Anonymous supplement samples in testing laboratory

Buyers & Clinicians: 3 Supplement CoA Checks, ISO Scope First

A supplement Certificate of Analysis (CoA) is a batch-specific lab report proving that one production lot was tested for identity, potency, and contaminants. The first thing to check when one lands on your desk is whether the lot number matches your product and whether the testing lab carries ISO/IEC 17025 accreditation. A CoA is not the same as ongoing certification like NSF/ANSI 173, and treating the two as interchangeable is where a lot of buyers get burned.

TL;DR:

  • Always verify that the lot number and manufacture date on the CoA match the product in your possession, as mismatched data invalidates testing results.
  • Confirm the testing lab’s accreditation covers the specific analyses, such as heavy metals or microbiology, rather than relying solely on general ISO/IEC 17025 status.
  • Review the reported values with measurement uncertainty by examining the ± margins to assess whether results truly meet safety standards.
  • Be wary of fabricated CoAs that lack batch details, suspiciously perfect numbers, missing methods, or unaccredited labs, which are signs of dry labbing or misrepresentation.
  • Request raw test data or chromatograms if results are borderline, inconsistent, or seem overly perfect to ensure the batch passed scrutiny accurately.

Table of Contents

What a Certificate of Analysis (COA) Is and Why It Matters

A CoA exists because someone, somewhere, has to prove a batch is what it claims to be. Manufacturers use them for incoming raw material release, finished-product release before it ships, and as documentation during audits. Regulators use the same logic: under 21 CFR Part 111, dietary supplement makers must verify identity, purity, strength, and composition, and a batch CoA is the paper trail that shows the work happened.

Here’s where confusion creeps in. A CoA is not the same thing as third-party certification programs like NSF/ANSI 173, which go further, covering facility audits, label-claim verification, and toxicology review on an ongoing basis rather than a single lot.

  • A CoA answers: “Did this specific batch pass testing?”
  • A certification program answers: “Does this brand consistently operate under verified standards?”
  • Both matter, but only one of them tells you anything about the bottle in front of you right now.

Anatomy of a CoA: The Sections and Data You Should Always Find

A complete CoA reads less like a marketing sheet and more like a lab notebook. If any of the following pieces are missing, treat that as a gap worth questioning, not a formatting quirk.

  1. Header information. Lab name, contact details, and visible ISO/IEC 17025 accreditation status, ideally stated right on the letterhead.
  2. Batch identifiers. Lot number, manufacture date, and test date, all of which should trace back to the exact product you’re holding.
  3. Test panels. Identity confirmation, potency, heavy metals, microbiology, pesticides, solvent residues, and, for some products, stability data.
  4. Methods and units. Techniques like HPLC or ICP-MS, results expressed consistently (mg per serving versus mg per gram matters a great deal), acceptance criteria, and signatures from the analyst and reviewer.

The CHPA SIDI guideline, adopted in 2010, standardizes exactly this content so suppliers and buyers aren’t guessing at format. One detail that separates a rigorous CoA from a sloppy one: measurement uncertainty. A result that reads “1.8 ppm lead” tells you little without the ± value attached, especially when the limit sits at 2.0 ppm. That margin of error can be the difference between a batch that comfortably passes and one riding the edge of acceptable.

How Do You Read and Verify a CoA Step by Step?

Reading a CoA competently takes about five minutes once you know the sequence. Skipping steps is how bad batches slip through.

  • Step 1: Match the lot. Confirm the batch number and manufacture date on the CoA correspond exactly to the product in hand. A mismatched lot number invalidates everything else on the page.
  • Step 2: Check the lab’s accreditation scope. ISO/IEC 17025 accreditation is only meaningful if it covers the specific tests reported. A lab accredited for microbiology testing isn’t automatically qualified for ICP-MS heavy metal analysis.
  • Step 3: Confirm methods and units. Verify the analytical method (HPLC, USP monograph number, ICP-MS) and make sure units are consistent, converting mg/g to mg/serving if the label uses a different basis.
  • Step 4: Read the raw values, not just pass/fail. A borderline result sitting near a specification limit tells a different story once you factor in measurement uncertainty.
  • Step 5: Check the contaminant panels. Confirm heavy metals, microbial limits, and pesticide screens were actually run, and that detection limits are low enough to catch a real problem.
  • Step 6: Request raw data when something looks off. Chromatograms and instrument printouts back up the summary numbers on the certificate.

Pro Tip: A batch that passes by a hair should get flagged for trending, not filed away. Repeated borderline results across lots often signal manufacturing drift long before an outright failure shows up.

Red Flags, Dry Labbing, and What to Ask Suppliers

Some CoAs are fabricated outright, a practice known as “dry labbing,” where a lab (or a supplier pretending to be one) reports numbers without running the actual test. ConsumerLab has documented cases of incorrect testing and misapplied methods traced back to manufacturer-supplied reports, which is why independent, third-party verification carries more weight than a document a brand wrote about itself.

Watch for these signals:

  • No batch or lot number, or one that doesn’t match the product.
  • Suspiciously round numbers across every analyte (real lab data is rarely that clean).
  • No stated test method or missing measurement uncertainty.
  • Contaminant panels absent entirely, especially heavy metals and microbiology.
  • A lab with no visible accreditation, or one that won’t confirm its scope.

If a supplier hesitates, ask directly: who ran the test, can you provide the lab’s contact information, what’s the chain of custody, what’s the measurement uncertainty on the potency assay, and can you share raw chromatograms. A supplier with nothing to hide answers these in a day. One that stalls is telling you something.

Regulatory Context: What US Rules Actually Require

21 CFR Part 111 requires supplement manufacturers to verify identity, purity, strength, and composition, and to keep records supporting those claims. That regulatory backbone is what gives a CoA its practical teeth.

  • Facility registration and current Good Manufacturing Practice (cGMP) statements are complementary, not substitutes. A registered facility can still ship a bad batch.
  • Some online marketplaces now require sellers to produce a batch CoA on request before listing certain supplement categories.
  • Retention timelines matter: keeping CoAs on file for at least the product’s shelf life, plus a buffer, is standard practice for defensible recordkeeping.
  • A layered verification approach, combining batch CoAs with facility inspection history and third-party certification, reduces risk more than any single document can on its own.

How Do You Obtain a CoA, and What Does It Cost?

Most brands can request a CoA directly from their supplier, but sending an independent sample to a third-party ISO/IEC 17025 lab gives you a result the manufacturer didn’t write themselves.

  • Supplier-provided CoAs are faster and free, but they carry the reliability caveats above.
  • Independent lab testing typically runs days to a few weeks, depending on the panel complexity and the lab’s backlog.
  • Cost scales with the number of analytes tested. A basic potency assay costs far less than a full panel covering heavy metals, microbiology, pesticides, and solvent residues.
  • Rush fees and sample shipping logistics add to both cost and timeline, so build buffer into procurement schedules.
  • When drafting a purchase order or quality agreement, specify the exact panels, methods (HPLC, ICP-MS, or named USP methods), and required accreditation scope in writing. Vague language gets vague results.

Tryrevivify’s Perspective on Documentation Standards

At Tryrevivify, we treat a CoA as a floor, not a ceiling. Every batch of our supplement gel undergoes third-party testing, and we hold ourselves to a minimum documentation standard: identity confirmation, potency reported in mg per serving, heavy metal screening, and microbiology limits, all tied to a disclosed method and an accredited lab. If a supplier or brand can’t show you that combination, you’re looking at an incomplete picture, not a clean one. For readers who want to dig further into how certification programs differ from batch testing, our guide to NSF certified supplements walks through the distinction in more depth.

Four supplement CoA documentation checks

Where to Verify These Standards Yourself

The FDA’s compliance guidance covers 21 CFR Part 111 testing rules directly from the source. The CHPA SIDI guideline and the IADSA CoA preparation guide both detail recommended CoA content and format. For lab credentials and manufacturer-reliability concerns, see IAS accreditation resources and ConsumerLab’s warnings on manufacturer-supplied reports.

Where to Verify These Standards Yourself — overview diagram

Get a Supplement Backed by Real Batch Testing

Tryrevivify is the option for readers who want the verification habits this article describes already built into the product they buy, not something they have to chase down after purchase. Our daily gel supplement combines superoxide dismutase, prebiotic fiber, polyphenols, and lactobacillus, and every batch carries third-party testing rather than a manufacturer’s self-issued report.

Tryrevivify

That matters most for readers managing inflammation, blood sugar, cardiovascular health, or digestive concerns, where knowing exactly what’s in the dose you’re taking isn’t optional. Tryrevivify ships as a one-time purchase or a subscription with a risk-free guarantee, so there’s no long-term lock-in while you evaluate whether it fits your routine. If the checklist in this article is the standard you hold suppliers to, check out this certificate of analysis review checklist for QA teams to ensure thorough verification before you order.

Why Most Buyers Read a CoA Backwards

Most people scan a Certificate of Analysis for the pass/fail column and stop there. That’s backwards. The pass/fail line is the least informative part of the document because it hides the raw number, the uncertainty range, and the method that produced it.

The industry has a quiet blind spot here too: a fair number of brands still tell customers they “can’t share” lab results due to FDA rules. That’s misleading. Nothing in FDA guidance generally prohibits sharing CoAs with customers, so when a company stonewalls a straightforward request, the more likely explanation is that the document wouldn’t hold up to a second look.

The real skill isn’t reading a CoA. It’s knowing which two or three details, lot match, accreditation scope, and measurement uncertainty, actually change your risk assessment, and refusing to accept a document that’s missing them. Everything else on the page is context. Those three are the substance.

— Larry

This article is general information, not a substitute for advice from a qualified doctor. Consult a qualified healthcare professional about your own circumstances before acting on anything here.

Sources

Back to blog