For anyone who manufactures, distributes, or sells dietary supplements, the term “certificate of analysis” comes up constantly. You request it from ingredient vendors, you review it before releasing a batch, and if you are doing things right, you generate your own with every lot. Yet confusion about what a COA should contain—and how much weight you should give it—remains one of the most common quality pitfalls across the industry.

A certificate of analysis is a document that reports the results of laboratory testing performed on a specific batch of material. It verifies that the product meets a defined set of specifications. When a COA is generated correctly, it is the single most important piece of evidence you have to confirm that what is on your label is actually in the bottle. When it is incomplete or taken at face value, it can create a false sense of security that puts your brand and your customers at risk.

What a Certificate of Analysis Actually Contains

A thorough COA starts with clear batch traceability: a lot number, a production date, a sample description, and an expiration or retest date. Then it moves into the test results that matter for dietary supplement quality control. The FDA’s current Good Manufacturing Practice (cGMP) regulations, found at 21 CFR Part 111 [4], require manufacturers to establish finished product specifications for identity, purity, strength, and composition, and for limits on contaminants [1]. Any COA you rely on should speak to those same categories.

Common test results found on a well-constructed COA include:

Identity – confirms the ingredient is what it claims to be, typically using a method specific enough to discriminate between similar compounds (e.g., HPLC, FTIR, or mass spectrometry).
Strength / Assay – quantifies the amount of active marker compounds or nutrients, reported as milligrams per serving or percentage of label claim.
Purity – addresses degradation products or related impurities that fall outside the intended composition.
Contaminants – covers heavy metals (lead, arsenic, cadmium, mercury), residual solvents, pesticides, and microbiological limits (bacteria, yeast, mold, pathogens).
Physical characteristics – may include appearance, odor, or particle size, but these alone are not sufficient for identity verification [1].

When you receive a COA from a raw material supplier, that list may look reassuringly complete. The question is whether the test methods and the data behind it actually prove anything about the lot you just received.

Supplier COAs vs. Third-Party COAs

Supplier COAs are documents that ingredient manufacturers prepare in-house. They are useful as a starting point, but they come with an inherent conflict of interest. A supplier has a financial incentive to show that its product meets your specifications, and not every supplier invests in rigorous quality control.

Third-party COAs are produced by a laboratory that neither makes nor sells the product. That independence reduces the risk of bias that comes with self-reported data. When a laboratory operates under a recognized quality management standard and is audited externally, you gain an additional layer of confidence that the results are technically sound and defensible. This distinction matters because a qualified third-party lab works to a documented quality system, participates in proficiency testing, and must prove its competence to remain in good standing.

Why a Supplier COA Alone Isn’t Enough

The FDA has explicitly cautioned that comparing a supplier’s COA to your own specifications—without additional testing—is not an acceptable method for verifying ingredient identity. In warning letters issued during GMP inspections, the agency noted that manufacturers were using tests such as color, particle size, pH, and a comparison of the supplier’s certificate of analysis as a substitute for identity testing. The FDA concluded that these approaches do not uniquely identify an ingredient and do not discriminate it from other substances [1]. That position makes it clear: a paper review is not identity verification.

Even when a supplier reports numerical assay values, those numbers may not reflect the contents of the batch you received. Independent analyses repeatedly show discrepancies. A survey by ConsumerLab of multivitamin-multimineral products found quality control problems with 46% of the samples tested; the levels of ingredients such as vitamin A, vitamin D, folate, and calcium spanned from 24% to 157% of the label claims [3]. In omega-3 fatty acid supplements, only 42% of products delivered an EPA content within 90% to 110% of the declared amount, and the same study reported that almost half were in the early stages of rancidity [3]. A separate Dutch analysis found vitamin D concentrations ranging from 8% to 177% of the labeled value [3].

A supplier-issued COA will rarely flag those problems. A third-party COA is designed to catch them before your product reaches a customer or a retailer.

How to Read (and Verify) a Certificate of Analysis

Start by confirming that the COA references the exact lot number of the material in your possession. If that piece of traceability is missing, stop. Without it, there is no way to tie the results to your batch.

Next, look at the methods. Acceptable methods are specific, validated, and appropriate for the matrix being tested. For nutrients labeled as meeting United States Pharmacopeia (USP) standards, the FDA directs that the appropriate USP analytical method be used for analysis [4]. A COA that lists only organoleptic checks or non-specific wet chemistry—without an identity method like HPLC, FTIR, or mass spectrometry—does not satisfy regulatory expectations for identity [1].

Check whether the laboratory that performed the testing holds a recognized third-party accreditation. While accreditation does not turn a poor method into a good one, it adds a layer of independent oversight that is absent from unaccredited operations.

For heavy metals, pay close attention to detection limits and ensure they are low enough to meet the strictest state-level thresholds where your products are sold. A COA that reports “pass” without numerical results and detection limits does not give you enough information to assess potential liability.

Finally, verify that the COA covers the specifications that matter for your product type. A protein powder needs an amino acid profile and possibly a nitrogen-based assay; a botanical needs a marker compound; a probiotic needs viable cell counts at the end of shelf life. The COA should match the promises you are making on your label and in your marketing.

When a COA Becomes a Regulatory Necessity

The FDA’s cGMP regulations, under 21 CFR Part 111 [4], require that you establish specifications for every component you use [1]. The agency’s compliance program for dietary supplement inspections directs field investigators to collect samples for nutrient analysis, microbiological analysis, and label review, with test results compared against label claims [4]. If your COA exists only in a filing cabinet and has no link to actual lot-by-lot data, you are exposed.

Retailers and online platforms are adding another layer. Many now require third-party testing data or evidence of a GMP audit before they will list a supplement. The USP Dietary Supplements Verification Program, for instance, includes a manufacturing facility audit, a review of quality control documentation, and laboratory testing of samples against USP–NF or pharmacopeial standards [5]. The USP Verified Mark signals that the product has been independently assessed, but brands can still demonstrate equivalent rigor by holding a current, well-documented COA from a competent laboratory for every lot.

The Testing Methods That Make a COA Trustworthy

The gap between what a supplier’s document says and what independent testing reveals is large enough that it should shape how you build your own quality program. An accredited, third-party COA is not just a regulatory safety net—it is the evidence you need when a customer asks hard questions or when an inspector walks through your door.

The difference often shows up in the methods. Techniques such as inductively coupled plasma mass spectrometry (ICP-MS) for heavy metals [3], liquid chromatography with mass spectrometric detection (LC-MS/MS) for pesticides, and high-performance liquid chromatography (HPLC) for marker compounds separate the credible COA from the paper-only version. A competent laboratory’s report will include method descriptions, detection limits, numerical results, and a clear statement of compliance or non-compliance against the published specification. That level of detail gives you the traceability and defensibility that a supplier-generated sheet cannot match.

For dietary supplement brands, the takeaway is simple. Treat every supplier COA with a healthy skepticism. Use it for screening, not as the final word. Build your release process around independent, third-party testing, and make sure the certificate of analysis you put your name on is backed by real data from a qualified laboratory. That is the only way to ensure that the quality promise on your label is true for every bottle you ship.

Sources

[1] Dietary supplements quality analysis tools from the United States Pharmacopeia - PMC (pmc.ncbi.nlm.nih.gov, accessed 2026-10-05)
[3] Current regulatory guidelines and resources to support research of dietary supplements in the United States - PMC (pmc.ncbi.nlm.nih.gov, accessed 2026-10-05)
[4] CP 7321.008, Dietary Supplements – Foreign and Domestic Inspections, Sampling, and Imports (fda.gov, accessed 2026-10-05)
[5] Dietary Supplements Verification Program | USP (usp.org, accessed 2026-10-05)

Written by Nour Abochama, Vice President of Operations, Qalitex Laboratories. Learn more about our team

Talk to our team about your testing needs. Contact us

What Is a Certificate of Analysis (and Why It Matters for Supplement Quality)