Certificate of analysis for supplements: what a COA should show, how to read one and the red flags

A certificate of analysis for supplements is the lab report for one specific lot: every test run, the specification it had to meet, the actual result with units, the method used and the dates. A useful COA lets you check identity, strength against the label, microbial counts and contaminants such as heavy metals. Read it against your own specification, never against the word "Pass".

What is a certificate of analysis for supplements?

A certificate of analysis (COA) reports the test results for one lot, or batch, of an ingredient or a finished product. Three parties issue them, and each answers a different question:

• The ingredient supplier usually sends a COA with each lot of raw material it ships to your manufacturer: is this ingredient what it claims to be?
• Your contract manufacturer issues COAs for finished batches, from its own lab or a contract lab: does this batch meet the product specification?
• An independent lab you hire reports on samples you send, ideally bottles pulled from your own stock: does what you sell match your label?

The first two get mixed up most, and they answer different questions:

In the US, the cGMP rule for dietary supplements decides what has to be tested in the first place. A manufacturer must set specifications for the identity, purity, strength and composition of each finished batch, and limits on the types of contamination that could adulterate it (21 CFR 111.70). It must run at least one appropriate test or examination to verify the identity of every dietary ingredient, and it may rely on a supplier's COA for other component specifications only after qualifying the supplier, which includes confirming the supplier's results (21 CFR 111.75). Finished batches must be verified against the specifications, either every batch or a subset chosen through a sound statistical sampling plan.

Notice what the rule doesn't do: it doesn't hand you numbers. The limits printed on a COA come from the specification your manufacturer writes and you approve, so the specification is the first document to ask for, before any COA.

Here is where each COA sits in one production run:

Where COAs come from in one production run

1. 1Ingredient lot arrivesWith the supplier's COA
2. 2Identity testAt least one on every dietary ingredient
3. 3ProductionRecorded in a batch production record
4. 4Finished-batch testingResults judged against the product specification
5. 5Independent checkYour own lab test on retail stock (optional)

What should a supplement COA show?

A COA you can rely on identifies the lot, the lab and every test:

• Product and lot: product name, lot or batch number and manufacture date. The lot must match the bottle.
• Dates: when the sample was received and when it was tested. Testing comes after manufacture.
• The lab: name, address and accreditation, and who reviewed and approved the results.
• Identity: confirmation that each key ingredient is what the label says, with the method named.
• Strength: the measured amount of each labeled ingredient, in the same units and per the same serving as the Supplement Facts panel (our post on supplement label requirements explains how that panel is built).
• Microbiology: each microbial test your specification lists, with units.
• Contaminants: the heavy metals and other contaminants your specification limits, such as lead, arsenic, cadmium and mercury.
• On every line: the specification, the actual result and the method.

The cGMP rule sets that bar for any supplier COA a manufacturer relies on: it must include a description of the test methods used, the limits of the tests and the actual results. Hold every COA you receive, including your manufacturer's, to the same standard.

How to read a certificate of analysis, line by line

Below is a fictional COA for a fictional magnesium and vitamin D3 capsule, lot MG2608-07. Every name and number is invented for this example, and none of them is a benchmark for real specifications.

Read the specification column before the results: a result means nothing without the limit it was judged against. In the example, magnesium came in at 212 mg against a 200 mg claim, which is 106% of claim. Vitamin D3 came in at 23.1 mcg against 25 mcg, which is 92.4% and below this brand's own minimum, so the "Pass" next to it is a reason to call the lab and the manufacturer before the lot ships.

Convert units before you compare. A result reported per capsule, read against a label that declares a two-capsule serving, looks like a 50% shortfall when nothing is wrong. The same trap works with mg and mcg, which differ by a factor of 1,000.

"< LOQ" means below the limit of quantitation, the smallest amount the method measures reliably. It is useful only when the LOQ is printed and sits well below your specification limit. "ND" or "Pass" without a number tells you almost nothing.

The difference between a COA you can act on and one you can't shows quickly:

A COA you can act on, and one you can't

Act on itUseful COA

• Lot number matches the bottle
• Every test has a specification, a result with units and a method
• Detection or quantitation limits printed for contaminants
• Dates in a logical order
• Named lab, accredited for these methods
• Signed by a named reviewer

Ask questions firstWeak COA

• No lot number, or the wrong one
• "Pass" or "Conforms" with no numbers
• No methods
• An ingredient COA standing in for the finished product
• The same numbers as the last lot
• No signature

Supplement COA red flags

Stop and ask questions when you see any of these:

1. No lot number, or one that doesn't match the bottle.
2. "Pass", "Conforms" or "ND" with no numbers, no specification and no detection or quantitation limit.
3. No test methods.
4. A raw-material COA presented as a finished-product COA. The supplier tested the ingredient, not your capsule.
5. Identical results across lots. Real measurements vary from lot to lot; copied numbers suggest copied documents.
6. Dates out of order, such as a test date earlier than the manufacture date.
7. A lab you can't find in an accreditation directory, or a method missing from its scope.
8. Units that don't match the label.
9. No named reviewer.
10. Signs of editing: fonts that change mid-page, misaligned numbers, a scan of a scan.

When something looks off, send the report number to the issuing lab and ask it to confirm the results directly. And when a contaminant result decides a legal question, such as lead under California's Proposition 65, the exact number matters; our post on Prop 65 for supplements turns a lead result into a daily exposure.

What does ISO/IEC 17025 accreditation mean for a supplement lab?

ISO/IEC 17025 sets the general requirements for the competence of testing and calibration laboratories (A2LA). In the US, accreditation bodies such as A2LA and ANAB assess labs against it, and ANAB's laboratory programs are recognized by the International Laboratory Accreditation Cooperation (ILAC) (ANAB).

The detail that matters is the scope. A lab's scope of accreditation is the list of specific tests, types of tests and calibrations it is accredited for, and capabilities that aren't listed on the scope aren't covered by the accreditation. A lab can be accredited for microbiology and not for heavy metals, or for one heavy-metals method and not another.

Checking takes five minutes:

1. Ask the lab for its accreditation certificate and scope.
2. Look the lab up in the accreditation body's directory: ANAB publishes a directory of accredited organizations, and A2LA has an organization search.
3. Find each method on your COA in the scope.
4. Check that the accreditation is current.

Lab accreditation is easy to confuse with two other quality marks, and none of the three stands in for the others:

Three things a quality claim can rest on

ISO/IEC 17025Lab accreditation

About the lab.

• Competence for the methods on its scope
• Granted by bodies such as ANAB or A2LA
• Says nothing about your product

For example NSF/ANSI 455-2GMP facility certification

About the factory.

• An audit of a site that makes, packages, warehouses or distributes supplements
• Built on regulatory and retailer requirements and industry practice
• Not a test of your product

For example USP VerifiedProduct certification

About the product.

• The certifier evaluates products submitted to it
• USP Verified: the listed ingredients in the declared amounts, and no harmful levels of specified contaminants
• Only for products that hold it

How often should you test supplements?

cGMP sets the floor: an identity test on every dietary ingredient, and verification of finished batches, either every batch or a statistically sampled subset. How often you pay an independent lab on top of that is your decision. A workable policy ties testing to risk:

• Every lot while trust is new. Test each lot independently for the first runs with a new manufacturer, and again whenever a supplier, the formula or the facility changes.
• More often for plant ingredients and metals. FDA notes that lead in the environment can be taken up by plants and enter the food supply (FDA), so botanical formulas deserve a closer watch on heavy metals.
• On retail stock, not only on samples. Pull bottles from your own inventory, so you test what customers receive.
• Whenever a COA raises a question. A retest settles it faster than an email thread.

Write the policy into your quality agreement with the manufacturer, including what happens when a lot fails: who pays for the retest, and who decides whether the lot is destroyed or reworked. Our post on choosing a supplement manufacturer covers that agreement, and private label supplements covers what to ask of a stock formula before you put your name on it.

For where testing fits among all the other launch steps, from formula to first sale:

How to use COAs in your marketing honestly

Published COAs give a skeptical buyer something to check, as long as the claims around them are exact.

• Show the current lot. Link the COA for the lot you are shipping, and replace it when the lot changes.
• Say what was tested. "Third-party tested for lead, arsenic, cadmium and mercury" is a claim you can document; "pure" with no test behind it isn't. Under the FTC's guidance, you need support for every objective claim, express or implied, before the ad runs (FTC).
• Don't borrow a mark. A GMP facility certificate is not a product certification, and a lab's accreditation says nothing about your product. Show a certification mark only if your product holds it.
• Keep composition and efficacy apart. A COA proves what is in the bottle, not what it does. Health benefits need competent and reliable scientific evidence, as a general rule randomized, controlled human trials, so "lab tested" never becomes "clinically proven". Our post on supplement clinical studies covers that evidence.

On a RevvyScales page, the scientific references block holds a list of sources (comments and references), so the current COA can sit in the same list as the studies you cite.

A COA review checklist

Run every new COA through this before the lot ships:

Before a lot ships

• Lot number on the COA matches the bottle
• Test date falls after the manufacture date
• The specification it was judged against is the version you approved
• Identity confirmed for each key ingredient, with the method named
• Strength per serving, in the label's units, inside your specification
• Every contaminant has a number or a printed quantitation limit
• Microbiology results inside your limits, with units
• Lab accredited, with these methods on its scope
• A named reviewer signed and dated it
• Results compared with earlier lots for copied numbers

0 of 10 done

File the COA with the lot's records, and keep the specification it was judged against next to it. When a retailer, a regulator or a customer asks how you know what is in the bottle, those two documents are the answer.