accepted as substantiation.

When a challenge test is required and when it is not

ISO 11930 applies to any product that can support microbial growth. In practice that means every product containing free water: creams, lotions, serums, gels, shampoos, conditioners, cleansers, toners, masks, wet wipes, liquid foundations and mascaras.

ISO 29621:2017, Guidelines for the risk assessment and identification of microbiologically low-risk products, describes the products that do not require a challenge test because their physicochemical properties make growth impossible. The main categories are:

• Anhydrous products with no free water: balms, oils, butters, oil-based serums and lipsticks, provided nothing in the packaging or use pattern introduces water.
• Products with water activity (aw) below 0.75, which excludes most bacteria, and below 0.60, which excludes yeasts and moulds.
• Products with pH at or below 3 or at or above 10, where the extremes of pH are themselves hostile to growth.
• Products with ethanol content at or above 20 percent by weight, and hydroalcoholic products generally at that threshold.
• Products in packaging that prevents any contact between the contents and the user or the environment during use, such as sealed single-dose units and airless pump systems with validated non-return valves.
• Products filled at temperatures that sterilise them and never subsequently opened before use.

An anhydrous product on which the consumer applies water, such as a cleansing balm used with wet hands or a bar soap kept in a shower, is not automatically low risk. The assessment is made on the product as it is used, not as it sits in the jar. Where a product is claimed as low risk, the CPSR must contain the ISO 29621 reasoning, and we write that reasoning as part of the assessment.

The five test organisms

ISO 11930 specifies five reference strains, chosen because they represent the organisms most likely to be introduced by the consumer, the manufacturing environment or the raw materials, and because they span Gram-negative bacteria, Gram-positive bacteria, yeast and mould.

Organism	Type	Reference strain	Why it is included
Pseudomonas aeruginosa	Gram-negative bacterium	ATCC 9027 / NCIMB 8626	Water-borne, resistant to many preservatives, grows in low-nutrient conditions, the most common cause of cosmetic recalls in the EU RAPEX/Safety Gate database
Staphylococcus aureus	Gram-positive bacterium	ATCC 6538 / NCIMB 9518	Skin flora, introduced by fingers during use
Escherichia coli	Gram-negative bacterium	ATCC 8739 / NCIMB 8545	Indicator of faecal contamination and poor hygiene in manufacture or use
Candida albicans	Yeast	ATCC 10231 / NCPF 3179	Mucosal flora, relevant for products used near the mouth and eyes
Aspergillus brasiliensis	Mould	ATCC 16404 / NCPF 2275	Airborne spores, the organism most likely to survive a weak preservative and grow on the surface of a cream

Aspergillus brasiliensis was formerly named Aspergillus niger and the older name still appears on some reports. It is the same strain. Where a product has a history of contamination with an organism outside this list, or an in-house isolate is more relevant than the reference strain, ISO 11930 permits additional strains to be added and we add them at the client’s request.

How the test is done

1. Preliminary characterisation of the sample

On receipt, the product is logged, photographed, and its pH and appearance recorded. A baseline Microbial Content Test to ISO 17516 confirms that the sample is not already contaminated, because a product carrying a bioburden at the start cannot give an interpretable challenge result. The formulation is reviewed to identify the preservative system and any ingredients that may interfere with the plating step: cationic surfactants, phenolics, organic acids, ethanol, chelating agents and essential oils all have antimicrobial activity that has to be neutralised in the counting medium.

2. Neutraliser validation

This is the step that separates a valid challenge test from a piece of paper. When a sample is taken from the inoculated product and plated to count survivors, the preservative comes with it. If the preservative keeps working on the plate, organisms that were alive in the product die on the agar, the count comes back low, and the product appears to have passed a test it did not pass.

ISO 11930 requires the laboratory to demonstrate, for each organism and for the specific product, that the neutralising diluent used for counting stops the preservative acting within the plating step and is not itself toxic to the organism. Three conditions are tested: the organism in neutraliser alone, the organism in neutraliser with product added, and the organism in buffer with no neutraliser. The recovery in the presence of product and neutraliser must be at least 50 percent of the recovery without product for the neutraliser to be accepted. Where the standard diluent fails, the formulation is adjusted: higher concentrations of lecithin and polysorbate 80 for phenolics and parabens, sodium thiosulphate for halogen-releasing preservatives, histidine for aldehydes and formaldehyde releasers, additional dilution for cationics. Validation is repeated until every organism recovers.

Reports that omit the neutraliser validation, or state it in a single line without data, are the most common reason a challenge test is rejected during a Product Information File inspection. Ours reports the validation results in full.

3. Preparation of the inoculum

Each organism is grown from a reference culture no more than five passages from the original stock, on Tryptic Soy Agar for bacteria at 32.5 °C ± 2.5 °C for 18 to 24 hours, and on Sabouraud Dextrose Agar for yeast at 22.5 °C ± 2.5 °C for 44 to 52 hours and for mould at the same temperature for 5 to 7 days until sporulation. Cells are harvested into sterile saline with 0.05 percent polysorbate 80 for the mould so that the spores disperse, and the suspension is adjusted by optical density to a target concentration, which is then verified by plate count. The target is 10⁷ to 10⁸ CFU/mL for bacteria and 10⁶ to 10⁷ CFU/mL for yeast and mould.

4. Inoculation

A known mass of product, typically 20 g, is inoculated with 1 percent by mass of the organism suspension, one organism per container, five containers per product. This gives an initial concentration in the product of 10⁵ to 10⁶ CFU/g for bacteria and 10⁴ to 10⁵ CFU/g for yeast and mould. The inoculum volume is kept to 1 percent so that the water introduced does not itself alter the product’s water activity or dilute the preservative. The product is mixed until the inoculum is homogeneously distributed, which for viscous emulsions means mechanical mixing, and the containers are stored at 22.5 °C ± 2.5 °C in the dark for the duration of the test.

Immediately after inoculation, a sample is taken from each container, neutralised, diluted and plated. This T0 count confirms that the target concentration was achieved and establishes the baseline against which every subsequent log reduction is calculated.

5. Sampling and counting

Samples are taken at day 7, day 14 and day 28. At each point, 1 g of inoculated product is dispersed in 9 mL of the validated neutralising diluent, serially diluted, and plated in duplicate by the pour plate or spread plate method. Bacterial plates are incubated at 32.5 °C ± 2.5 °C for 48 to 72 hours; yeast and mould plates at 22.5 °C ± 2.5 °C for 3 to 5 days. Colonies are counted, the dilution factor applied, and the result expressed as CFU/g. The log reduction at each time point is the difference between log₁₀ of the T0 count and log₁₀ of the count at that time. A count below the detection limit of the method, 10 CFU/g at the lowest dilution, is reported as such and treated as the maximum measurable reduction.

Where the product is opaque or coloured, the plating medium and dilution are adjusted so that colonies can be distinguished from product residue, and each batch of plates carries a positive control of the organism in diluent alone and a negative control of sterile diluent.

6. Evaluation against Criteria A and Criteria B

ISO 11930 sets two sets of acceptance criteria, expressed as the minimum log reduction required at each sampling point. “NI” means no increase from the previous reading.

Organism	Criteria A: day 7	Criteria A: day 14	Criteria A: day 28	Criteria B: day 14	Criteria B: day 28
Bacteria (P. aeruginosa, S. aureus, E. coli)	≥ 3 log	≥ 3 log	NI	≥ 3 log	NI
Candida albicans	≥ 1 log	≥ 1 log	NI	≥ 1 log	NI
Aspergillus brasiliensis	≥ 0 log (NI)	≥ 1 log	NI	≥ 0 log (NI)	NI

Criteria A is the primary standard. A product meeting Criteria A for all five organisms is considered adequately protected in the form tested, without further justification.

Criteria B is a lower standard that ISO 11930 allows only where the risk assessment in Annex B of the standard demonstrates that additional factors reduce the microbiological risk: protective packaging, a low-risk use pattern, a limited period after opening, or physicochemical properties that fall short of the ISO 29621 thresholds but still constrain growth. A product meeting Criteria B is not a product that has passed on a technicality; it is a product whose protection is shared between the formula and something else, and the CPSR has to say what that something else is. We write that risk assessment when a product meets Criteria B, and we tell the client when the honest conclusion is that the preservative system needs to be strengthened instead.

Failure at any organism, at any time point, is a failure of the test.

Interpreting the result

A pass is not a certificate; it is a data set with a conclusion. The report presents the raw counts and log reductions for every organism at every time point alongside the criteria, so that the safety assessor, the Responsible Person and any inspector can see exactly where the margin lies. A product that scrapes past Criteria A at day 7 with a 3.1 log reduction for Pseudomonas is legally protected, but a small reformulation, a change of supplier for the preservative, or a shift in pH during storage can move it across the line. We say so in the report, because the challenge test should inform the formulation, not merely certify it.

The result is specific to the batch tested. A change to the preservative, its concentration, the pH, the water content, the chelating agent, the packaging type, or the manufacturing process requires a repeat test. A change to fragrance, colour or a non-functional ingredient at low concentration usually does not, and we advise on which changes trigger a retest.

Second-cycle and repeat-inoculation testing

For products with an extended period after opening, for multi-use products used around the eyes, or where a client wants to demonstrate robustness rather than simple adequacy, the test can be extended with a second inoculation at day 28 into the same containers, followed by a further 28-day cycle. This simulates repeated contamination in use and exposes preservative systems that are consumed by the first challenge. It is not required by ISO 11930 but is recognised by it, and it is the test to specify when a product is going into a jar rather than a pump.

What the report contains

• Product identification, batch, form, packaging and date of receipt
• Formulation summary and identification of the preservative system
• Baseline Microbial Content Test result to ISO 17516:2014
• Neutraliser validation data for each organism, with percentage recovery
• Inoculum preparation, strains, passage number and verified inoculum concentration
• Raw plate counts, CFU/g and log reduction at T0, day 7, day 14 and day 28 for each organism
• Evaluation against Criteria A and Criteria B
• Where applicable, the Annex B risk assessment supporting acceptance under Criteria B
• Conclusion on the adequacy of antimicrobial protection in the form tested
• Investigator identification and signature

What to send

Approximately 150 g or mL of product, ideally in its final packaging, from a single batch. Where the product is sold in multiple pack formats that differ in exposure (a jar and an airless pump, for instance), the jar is the worst case and the one to test. The full formulation with percentages and supplier documentation for the preservative is required before the neutraliser validation can be designed. Samples should be sent at ambient temperature unless the product requires refrigeration.

How it fits with the CPSR

The challenge test result populates Annex I, Part A, Section 3 of the safety report directly. Where we prepare both, the microbiological section of the CPSR is written from our own primary data and cross-referenced to the stability study and the period-after-opening decision under Article 19(1)(c). Where a client brings a challenge test from another laboratory, we review it for the neutraliser validation, the strains, the inoculum levels and the sampling points before relying on it, and we tell the client if it cannot be relied on.