CoACertificate of Analysis

A Certificate of Analysis (CoA) is a signed document, tied to a specific lot number, that reports the actual test results obtained for a set of defined quality attributes against a defined specification. It is the fundamental unit of trust between a material supplier and the manufacturer receiving it, and between a manufacturer's QC lab and the batch record it releases. A CoA says, in effect: 'we tested lot X against method Y, and here is what we got, and here is whether that meets spec Z.'

That definition matters because a CoA is not a promise, a marketing claim, or an assurance of quality in the abstract — it is a record of specific analytical results for a specific lot, generated by a specific method, at a specific point in time. Everything that goes wrong with CoAs traces back to one of those four specifics being missing, wrong, or misrepresented.

A CoA typically travels in one direction per transaction: the party who performed (or is legally responsible for) the testing issues it to the party who needs assurance the material is fit for use. An incoming raw-material CoA travels from supplier to manufacturer; a finished-product CoA travels from manufacturer to customer, distributor, or regulator.

Formats vary by industry and supplier, but a defensible CoA contains the same core elements regardless of what it's attached to:

• Issuing entity name, address and (where relevant) site registration/license number.
• Material name, internal code/SKU, and — for globally traded materials — CAS number or equivalent identifier.
• Lot/batch number, unambiguously matching the physical container label.
• Manufacture date and, where applicable, expiry or retest date.
• Specification reference and version (the exact spec the lot was tested against — not just 'meets spec').
• Test attribute, method reference (compendial or in-house, with version/revision), result, unit, and acceptance criteria — one row per attribute.
• Reporting limit / limit of quantitation for any attribute reported as 'not detected' or '<X'.
• Overall disposition (pass/fail/conditional) and the signature (wet or electronic) of the person authorised to release, plus date signed.
• Document control identifiers — CoA number, revision, and ideally a QR/barcode tying it back to the LIMS record it was generated from.

These four documents are frequently confused, filed interchangeably, and — worse — accepted interchangeably by receiving staff who don't know the difference. They are not interchangeable.

The most consequential mix-up is accepting a CoC where a CoA is regulatorily required. A CoC tells you the supplier believes the lot conforms; it does not give you the data to independently verify that, and under §211.84(d)(1) a supplier's CoA — no matter how detailed — still doesn't relieve the receiving manufacturer of its own identity-test obligation for each component, container and closure, unless the reduced-testing conditions below are met.

§211.84(d)(1) requires that at least one test be conducted to verify the identity of each component of a drug product, and that any additional tests needed to assure conformance with written specifications be performed — unless the manufacturer has validated the supplier's test results 'at appropriate intervals'. This is the regulatory basis for so-called 'skip testing' or reduced testing programmes.

In practice, a defensible reduced-testing programme has all of the following, and FDA investigators will ask about each one specifically:

• A documented supplier qualification (on-site or documentation-based audit, history of conforming lots, quality agreement in place).
• A defined periodic full-test schedule (e.g., full panel every Nth lot or every 12 months, whichever comes first) that is actually followed and documented.
• Identity confirmation performed on every single lot regardless of supplier qualification status — reduced testing never removes the identity test, only the full attribute panel.
• A trigger list that forces immediate full testing regardless of schedule: any OOS at the supplier, any change in supplier manufacturing site or process, any packaging/labeling anomaly, any gap in supply chain custody.
• Ongoing monitoring — a supplier that starts failing periodic full tests loses reduced-testing status immediately, not at the next scheduled review.

§111.75 governs when a supplement manufacturer may rely on a supplier's Certificate of Analysis in place of its own testing for components, and it is stricter in one specific way than §211.84: it requires the manufacturer to first establish the reliability of the supplier's CoA through its own confirmatory testing before relying on it going forward, and to periodically re-verify that reliability.

• §111.75(a)(1)(ii) — you may rely on a CoA for identity testing of a dietary ingredient only after you have first confirmed the CoA's reliability, e.g., by conducting your own identity test on at least one, and typically several, initial lots, and periodically thereafter.
• §111.75(a)(2) — you must still conduct at least one appropriate test to verify the identity of every component, unless it's a dietary ingredient with a supplier CoA whose reliability has been confirmed under (a)(1).
• §111.75(c) — finished-batch testing: you must confirm through testing or examination that the finished batch meets all product specifications, including identity, purity, strength, composition and any specification designed to prevent adulteration (e.g., contaminant limits).
• §111.70(b) and (g) — the specifications the CoA is measured against must themselves be documented, justified and periodically reviewed; a CoA testing against a stale or undocumented spec is not evidence of compliance.

This is the section most commonly cited in 483s to supplement manufacturers: firms accept a supplier CoA at face value on day one without ever performing the confirmatory identity testing §111.75(a)(1)(ii) requires, and without a documented basis for why the CoA is considered reliable.

In the EU/EEA regulatory model, a batch cannot be released for sale or supply until a named Qualified Person (QP) has certified it in accordance with Annex 16. The QP's certification relies heavily on the CoAs generated across the supply chain — for starting materials, in-process controls, and the finished product — but the QP certification itself is a distinct act from any individual CoA.

• Annex 16 §1 requires the QP to confirm the batch was manufactured and checked in compliance with the laws in force, the marketing authorisation/specification, and GMP (including, for imported batches, GMP equivalent to EU GMP).
• Where manufacture spans multiple sites, Annex 16 permits reliance on the assessments and certifications made at earlier stages — including CoAs from other GMP sites in the same group or from third-country sites with a mutual recognition/MRA framework — but the final QP still takes responsibility for the certification as a whole.
• Annex 16 §3 requires that any deviations, OOS results, or changes since the previous certification stage are assessed by the QP before certifying the batch — a clean CoA does not itself close that assessment.

ISO/IEC 17025 is the international standard for the technical competence of testing and calibration laboratories. A lab holding ISO 17025 accreditation for a specific test method (accreditation is always scope-specific — a lab accredited for microbiological testing is not automatically accredited for heavy-metals testing) has demonstrated, to an external accreditation body, that its method validation, equipment calibration, measurement uncertainty and personnel competence meet the standard.

• An accreditation mark or number on a CoA is only meaningful if it's checked against the accreditation body's published scope — the specific test, matrix and method the lab is accredited for. A lab can be ISO 17025 accredited overall and still run an unaccredited method for the attribute you actually care about.
• ISO 17025 accreditation is not equivalent to, and does not substitute for, cGMP compliance — a contract lab can be excellently accredited and still be an unqualified GMP testing site if it lacks the data-integrity controls a GMP audit would check.
• For supplier qualification purposes, verifying the third-party lab's accreditation scope (not just the certificate's existence) is one of the highest-value five-minute checks in an incoming-material programme.

The single most common CoA-reading error is treating 'result' as sufficient information on its own. Four separate pieces of information are needed to interpret any one line of a CoA, and all four should be explicit on the document:

A spec-matching engine — manual or automated — needs all four fields normalised before it can correctly flag a lot as pass or fail. Comparing a result to a spec while ignoring the method or reporting limit is a common source of both false passes and false OOS investigations.

USP General Chapter <1010> and standard analytical-chemistry practice both specify that rounding must be applied to the final reported result, not to intermediate calculation steps, and that the number of significant figures reported should reflect the precision the method actually supports — not more, not fewer.

• 'Round then compare' — the reported, rounded result is what's compared to the spec limit, not the pre-rounded raw value. A spec of '≤ 2.0%' and a raw instrument reading of 2.049% rounds to 2.0% and passes; but rounding intermediate values during the calculation before reaching the final result is not acceptable practice and can mask a true failure.
• Absolute-value spec limits (e.g., '98.0–102.0%') require the analyst to know how many decimal places the limit itself implies — reporting a result to more decimal places than the limit specifies invites an argument over whether 101.96% should round to 102.0% (pass) or be flagged.
• Rounding rules must be defined in the SOP or method, not decided ad hoc by whoever is filling in the CoA that day. 'Round half up' vs 'round half to even' (banker's rounding) give different answers on genuinely borderline values and the difference has been the subject of real OOS disputes.
• A CoA that reports results to a different number of significant figures than the spec was written to should be treated as a flag for spec/method mismatch, not silently accepted.

Most CoA problems are not exotic — they're mundane process gaps that compound because nobody is looking at the document critically at intake:

• Photocopied or PDF'd CoAs with no verifiable chain back to the original — a scanned document with a signature block that could be from any lot, reused across shipments.
• CoA testing against an out-of-date specification version — the supplier's CoA references 'Spec Rev C' while the receiving site's approved spec is now Rev E, and nobody diffs the two.
• Unqualified or never-audited suppliers whose CoAs are accepted purely because a purchase order exists — no quality agreement, no periodic confirmatory testing, no audit trail of why the supplier is trusted.
• CoA fraud — fabricated or altered results, a genuine template populated with numbers that were never actually measured, or a CoA for a different (often better) lot substituted for the lot actually shipped. This is not hypothetical: multiple FDA warning letters and DOJ actions have involved suppliers issuing fabricated CoAs, particularly for botanical/dietary ingredient identity and heavy-metal testing.
• Transcription errors when results are manually re-typed from a supplier PDF into a LIMS or ERP field, especially decimal-place and unit errors (mg/kg vs %, mg vs mcg).
• Missing or mismatched lot numbers between the physical container label, the packing list, and the CoA — the classic three-way match failure that receiving inspection exists to catch.
• CoAs that report 'meets spec' or 'complies' as the only entry for an attribute, with no numeric result — functionally a CoC masquerading as a CoA.

Manual CoA review does not scale, and it is precisely the repetitive, detail-sensitive task most prone to fatigue-driven error: comparing a dozen numeric results, a method reference, and a spec version against an approved specification, lot after lot, is exactly the kind of check where the tenth CoA of the day gets less scrutiny than the first.

• Electronic CoA intake captures the supplier's results as structured data — via a supplier portal, EDI transaction, or parsed PDF/XML — rather than a human retyping numbers off an image.
• Automatic spec matching compares each reported result, at full precision, against the currently approved specification version for that material, and flags any mismatch in spec version, missing attribute, out-of-range result, or method deviation before the material is allowed onto the floor.
• A hard block at goods receipt — the lot cannot be moved to available/unrestricted stock until the CoA has been reconciled against the spec — closes the gap where a receiving clerk visually skims a CoA and stamps it accepted under time pressure.
• An audit trail of who reviewed the CoA, what exceptions were raised, and how they were dispositioned turns CoA review from a one-time gate into a queryable record for supplier trending and inspection readiness.

On the outbound side, a finished-product CoA should be generated directly from the same release-test results recorded in the batch record — not typed up separately by a document-control clerk after the fact. Re-keying release data into a CoA template is a second manual-transcription opportunity for exactly the errors described above, and it creates two documents (the batch record and the CoA) that can drift out of agreement.

• The CoA should pull the approved specification version that was actually in effect at the time of manufacture, not the version current on the day the CoA happens to be printed — these can differ when a spec revision has occurred between manufacture and shipment.
• Every reportable result on the CoA should trace back to a specific test record (instrument run, analyst, date) so an auditor or customer complaint investigation can go from the CoA number to the underlying raw data in one step.
• Disposition (pass/fail/release/reject) on the CoA must match the batch disposition in the quality system exactly — a CoA showing 'released' for a batch that is actually on quality hold is a data-integrity and potentially a recall-triggering event.
• Where a customer contract or export destination requires a different reporting format (e.g., additional attributes, different units, translated language), the underlying result set stays the single source of truth and the CoA is a formatted view of it — not a separately maintained document.

Generating CoAs directly from validated release data, with the current approved spec pulled automatically, removes the two failure modes that dominate finished-product CoA errors: results transcribed incorrectly, and specs quoted at the wrong revision.