How to Read a Certificate of Analysis

A Certificate of Analysis (COA) is the single most important document you'll receive from a manufacturer or ingredient supplier. It tells you what's actually in your product, whether it meets your specifications, and whether an independent lab confirmed the results.

Most brand owners receive COAs and file them without reading them. That's a mistake. This guide walks through every section of a COA, explains what to look for, and flags the problems that should stop a production run.

Dietary supplement manufacturers must comply with 21 CFR Part 111 (Current Good Manufacturing Practice for dietary supplements). This includes requirements for personnel, facilities, equipment, production, laboratory operations, and record-keeping.

What a COA Is (and What It Is Not)

A COA is a document issued by a laboratory that reports the results of testing on a specific batch of raw material or finished product. It includes the tests performed, the results, the specifications, and a pass/fail determination for each test.

A COA is not a guarantee of product quality. It is a snapshot of one batch at one point in time. A clean COA on batch 1 does not mean batch 2 is clean. That's why 21 CFR Part 111 requires testing on every production batch, not just the first one.

Two types of COAs exist. A manufacturer COA comes from the company that produced the ingredient or product. A third-party COA comes from an independent testing laboratory with no financial relationship to the manufacturer. You want both.

Anatomy of a COA

COA formats vary by lab, but every credible COA includes the same core sections. If any of these are missing, ask the lab or manufacturer why.

Header and Lab Information

The lab's name, address, accreditation status, and contact information. Look for ISO 17025 accreditation. A COA from an unaccredited lab is not necessarily wrong, but it carries less weight.

Product and Batch Identification

Product name, lot number, batch number, date received, and date tested. This connects the COA to a specific production run. If the lot number on the COA doesn't match the lot number on your product, the COA is meaningless for that batch.

Test Methods

The analytical method used for each test (HPLC, ICP-MS, USP method numbers). This matters because different methods have different detection limits and accuracy. Reputable labs cite the specific method.

Specifications

The acceptance criteria for each test. These should match your product specification, not some generic standard. If your label says 500mg of vitamin C per serving, the specification should reflect that.

Results

The actual measured values. These are the numbers that matter. A result of 480mg against a specification of 500mg is technically a failure, even if the lab marks it as a pass within their tolerance range.

Pass/Fail Determination

The lab's conclusion on whether each test met the specification. Read this, but don't stop here. Check the actual numbers yourself.

Signatures and Dates

The analyst and reviewer signatures with dates. A COA without signatures may not have gone through proper review. Two signatures (analyst and supervisor) indicate a review process.

The Five Tests That Matter Most

COAs can list dozens of tests. For brand owners reviewing incoming raw materials or finished products, five categories matter above all others.

1. Identity Testing

Confirms the ingredient is what the label says it is. This is the first test to check on any COA. If the identity test fails, every other result is irrelevant because the wrong ingredient is in your product.

21 CFR Part 111 requires identity testing on 100 percent of incoming dietary ingredients. Methods include HPLC, FTIR, and DNA barcoding for botanicals. The COA should name the specific method used.

2. Potency Testing

Measures the actual amount of active ingredient in the product. This number should match or exceed what your label claims. A common issue: manufacturers set their own specification at 80 percent of label claim, then mark a result of 82 percent as "pass." Your customers expect 100 percent of what the label says.

Overages matter here. Most manufacturers add 5 to 15 percent overage to account for degradation over the shelf life. A potency result above 100 percent of label claim on a fresh batch is normal and expected.

3. Heavy Metals Testing

Tests for arsenic, cadmium, lead, and mercury. These contaminants occur naturally in soil and water and accumulate in botanical ingredients. California's Proposition 65 sets some of the strictest limits in the country. Even if you don't sell in California (you probably will), Prop 65 limits are a reasonable floor.

Results are reported in parts per million (ppm) or parts per billion (ppb). Compare the results against USP limits or your own product specifications. A result of "not detected" is the best outcome. A result below the limit is acceptable. A result at or near the limit deserves attention.

4. Microbial Testing

Checks for bacteria, yeast, and mold. Standard panels include total aerobic count, yeast and mold count, and specific pathogens (E. coli, Salmonella, Staphylococcus aureus). These tests protect consumer safety.

Pathogen results should always say "not detected" or "absent." Any positive pathogen result means the batch should not ship. Total aerobic count and yeast/mold count have acceptable ranges that vary by product type.

5. Stability Testing

Measures how the product holds up over time under specific storage conditions. Stability data supports your expiration date. Without it, your expiration date is a guess.

Stability COAs look different from batch-release COAs. They show results at multiple time points (initial, 3 months, 6 months, 12 months) under defined temperature and humidity. Look for potency trending downward over time. If potency drops below label claim before the expiration date, the product shelf life needs adjustment.

How to Compare Specifications Against Results

The most common mistake brand owners make with COAs: accepting the lab's pass/fail without checking the actual numbers. Here is a three-step process.

Step 1: Confirm the specification matches YOUR product spec. The COA should test against the specifications in your quality agreement, not the lab's default range. If your label says 1,000mg of fish oil per softgel, the potency specification should reflect that number.
Step 2: Read the actual result, not just pass/fail. A potency result of 510mg against a 500mg specification is a pass, but barely. A result of 550mg gives you more margin for degradation over the shelf life. Both are passes, but they tell different stories.
Step 3: Check units and methods across COAs. If you switch labs or compare a manufacturer COA against a third-party COA, make sure both used the same test method and report in the same units. Results from different methods are not directly comparable.

Red Flags on a COA

These problems should trigger a conversation with your manufacturer. Some should stop a production run entirely.

No lot or batch number. The COA can't be traced to a specific production run. It may be a generic template, not actual test results.
Results are all round numbers. Real lab results have decimal places. A COA showing exactly 500.0mg, 0.0 ppm, and 0 CFU/g for every test is likely fabricated.
No test method listed. A result without a method can't be reproduced or verified. Credible labs always cite their analytical methods.
Manufacturer COA only, no third-party testing. The manufacturer is grading their own work. This doesn't mean the results are wrong, but independent confirmation matters.
Missing heavy metals or microbial panels. These are basic safety tests. A finished product COA without them is incomplete.
Test date far from production date. A COA dated six months before production may not reflect the batch you're receiving. Shelf-stable raw materials can change over time.
Lab is not ISO 17025 accredited. Accreditation from a recognized body (like A2LA or ANAB) means the lab's methods and processes have been independently audited. Unaccredited labs can still produce valid results, but the verification layer is absent.

What to Do When Something Looks Wrong

Finding a problem on a COA is not the end of the relationship. It is the beginning of a conversation. How the manufacturer responds tells you more than the COA itself.

Ask for the raw data or chromatograms behind the result. Reputable labs will provide these.
Request a retest from a different third-party lab. If results disagree, investigate before releasing the batch.
Check if the failure is consistent. One out-of-spec result on one batch is a quality event. The same failure across multiple batches is a systemic problem.
Document everything. Keep a file for each manufacturer with every COA, communication, and resolution. This protects you during FDA inspections.
Know when to walk away. A manufacturer who can't explain a failing result, or who pressures you to release a batch with a known problem, is not a partner.

Where COAs Fit in Your Quality System

A COA is one piece of a broader quality picture. It works alongside your quality agreement, batch records, and testing program to form a complete system.

Your quality agreement defines what tests are required and what specifications apply. The COA proves those tests were performed.
Batch records track the production process. The COA tracks the testing results. Together they document the entire lifecycle of a batch.
Keep COAs for every batch of raw materials and finished products. 21 CFR Part 111 requires these records for at least one year past the product's expiration date.

Concepts Covered

COA (Certificate of Analysis)Identity Testing Potency Testing Heavy Metals Testing Stability Testing 21 CFR Part 111

Disclaimer: This guide is educational content, not legal, regulatory, or professional advice. Consult qualified professionals before making testing or quality decisions. See our Terms of Service for details.