How to Read a Certificate of Analysis: A B2B Sourcing Checklist for Raw Material Buyers

For anyone sourcing raw materials in the nutraceutical supply chain, the Certificate of Analysis is the single most consequential document a supplier provides — and also the document most frequently accepted at face value without the scrutiny it requires. A COA that looks professional is not the same as a COA that actually protects your business.

What a Certificate of Analysis Is Supposed to Contain

A properly constructed COA is a per-batch laboratory report covering several distinct categories of testing: identity confirmation that the material is what it claims to be, typically verified through HPLC, ICP-MS, or other chromatographic methods; potency, the actual measured concentration of the active compound; heavy metals, specifically lead, arsenic, cadmium, and mercury; microbial contamination, including total aerobic plate count, yeast and mold, and pathogen screening for organisms like E. coli, Salmonella, and Staphylococcus aureus; and disclosure of any undeclared excipients or allergens . A voluntary industry guideline developed for dietary supplement components provides a standardized template for what a compliant COA should document, reflecting the fact that COA quality and completeness vary substantially across the supplier landscape .

The Single Most Common COA Red Flag

The most frequent and most consequential defect in supplier-provided COAs is the use of "report only" values for heavy metals, meaning the lab states a measured number but the COA specifies no pass/fail limit against which that number is being judged . A regulatory consulting review of COA quality standards states this directly: heavy metals need limits, and "report only" is not a specification — a compliant COA requires pass/fail criteria for identity, label-claim actives, heavy metals with defined limits, and microbial counts, each tied to a clear basis such as parts per million or micrograms per gram . If a supplier's COA lists a lead result of, for example, "0.3 ppm" with no stated limit, that number is functionally meaningless without knowing whether 0.3 ppm passes or fails whatever the buyer's target market considers acceptable.

Cross-Referencing Against Regulatory Limits

Because dietary supplements are not subject to FDA pre-market approval, buyers still need to verify incoming raw materials against the specifications and legal limits that apply to the intended market. Two of the most commonly referenced frameworks are USP heavy metal limits and the European Union's Commission Regulation (EU) 2023/915, which sets explicit maximum levels including lead at 3.0 mg/kg in food supplements (with category-specific variations), cadmium at 1.0 mg/kg in most supplements (lower specifically for seaweed-based products), and mercury at 0.10 mg/kg, with methylmercury-dominant sources like fish oil treated under a separate specification . For a B2B buyer sourcing raw materials intended for products that may eventually be sold or exported to EU-adjacent markets, benchmarking incoming COAs against the stricter EU limits, rather than accepting whatever domestic threshold a supplier defaults to, is a more conservative and more defensible sourcing standard.

Documented Contamination Rates by Category

Independent aggregate testing has found that heavy metal contamination in raw supplement materials is a systemic rather than isolated issue. Data compiled from Clean Label Project testing and peer-reviewed studies has found measurable lead in the significant majority of tested greens powders, lead specifically in roughly 14% of turmeric samples — frequently traced to adulteration with lead chromate used to enhance color — and measurable heavy metals in a substantial share of tested protein powders . This is directly relevant for any raw material buyer working with botanical extracts, colored powders, or ingredients sourced from regions with less consistent agricultural contaminant controls; category-specific contamination risk should inform testing frequency and threshold stringency, not just blanket acceptance of a standard COA template.

Verifying the Testing Methodology Itself

A compliant COA should name the specific test method used for each parameter — tied to USP, AOAC, or a validated in-house method with a documented validation summary on file — rather than simply stating a result with no methodological reference . Testing by an ISO/IEC 17025-accredited laboratory can strengthen confidence in laboratory competence when the accreditation scope covers the relevant method. Accreditation is a due-diligence signal, not a substitute for matching the method, sample, lot, specification, and result.

Batch Traceability: The Detail Most Buyers Skip

Every legitimate COA should be tied to a specific batch or lot number, with documentation of the sampling plan used — for example, whether samples were pulled from the beginning, middle, and end of a production run, which affects how representative the tested sample is of the full batch . A buyer receiving raw material without a corresponding lot-specific COA, or receiving a generic "typical results" COA not tied to the actual shipped batch, has functionally no verified quality assurance for that specific shipment, regardless of how clean the supplier's historical testing record appears.

Finished-Product Testing vs. Component Qualification

Under 21 CFR 111.75, US dietary supplement manufacturers are permitted, under specific documented conditions, to rely on a supplier's component-level testing rather than independently retesting every incoming raw material batch — but this substitution requires documented supplier qualification and appropriate in-process controls, and should be explicitly cited and justified on the COA rather than assumed . For a B2B buyer evaluating a contract manufacturer or raw material supplier, asking directly whether finished-product testing or component-qualification testing is being used — and requesting the underlying justification when the latter applies — is a legitimate and increasingly standard due-diligence question.

A Practical COA Review Checklist

What This Means for Building Supplier Relationships

For a nutraceutical brand building or refining its raw material sourcing process, the most durable practice is standardizing a COA review checklist across all suppliers rather than accepting whatever format each individual supplier defaults to, and explicitly requesting missing elements (pass/fail limits, lab accreditation, methodology citations) before a supplier relationship is finalized rather than after a quality issue surfaces. Suppliers who resist providing this level of specificity, or who cannot readily produce it, are revealing something meaningful about their own quality control maturity — a signal worth weighing as heavily as price or lead time in any sourcing decision.

Requesting and Storing COAs as an Ongoing Practice, Not a One-Time Check

A single satisfactory COA at the start of a supplier relationship does not guarantee ongoing quality, since raw material sourcing regions, growing seasons (for botanicals), and manufacturing conditions can shift between production runs. A more rigorous sourcing practice requests a COA for every incoming batch, not just an initial qualifying sample, and maintains a retained archive of COAs mapped to specific batches used in specific finished-product production runs. This archive becomes essential in the event of a consumer complaint, a regulatory inquiry, or a recall investigation, where the ability to trace a specific finished product lot back to a specific raw material batch and its corresponding COA can be the difference between a contained, well-documented response and a much larger liability exposure.

Evaluating Reputable vs. Fabricated Documentation

Because COAs carry significant weight in both regulatory compliance and B2B purchasing decisions, they are also, unfortunately, sometimes fabricated or selectively edited by less scrupulous suppliers. A few practical verification steps can reduce this risk: independently contacting the named testing laboratory to confirm they performed the specific test in question, checking that the lab's accreditation status is current and publicly listed on the relevant accreditation body's registry, and being skeptical of COAs with suspiciously uniform "just barely passing" results across every parameter, which can indicate the document was constructed to satisfy a checklist rather than reflecting genuine independent testing. Requesting the ability to periodically submit your own blind samples for independent third-party verification, separate from the supplier's own COA process, is a more expensive but considerably more reliable practice for high-volume or high-risk ingredient categories.

Aligning COA Standards With Target Market Requirements

Finally, COA standards should be calibrated to the strictest regulatory environment a brand's finished products might realistically reach, not simply the minimum required for the primary domestic market. A brand manufacturing primarily for the US market but maintaining ambitions for EU, UK, or other export markets should benchmark incoming raw material COAs against the more stringent of the applicable heavy metal and contaminant limits from the outset, since retrofitting sourcing standards after a formulation is already locked in and commercialized is considerably more disruptive and costly than building the stricter standard into initial supplier qualification. This forward-looking approach to COA review is a meaningful, low-cost way to reduce future compliance risk as a brand's market footprint expands.