Certificate of Analysis Red Flags: How to Spot Fraudulent COAs From Supplement Ingredient Suppliers

A Certificate of Analysis is supposed to be a guarantee. In practice, it’s often closer to a hope.

In recent FDA enforcement cycles, failures tied to incoming ingredient verification have consistently ranked among the most cited violations under 21 CFR Part 111 — the dietary supplement current Good Manufacturing Practice (cGMP) regulations. In case after case, brands had accepted supplier-provided COAs without independent testing, only to discover that what arrived in the drum didn’t match what was listed on the document.

The problem isn’t new. A 2015 study published in JAMA Internal Medicine found that 66% of herbal supplements purchased from major US retailers contained either the wrong ingredient or no measurable amount of the claimed herb. And a 2013 DNA barcoding study in BMC Medicine found that 59% of herbal products contained plant species not even on the label. Behind nearly all of those failures was a COA that said everything was fine.

Here’s what those COAs had in common — and what to look for before you accept another one.

Why COA Fraud Is Easier to Pull Off Than You’d Think

A Certificate of Analysis isn’t a controlled document under any universal legal standard. Anyone can produce one. There’s no central registry, no required format, no authentication link embedded in the PDF. A supplier in any jurisdiction can generate a professional-looking document with a lab letterhead, a table of results, and a passing verdict — and most buyers have no immediate way to distinguish it from a legitimate analytical record.

Under 21 CFR Part 111.75, dietary supplement manufacturers are required to conduct at least one appropriate test to verify the identity of each incoming dietary ingredient before use. The regulation doesn’t say “trust the supplier’s COA.” It says verify. But underfunded or fast-scaling brands often skip independent testing entirely and use the supplier-provided document as their only record of incoming material quality. That’s the gap fraudulent suppliers exploit.

The tells aren’t always obvious. They’re often subtle — a wrong method reference here, a suspiciously round number there, a turnaround time that’s physically impossible for the test described. But once you know what to look for, they stand out reliably.

7 Red Flags That Should Trigger Independent Testing

1. No accreditation listed — or accreditation that can’t be verified

A legitimate analytical laboratory performing testing for regulatory purposes should hold ISO/IEC 17025:2017 accreditation for the specific test methods being used. That accreditation is granted by recognized bodies like A2LA (American Association for Laboratory Accreditation) or PJLA, and it’s publicly searchable in their online databases. If a COA doesn’t list the lab’s accreditation number, or if that number doesn’t resolve to a currently active scope covering the methods claimed, stop there.

We see COAs that reference accreditation numbers belonging to a different laboratory entirely. It happens more often than you’d expect.

2. Test dates that don’t add up

Check the test completion date against the manufacturing or production date listed on the document. If testing was purportedly completed before the material existed, you’re looking at a fabricated document. Also watch for physically impossible turnaround times: a full USP <61> aerobic microbial count and USP <62> objectionable organism test requires a minimum of 5–7 business days of incubation alone, regardless of how efficient the lab is. A COA showing those results with a 24-hour turnaround either has a wrong date or was never run.

3. Results that land exactly on specification limits — repeatedly

Real analytical data scatters. Instruments produce values that cluster around a true value with natural variation. If a COA shows a heavy metal result of exactly 1.0 ppm against a spec of ≤1.0 ppm — or if you see identical round numbers across multiple lots from the same supplier — that’s a signal. Legitimate labs report to 3–4 significant figures, and results rarely fall precisely on a limit unless they’ve been manually entered rather than instrument-generated.

This is one of the subtler red flags, and in our experience, one of the most reliable.

4. Method references are missing, vague, or inapplicable

A COA should specify the exact analytical method used for each parameter reported. “Heavy metals tested per USP” is not a method reference — it’s a category. “ICP-MS per USP <233>” is. “AOAC 2012.19” for pesticide residue screening is specific and evaluable; “pesticide screening per internal method” gives you nothing to validate.

When methods aren’t cited at all, or when the cited method doesn’t apply to the matrix being tested (a method validated for aqueous solutions appearing on a botanical extract COA, for example), it often means testing wasn’t performed the way the document implies.

5. No lot number or traceable batch identifier

A COA that doesn’t tie results to a specific lot number is functionally useless for regulatory traceability. Under 21 CFR Part 111, you need a documented chain linking your finished product lot → incoming ingredient lot → COA for that lot. A generic COA covering “all production” or issued without a batch identifier cannot satisfy that requirement — and won’t hold up during an FDA inspection or a third-party audit.

6. The issuing lab doesn’t exist outside the document

Before accepting any COA, look up the issuing lab independently. Search for them entirely outside the document — not using the contact information printed on it. Do they have a real website? A physical address you can locate? An accreditation listing in a public database? A phone number that connects to someone who can confirm the document? Fraudulent COA mills frequently use real-sounding laboratory names with professional letterhead but no verifiable existence as operating labs.

Two minutes of external verification can prevent an enforcement action that takes two years to resolve.

7. The testing scope is suspiciously narrow — or suspiciously comprehensive

Both ends of the spectrum should raise questions. A COA that tests only heavy metals when your specification also requires identity, potency, microbial limits, and residual solvents is incomplete and shouldn’t be accepted as full incoming material documentation. But a COA claiming to test 40+ parameters with results back in 48 hours may be generating those numbers from a reference specification, not from your actual lot.

Comprehensive testing takes time. If the turnaround seems incompatible with the scope, ask the lab directly to explain their workflow. A legitimate laboratory will have a clear answer.

What Proper Incoming Ingredient Verification Actually Looks Like

Under a mature cGMP program, independent third-party verification of incoming ingredient lots is standard practice — particularly for high-risk materials, new suppliers, and any ingredient that has appeared in recent FDA warning letters or market surveillance data. At minimum, that verification should cover:

1. Identity confirmation via an orthogonal method appropriate to the ingredient type — FTIR for excipients, HPLC or LC-MS/MS for active botanicals and concentrated extracts, DNA barcoding for whole or processed plant materials where adulteration risk is elevated
2. Elemental impurities screening via ICP-MS per USP <232>/<233> limits, or against your documented ingredient-specific specification
3. Microbial limits testing per USP <61> and <62>, including the full required incubation periods — no shortcuts
4. Potency or marker compound assay for any ingredient making a label claim or contributing to a finished product structure/function claim

That’s not every test on every lot. Most brands with established supplier qualification programs use a risk-based sampling plan: more frequent independent testing for new suppliers, high-risk botanical categories, and materials sourced from regions with documented adulteration histories; reduced but not eliminated frequency for established, consistently compliant suppliers. The key phrase is “not eliminated” — a passed audit from three years ago doesn’t tell you what’s in the drum that arrived this week.

Why the Lab You Use for Verification Matters

If you’re challenging a supplier COA with independent testing, the results need to carry regulatory weight. An ISO/IEC 17025:2017 accredited laboratory produces data under a quality management system that’s been independently audited for technical competence, method validation, proficiency testing performance, and measurement traceability to national standards. That audit trail matters when you’re responding to an FDA Form 483 observation, satisfying an Amazon third-party testing requirement, or defending a product in a legal proceeding.

A non-accredited lab might still produce accurate results — but you have no independent way to demonstrate that, and neither does an FDA investigator reviewing your records. For incoming ingredient verification intended to satisfy 21 CFR Part 111.75, accreditation for the specific scope of testing isn’t a nice-to-have; it’s what turns a result into a defensible record.

California-based brands also need to factor in turnaround time. If your ingredient arrives at your Irvine or San Diego facility with a manufacturing schedule that starts in 21 days, and your verification testing includes microbiology, you need a lab that can turn full results in under two weeks — ideally one local enough that shipping doesn’t eat two of those days. That’s not an abstract concern; it’s a production planning constraint that affects which labs are actually usable in your operation.

The Check You Can Run This Week

Pull three COAs from your current approved supplier list — from three different suppliers, covering different ingredient types — and run them through the seven flags above. Specifically: confirm the issuing lab’s accreditation number in an A2LA or PJLA database, verify the test completion date predates anything suspicious, and check whether each method reference is specific enough to evaluate.

If more than one of those three comes back with a flag, that’s meaningful data. It tells you something about your supplier qualification program that’s worth correcting before an FDA investigator or a contract manufacturer’s auditor tells you the same thing in writing.

The goal isn’t to treat every supplier as a bad actor. Most aren’t. But the brands that end up holding recalled, mislabeled, or adulterated product almost invariably had paperwork that looked completely fine — right up until independent testing said otherwise.

---

Written by Nour Abochama, Vice President of Operations, Qalitex Laboratories. Learn more about our team

Talk to our team about your testing needs. Contact us

Related from our network

• Raw Material Testing and COA Verification for Ingredient Suppliers — Ayah Labs specializes in third-party testing and COA verification for global raw material and ingredient suppliers.
• FDA cGMP Audit Readiness and Supplier Qualification Consulting — Aurora TIC helps supplement and food brands prepare for FDA inspections and build defensible supplier qualification programs.
• Supplement Ingredient Testing for Canadian Brands — Androxa provides Health Canada–compliant testing for dietary supplement and NHP ingredient lots sourced domestically and internationally.