What a Supplement Certificate of Analysis Actually Proves — And the Red Flags Most Brands Walk Right Past

A certificate of analysis is supposed to settle the question. You ordered 500 kilograms of ashwagandha extract, the supplier sends over a CoA, and your purchasing team files it away as proof the material is what it claims to be. Simple.

The problem is that in our experience reviewing thousands of supplier and finished-product CoAs, a surprising number of them prove very little. Not because the lab necessarily fabricated data — though that does happen — but because the CoA was never designed to answer the questions brands think it’s answering.

Understanding what a CoA actually says, and more importantly what it doesn’t, is one of the most underrated skills in supplement quality. Here’s what your QA team should be checking every single time.

What a Legitimate Certificate of Analysis Must Include

Under 21 CFR Part 111, dietary supplement manufacturers are required to establish specifications for identity, purity, strength, and composition for every component used in production. A CoA is how a supplier or contract manufacturer demonstrates — to you, to your auditors, and ultimately to the FDA — that a specific lot of material met those specifications.

For raw material and ingredient-level verification, Ayah Labs specializes in contract testing and supplier qualification.

At minimum, a credible CoA should contain:

• A unique lot or batch number traceable to manufacturing records. Generic, reused, or sequential lot numbers with no supporting documentation are an immediate flag.
• Actual numerical results, not just “Pass” or “Conforms.” If the specification says ≤0.5 ppm for lead and the CoA says “Pass,” you don’t know whether the measured result was 0.01 ppm or 0.49 ppm. That 49x difference matters enormously, especially when you’re blending several ingredients that each carry trace-level contamination.
• Method citations. A lab that tested heavy metals should reference a specific analytical procedure — ICP-MS per USP <2232>, AOAC 974.02, or an equivalent validated method. “Heavy metals: Pass” with no method cited gives you no information about the rigor of the analysis.
• Testing date and sample receipt date. Both should be present and internally consistent. A CoA dated weeks after a product already shipped is a provenance problem.
• Lab identification and accreditation status. The issuing laboratory should ideally hold ISO/IEC 17025 accreditation covering the specific methods performed. Accreditation isn’t a guarantee of accuracy in every case, but it does mean the lab’s quality system and technical competency have been independently audited on a regular schedule.

Miss any one of those elements and you have a document that looks like proof but doesn’t function as proof.

Five Red Flags We See Most Often

We’ve reviewed CoAs from contract manufacturers, raw ingredient suppliers, and retail products sent to us for independent verification. These are the patterns that consistently signal a problem.

1. Pass/Fail results with no numerical values.

This is the single most common issue we encounter. A CoA that reports only binary outcomes — “Meets Specification,” “Conforms to Standards,” “Within Limits” — provides no quantitative information. You cannot use that data to trend performance across batches, to model aggregate risk across a multi-ingredient formula, or to demonstrate due diligence during an FDA inspection. Under 21 CFR Part 111.75, a qualified laboratory is expected to document actual test results, not just disposition decisions. If your supplier cannot or won’t provide numbers, that warrants a formal corrective action request.

2. Testing dates that don’t align with the batch timeline.

A raw ingredient CoA dated before the batch was manufactured isn’t testing that batch — it’s describing a previous lot that was presumably similar. This sounds obvious, but we’ve encountered cases where suppliers rotate a single CoA across multiple shipments because “the formula hasn’t changed.” That’s not batch-specific quality control. The lot number, manufacturing date, and testing date should form a coherent, traceable sequence. When they don’t, you have no confirmation that the material you actually received was the material that was tested.

3. Suspiciously identical values across multiple consecutive batches.

Natural raw materials vary. Ashwagandha withanolide content fluctuates with growing region, harvest season, and extraction parameters. Marine collagen peptide molecular weight distribution shifts between lots depending on the source fish and hydrolysis conditions. If a supplier provides CoAs for 12 consecutive shipments where the withanolide content is exactly 5.0% every time — not 4.8% on one lot, not 5.3% on another, but precisely 5.0% each time — that uniformity is itself a data quality concern. Real analytical results carry measurement uncertainty and natural biological variance. Numbers that never move often suggest they were reported rather than measured.

4. No citation of a validated or recognized test method.

For elemental impurities in dietary supplements, USP <2232> defines acceptable daily exposure limits and references ICP-MS or ICP-OES as the recommended analytical techniques. For microbial contamination, USP <61> covers total aerobic count, yeast, and mold; USP <62> addresses specified organisms including Salmonella spp., Staphylococcus aureus, and E. coli. A finished supplement CoA that reports microbial limits without citing a compendial or AOAC-validated method provides substantially weaker assurance than one anchored to a recognized procedure. “Internal method” may be perfectly sound, but you’d need to review the full method validation package to know that — and most brands never ask for it.

5. Raw ingredient CoAs substituting for finished product testing.

This is the one that catches brands most unprepared. Your supplier’s CoA for a raw botanical extract tells you about that ingredient as it left the supplier’s facility. It says nothing about what happened during blending, granulation, encapsulation, coating, and packaging at your contract manufacturer. Each of those steps introduces opportunity for cross-contamination, moisture uptake, oxidation, and microbial exposure.

Finished product testing — testing the actual tablet or capsule that will be placed on the shelf — is a distinct requirement. Under 21 CFR Part 111.75(a)(1), manufacturers must test the finished batch or have a system that verifies identity at each step of manufacturing and packaging. Relying exclusively on ingredient-level CoAs for finished product release is a compliance gap, regardless of how thorough those ingredient CoAs appear to be.

What Independent Verification Actually Changes

Here’s the thing about third-party testing that tends to get reduced to a marketing claim: the real value isn’t just that a separate lab ran the tests. It’s the absence of a financial stake in the outcome.

When a supplier tests their own product and issues a CoA, they have a commercial relationship with the result. That doesn’t mean the data is wrong — most of the time it isn’t — but it means the finding hasn’t been independently challenged. When a contract manufacturer conducts release testing on a product they produced for you, the same dynamic exists. Neither party benefits from reporting a failure.

An independent, ISO 17025-accredited third-party laboratory has no financial relationship with the outcome. Our obligation is to report what the instrument measures. If a product fails a heavy metals specification, we report the failure. If a microbial count exceeds USP <61> limits, that number goes on the report. That’s the structural difference between verified and unverified quality documentation.

At Qalitex, our finished product testing reports include quantitative results for every analyte, explicit method citations, lot number traceability, and both sample receipt and analytical completion dates. That’s what a document that actually proves something looks like.

One practical note on accreditation: scope matters. An ISO 17025-accredited lab is certified for specific methods applied to specific matrices — not for testing in general. A lab might be fully accredited for heavy metal analysis by ICP-MS but not for pesticide residues by LC-MS/MS. Before relying on any CoA, confirm that the methods listed fall within the issuing lab’s current accredited scope. Accreditation bodies including A2LA and PJLA (Perry Johnson Laboratory Accreditation) maintain searchable online scope databases that make this verification straightforward.

Before Your Next Product Launch

Pull the last five CoAs you received from your primary raw ingredient supplier and run through this checklist:

1. Is there a unique, traceable lot number on each document?
2. Do the results report actual numerical values — not just pass/fail?
3. Is a specific, recognized test method cited for each analyte?
4. Does the testing date align with the batch manufacturing date?
5. Are results showing reasonable natural variation across batches, not suspicious uniformity?
6. Is there a separate finished product CoA in addition to ingredient-level documentation?

If you’re missing three or more of those six elements across your supplier CoAs, you’re carrying more undocumented quality risk than your compliance files suggest. That’s a fixable problem — but only once you’ve identified it. Start with the documents you already have.