How to Read a Heavy Metal Certificate of Analysis

A heavy metal certificate of analysis (COA) is only useful if you know what each field actually means. This guide walks through the anatomy of a heavy metal COA: laboratory identity and accreditation, sample identification, test method, units, reporting limits, the specification column, and the sign-off, followed by a line-by-line worked example and a list of red flags. It is written for quality and regulatory leads at supplement brands who receive COAs from labs and suppliers and need to read them critically.

Most quality teams see dozens of these documents a month. Very few of the people downstream of them, founders, marketers, retail buyers, read past the words "ND" or "Pass." That is a problem, because a COA can be technically accurate and still tell you almost nothing, depending on what method was used, what the reporting limit was, and whose specification the results were compared against.

What is a heavy metal certificate of analysis?

A COA is a laboratory's formal report of what it measured in one specific sample. For heavy metals, that usually means results for lead, arsenic, cadmium, and mercury, reported as concentrations, sometimes compared against a specification. It is a snapshot of one sample on one day. It is not a certification, not a safety guarantee, and not evidence about any lot other than the one tested. Under FDA's dietary supplement cGMP rule, COAs are part of how manufacturers verify the specifications they are required to establish, including "limits on those types of contamination that may adulterate" the product (21 CFR 111.70), and how brands qualify what suppliers send them (21 CFR 111.75).

Reading one properly means checking seven things, in order.

Who issued the Coa, and are they accredited?

Start with the letterhead. A credible COA identifies the laboratory by name and physical address, and states its accreditation. For chemical testing, the accreditation to look for is ISO/IEC 17025, the international standard for the competence of testing laboratories, granted by an accreditation body after audits of the lab's methods, equipment, personnel, and quality system. Accreditation does not make every result correct, but it means an independent auditor has verified the lab can produce valid results for the methods on its scope.

Two checks matter here. First, is the accreditation current and does the lab's accredited scope actually include elemental analysis in your matrix type? A lab can hold ISO/IEC 17025 accreditation for microbiology and still run metals outside its accredited scope. Second, is the document from the lab at all? COAs retyped onto a supplier's own letterhead are summaries, not certificates. Our guide on how to evaluate a heavy metal testing laboratory covers lab selection in depth.

What sample does this Coa actually cover?

A COA is anchored to a sample, so the document must identify it unambiguously: product or ingredient name, lot or batch number, sample receipt date, and ideally who collected the sample and how. If the lot number on the COA does not match the lot in your warehouse, the COA tells you nothing about your inventory. This is the single most common gap in supplier documentation, and it is why lot matching sits at the center of supplier certificate of analysis verification.

Pay attention to who pulled the sample. A sample the supplier selected and shipped to the lab answers a different question than a sample drawn from your received goods or purchased at retail. Neither is wrong, but they are different evidence.

What method was used, and why does it matter?

The method line tells you how the numbers were generated. For heavy metals in supplements, the benchmark is ICP-MS (inductively coupled plasma mass spectrometry), typically after microwave-assisted acid digestion, following validated procedures such as FDA's Elemental Analysis Manual method 4.7 or the procedures defined in USP <233>, which replaced the older colorimetric heavy metals test in the pharmacopeial world (USP elemental impurities updates). ICP-MS instruments can detect elements down to roughly parts-per-trillion levels, which is why modern COAs so often show low but nonzero results where older methods showed nothing.

If the method field is blank, or names a technique with much higher detection limits, the results may be honest but far less informative. A "not detected" from a low-sensitivity method is a weaker statement than a quantified trace from ICP-MS. Our plain-English explainer on ICP-MS testing for supplements covers what the instrument actually does.

What do the units mean: ppb, ppm, or micrograms per serving?

Units are where most misreadings happen. Labs report concentrations; regulatory benchmarks are mostly dose-based. You will usually need to convert.

The conversion that matters commercially: dose per daily serving equals the concentration in µg/g times the serving mass in grams. A powder testing at 21 ppb lead (0.021 µg/g) delivers 0.105 µg of lead in a 5 g serving. That is the number you compare against dose-based benchmarks like the USP <2232> daily-dose limit of 10 µg/day for lead, or California's far stricter Prop 65 safe harbor of 0.5 µg/day (OEHHA levels). A concentration alone, without serving size, cannot be judged against either.

What does "Nd" actually mean?

"ND" means non-detect: the metal was not found above the method's reporting limit. It does not mean zero, and it is only meaningful relative to the stated limit. "ND (<0.010 µg/g)" and "ND (<1.0 µg/g)" look identical in a summary table and differ by a factor of one hundred in what they establish.

Look for the limit of detection (LOD) or, more usefully, the limit of quantitation (LOQ), the lowest level the lab can reliably measure. A well-constructed COA states the reporting limit next to every ND. When you assess dose, treat an ND conservatively as "up to the reporting limit": ND at <0.010 µg/g in a 5 g serving means at most 0.05 µg. If a COA reports ND with no limit stated anywhere, you cannot interpret the result, and neither can an auditor. This is also why "zero heavy metals" is not a claim any laboratory can substantiate; detection always bottoms out at some limit.

Whose specification is in the spec column?

Many COAs include a specification column and a pass/fail verdict. Always ask: whose specification? There is no generally applicable federal numeric limit for lead, arsenic, cadmium, or mercury in finished supplements; under 21 CFR 111.70 the manufacturer sets its own limits. So the spec on the page might be the brand's internal limit, the supplier's limit, a lab default, a USP <2232> figure, or a Prop 65 derived number. A "Pass" against a generous spec and a "Pass" against a Prop 65 derived spec are very different statements wearing the same word.

The specification's basis should be stated or traceable. If it is not, the pass/fail column is decoration, and you should evaluate the raw numbers yourself against the benchmark that matters for your market.

Is the Coa dated and signed?

The closing block matters more than it looks. Check the analysis date and report date (a COA from three years ago describes a supply chain that may no longer exist), a unique report number, and the signature or electronic authorization of a responsible person at the laboratory. Unsigned, undated documents are drafts, not certificates. The report number lets you verify the document directly with the lab, which is the definitive authenticity check.

What does a full read-through look like? A worked example

The following COA is entirely hypothetical, invented for teaching purposes. It does not describe any real product, lab, or lot.

Suppose a creatine monohydrate brand receives this from its contract lab for finished product lot CM-2401, daily serving 5 g:

Reading it line by line: the lab is named and ISO/IEC 17025 accredited for metals by ICP-MS, method referenced to FDA EAM 4.7, sample identified by lot and receipt date. Lead was quantified at 0.021 µg/g, about twice the reporting limit, so it is a real measured value, not noise. At 5 g per day that is 0.105 µg/day, well under the Prop 65 lead safe harbor of 0.5 µg/day and far under USP <2232>'s 10 µg/day. Arsenic and mercury are ND, meaning at most 0.010 and 0.005 µg/g respectively, at most 0.05 and 0.025 µg/day. Cadmium at 0.008 µg/g gives 0.04 µg/day against USP <2232>'s 5 µg/day and Prop 65's 4.1 µg/day oral MADL. The specification column, per the footnote, is the brand's internal spec, with lead set at 0.100 µg/g so that a full serving stays at or below the Prop 65 daily level. Dated, signed, report number present. This is a COA doing its job: every number interpretable, every verdict traceable to a stated basis.

Note what the exercise did not conclude: that the product is "metal-free" or "completely safe." It concluded that this lot's measured doses sit below specific named benchmarks. That is the only kind of statement a COA supports.

What are the red flags on a heavy metal Coa?

• No laboratory name, address, or accreditation status anywhere on the document
• Lot number missing, or not matching the lot the COA was offered to support
• No test method stated, or a method with detection limits too high to be informative
• "ND" with no reporting limit disclosed
• Concentration units with no serving size anywhere, making dose impossible to calculate
• A pass/fail column with no stated basis for the specification
• Results identical to the decimal across multiple lots (possible copy-paste)
• No report number, date, or signatory
• A "0" or "none" result rather than ND with a limit (labs measure limits, not zeros)
• Document supplied as an editable file or retyped on someone else's letterhead

One or two of these are worth a query to the lab or supplier. Several together mean the document should not enter your quality record until verified at the source.

Faq: Reading heavy metal COAs

What does ND mean on a certificate of analysis? Non-detect: the analyte was not found above the method's reporting limit. It is not zero. ND is only interpretable when the reporting limit is stated, and dose assessments should treat it as "up to that limit."

What is the difference between ppb and ppm? Both are mass concentrations. One ppm equals 1,000 ppb. One ppm is also 1 µg/g, and one ppb is 0.001 µg/g. Multiply µg/g by serving mass in grams to get micrograms per serving.

Is a COA the same as certification? No. A COA is a lab's report on one sample of one lot. Certification is ongoing conformance with an independent published standard, verified by a third party. See our guide to heavy metal certification for supplements.

What specification should a heavy metal COA use? There is no universal legal limit; manufacturers set their own under 21 CFR 111.70. Common benchmarks are USP <2232> daily-dose limits and California Prop 65 safe harbor levels. A good COA states which basis the specification comes from.

Do detectable metals on a COA mean the product is unsafe? Not by themselves. ICP-MS detects at extremely low levels, and trace metals occur naturally in mineral and agricultural ingredients. What matters is the dose per daily serving compared against a named benchmark.

How do I verify a COA is genuine? Contact the issuing laboratory with the report number and ask them to confirm it. Cross-check lot numbers, dates, and letterhead. For supplier documents, this is part of the qualification FDA expects; see supplier certificate of analysis verification.

How often should new COAs be generated? FDA requires specification verification for every batch or a sound statistical subset, but sets no fixed frequency. See how often supplements should be tested for heavy metals for a risk-based framework, and ingredient testing vs finished product testing for where COAs fit in the chain.

If you would rather have every COA in your program read, benchmarked, and published against a transparent standard, that is what certification is for. Request a preliminary certification assessment, review our heavy metal testing and certification standard, or apply for certification. You can also browse Heavy Metal Tested certified brands to see public verification in practice.