Last Updated on May 29, 2026 by Hafsa J.

Why a Clean Lab Test Isn’t Enough: The Suntegrity Mold Recall

A sunscreen passed its release testing. Every required microbial check came back within limits, the batch shipped, and the product went out to retailers and to Amazon at fifty-eight dollars a tube. Months later, mould was growing inside some of those tubes.

That is the Suntegrity recall of May 2024, and it is one of the cleanest illustrations I have come across of a gap most cosmetics manufacturers do not realise they have. The company did the testing. The testing was not wrong. It simply was not designed to catch what eventually went wrong. If you run a cosmetics operation and your microbiological control begins and ends with batch-release testing, this recall is a mirror, and I want to walk you through exactly what it reflects.

What the recall notice actually said

Here are the facts, drawn from the company’s own recall notice and the FDA posting, with nothing added. On May 24, 2024, Suntegrity Skincare voluntarily recalled nine lots of its Impeccable Skin Sunscreen Foundation. The trigger was a single lot, 115BU, where testing found a higher-than-acceptable mould count, the species being Aspergillus sydowii. The company recalled the other eight lots out of caution even though their own results came back clear. Importantly, and I want to state this plainly because it matters: no adverse event reports had been received at the time of the recall. Nobody was reported harmed. This was a quality failure caught and acted on, not an injury story.

The single most important sentence in the whole notice is the company’s own explanation of timing. The contamination developed after the batch had passed its proper initial release testing, appearing over time in a later test. Read that again, because it is the entire point. The product was clean when it left the factory. The release test said so, accurately. The mould came later.

What I find telling is the second half of the story, the eight lots recalled despite clean results. That is a company that has understood something uncomfortable: if one lot can turn after release, a clean release result on the others no longer feels like proof of anything. They were not recalling contaminated product. They were recalling product they could no longer vouch for, because the thing they had tested for was not the thing that failed. That instinct was correct, and it is the instinct this article is about.

There is also a cross-border footnote worth noting, because it shows how fast a single manufacturing gap travels. Within weeks, on June 28, 2024, Health Canada issued its own recall of the same nine lots. One contamination event, surfacing after release, became a recall in two countries. For any manufacturer selling across the US and Canada, a post-release failure does not respect a border.

The trap of batch-release testing

Batch-release testing does exactly one thing, and it does it well: it counts the microbes present in a batch at the moment of release. The total aerobic count, the yeast and mould count, measured against limits, under standards like ISO 16212 and ISO 21149. Pass, and the batch ships. It is a necessary control, and no serious manufacturer skips it.

But look at what that test is, structurally. It is a photograph. It captures one instant, the day the product leaves the line, and it tells you the product was clean in that instant. Based on my experience, this is where the misunderstanding lives: a clean release result gets treated as a guarantee of safety, when all it actually certifies is a single point in time. The Suntegrity lot passed its photograph. The problem is that products do not live in a photograph. They live for months, get opened, get fingers and air and bathroom humidity introduced into them, and sit on shelves through temperature swings. A snapshot at the factory gate says nothing about any of that.

The graphic below lays the two approaches side by side, because the distinction is the whole article.

The mould in lot 115BU did not exist at release. It developed afterward. So the release test, however correctly it was performed, was never going to see it, because the failure had not happened yet. This is not a story about a lab making a mistake. It is a story about asking a test to answer a question it was never built to answer. You cannot photograph the future.

This matters for every cosmetics manufacturer, not just one sunscreen brand, because the same blind spot is everywhere I look in this industry. A water-containing product, a jar or tube that gets opened repeatedly, a preservative system that was chosen on paper rather than proven in practice: these are the conditions under which a clean release result and a contaminated product six months later can both be true at once. The release test is the floor of microbiological control, the bare minimum. Treating it as the ceiling is the trap, and it is the most common one I see when I review a manufacturer’s quality file. The fix is not more release testing. It is a different test entirely, one designed to look forward instead of backward, which is what ISO 22716 actually asks for and where the next section goes.

What ISO 22716 expects instead: proving the system holds

If batch-release testing is the photograph, challenge testing is the stress test. Its proper name is preservative efficacy testing, PET for short, and the logic is the opposite of a release count. Instead of asking “is this clean today,” it asks “if real microbes get in, can this product stop them, for as long as it claims to last.”

The method is deliberate and a little counterintuitive. You take the finished product and you contaminate it on purpose, inoculating it with a defined cocktail of bacteria, yeast, and mould. Then you measure how fast the preservative system kills them off, taking counts at several time points and comparing the log-reductions against acceptance criteria, under ISO 11930 or USP <51>. A product that knocks the population down quickly and keeps it down passes. A product that lets anything survive and regrow fails, even if its release count was spotless. That is the test Suntegrity’s failure mode calls for, and it is the one a batch-release count can never substitute for.

Here is the line I come back to with every manufacturer who tells me their product is fine because it has a preservative in it: adding a preservative is not the same as having a preservation system. You have a preservative when you put it in the formula. You have a system only when challenge data prove that real microorganisms cannot establish themselves in the product across its shelf life. The first is an ingredient decision. The second is evidence. ISO 22716 is built around the second.

This is not an exotic or optional test, either. In the EU it sits at the centre of the safety assessment, one of the non-negotiable pieces of the Product Information File that the Responsible Person is accountable for. A water-based or jar-packaged product without challenge data is, in regulatory terms, a product whose microbiological safety has not actually been demonstrated. The release count tells you the batch is clean. The challenge test tells you the product is safe to live in a consumer’s bathroom for a year. Those are different claims, and only one of them protects you when a lot turns months after it shipped.

The practical gap I find, over and over, is not that manufacturers refuse to do PET. It is that they do it once, early, on a development sample, file the certificate, and never revisit it when the formula, the supplier, or the packaging changes. A challenge test on last year’s formulation is not evidence about this year’s product. The discipline ISO 22716 expects is that the proof stays current with what you are actually shipping.

Three lessons that apply to every cosmetics manufacturer

Strip away the brand name and the sunscreen category, and the Suntegrity recall leaves three lessons that sit underneath any cosmetics operation, whatever you make and whatever you charge for it.

The first: a clean batch-release result is necessary but never sufficient. It is the entry ticket, not the finish line. If your microbiological control program ends at release, you are protected against the wrong failure mode.

The second: challenge testing is not optional for any product that can support microbial growth. Water content, repeated opening, jar or tube packaging, these are the risk signals. If a product has them and you cannot produce current PET data, you have a gap, not a program.

The third, and the one most people resist: price and positioning are not protection. This was a fifty-eight-dollar premium product from a brand built on a clean, careful image. The mould did not check the price tag. I have seen the same assumption inside expensive, well-marketed operations as often as inside budget ones, the quiet belief that a premium formula is somehow above basic microbiology. It is not. Aspergillus does not read your brand deck.

If you want to know where your own operation sits against these three, the place to start is an honest look at your quality controls, not a reassuring glance at your release certificates. The self-assessment below runs through the GMP areas an auditor probes, including the microbiological and stability controls this whole recall turned on.

A low score on the quality-control section is the single most common result I see, and it almost always traces back to exactly this confusion between release testing and challenge testing. The good news is that it is a fixable gap, and a well-understood one. The route from “I think we’re covered” to documented proof runs through the ISO 22716 certification path, which is where the manufacturing controls behind all of this get formalised.

There is a larger reason to close this gap now rather than later. A post-release contamination that surfaces in the US market is exactly the kind of manufacturing failure that the FDA’s new mandatory recall authority under MoCRA is built to act on. And the early signals of a product turning, the consumer complaints that arrive before a company runs its own follow-up test, increasingly show up in the FDA’s public adverse-event dashboard, where anyone, including a regulator, can see them. Suntegrity caught its own problem and recalled voluntarily. The manufacturers who do not catch it themselves are increasingly being caught in public. The test that prevents that is the one this article has been about from the first paragraph.