Supplier Certificates of Analysis: What Supplement Brands Should Verify

Supplement brands receive certificates of analysis from ingredient suppliers every week, and most of those documents are accepted on faith. This guide explains what FDA's cGMP rule actually requires before you may rely on a supplier's COA, and the practical checks that separate a defensible supplier file from a folder of PDFs: authenticity, lot matching, heavy metal coverage, specification basis, periodic confirmation testing, and the documentation trail an auditor will ask for.

The uncomfortable truth about supplier COAs is that the document itself proves very little. It is a claim, made by a party with a commercial interest in your acceptance of the shipment, about a sample you did not select, tested against a specification you may never have read. None of that makes supplier COAs worthless. It makes them inputs to verification rather than substitutes for it, which is exactly how federal regulation treats them.

What does 21 Cfr 111.75 actually require before you rely on a supplier Coa?

FDA's dietary supplement cGMP rule requires manufacturers to establish specifications for components, including contaminant limits (21 CFR 111.70), and then to verify those specifications are met. For components, 21 CFR 111.75 permits relying on a supplier's certificate of analysis instead of testing every attribute yourself, but only under explicit conditions set out in section 111.75(a)(2)(ii):

• You first qualify the supplier by "establishing the reliability of the supplier's certificate of analysis through confirmation of the results of the supplier's tests or examinations." In plain terms: you test the material yourself, at least initially, and confirm the supplier's numbers hold up.
• The COA itself must include "a description of the test or examination method(s) used, limits of the test or examinations, and actual results." A document listing "Pass" with no method, limits, or numbers does not meet the regulatory definition.
• You must maintain documentation of how you qualified the supplier.
• You must "periodically re-confirm the supplier's certificate of analysis." Qualification is not permanent; it decays without re-verification.
• Your quality control personnel must review and approve the documentation for the qualification.

Note what this structure implies. Relying on supplier COAs is a privilege earned through your own testing, sustained through periodic re-testing, and evidenced through records. A brand that has never independently confirmed a supplier's results has not qualified that supplier in the regulatory sense, no matter how thick the COA folder is. And identity testing of dietary ingredients cannot be delegated to a COA at all; 111.75(a)(1) requires it regardless.

How do you check that a supplier Coa is authentic?

Before a COA can verify anything, you need confidence the document is what it claims to be. Practical authenticity checks:

• Confirm with the issuing lab. Every genuine COA carries a report number. Contact the laboratory directly (using contact details you source independently, not from the document) and ask them to confirm the report exists and matches. This one step defeats most fabrication.
• Check whose paper it is on. A lab-issued report is primary evidence. Results retyped onto the supplier's own letterhead are a summary of evidence you have not seen; request the underlying lab report.
• Look at the lab, not just the logo. Is the laboratory named, addressed, and accredited to ISO/IEC 17025 with elemental analysis on its accredited scope? Our guide on how to evaluate a heavy metal testing laboratory lists what a qualified lab looks like.
• Watch for template artifacts. Identical results across lots to the third decimal, mismatched fonts, missing report numbers, editable file formats, and undated or unsigned reports are all reasons to verify at the source before filing.

Does the Coa actually match the lot you received?

A COA is evidence about one lot. The verification is mechanical but non-negotiable: the lot or batch number on the certificate must match the lot number on the containers you received, the quantity and material description should be consistent, and the analysis date should make sense against the manufacturing and shipping dates. Where suppliers blend or repackage, ask how their lot numbering maps to the original manufacturer's lots, and get that mapping in writing.

Sampling context matters too. Most supplier COAs describe a sample the supplier drew. That is normal, but it is one more reason your own periodic confirmation testing, on material you sampled from your own received containers, carries independent weight.

A related trap is the "typical values" document. Some suppliers circulate a generic product data sheet showing representative results and present it as a COA. It is not one. A certificate of analysis is lot-specific by definition; a document with no lot number describes the supplier's product line on a good day, not the pallet in your warehouse. File it as marketing literature and ask for the lot-specific report.

Does the Coa cover heavy metals at all?

This check is embarrassingly easy to fail. Many ingredient COAs are built around identity, potency, microbiology, and physical characteristics, and either omit elemental contaminants entirely or list only lead. Read the analyte list. For metals, you generally want lead, arsenic (ideally with a path to speciation for inorganic arsenic where relevant), cadmium, and mercury, each with a stated method (validated ICP-MS testing for supplements, per procedures like FDA EAM 4.7 or USP <233>-type methods, see USP's elemental impurities updates), a reporting limit for any non-detect, and actual numeric results. A COA that is silent on metals does not verify your metals specification, whatever else it verifies; you will need to test the material or obtain supplementary data. Our companion piece on how to read a heavy metal certificate of analysis walks through interpreting each field.

What is the spec-shopping problem?

Because there are no generally applicable federal numeric limits for heavy metals in finished supplements, every specification on a supplier COA was chosen by someone. Spec shopping is what happens when that someone optimizes for passing rather than for your product: a supplier sets, or a brand accepts, limits generous enough that any plausible result passes. A lead spec of 3 µg/g on an ingredient looks reassuring next to a "Pass," until you calculate what it permits: at 3 µg/g, just 0.2 g of that ingredient in a daily serving could carry 0.6 µg of lead, above California's Prop 65 safe harbor of 0.5 µg/day for the entire finished product (OEHHA levels).

The fix is to work backwards from your finished-product benchmark, whether that is USP <2232> daily-dose limits or Prop 65 derived numbers, through your formula's inclusion rates, to ingredient limits that actually protect the finished product. Then compare the supplier's spec against yours, not the other way around. When they differ, your specification governs acceptance; the supplier's governs nothing but their own paperwork.

How often should you re-confirm supplier COAs with your own testing?

The regulation says "periodically" and leaves the interval to you, which means you need a documented rationale rather than a habit. Sensible programs scale confirmation frequency to risk: mineral-derived and agricultural ingredients (where metal levels track soil and source variability) get confirmed more often than high-purity synthetics with long clean histories; new suppliers start with every-lot confirmation until a track record exists; any source change, process change, country-of-origin change, or out-of-trend supplier result resets the clock. A common structure is every-lot verification during qualification, stepping down to a defined skip-lot cadence once results are consistent, with an automatic return to every-lot on any failure or change. We map cadence options in detail in how often supplements should be tested for heavy metals.

Remember that supplier confirmation is one layer of a two-layer system: whatever you accept at the ingredient stage, finished-batch verification under 111.75(c) still applies, either every finished batch or a subset identified through a sound statistical sampling plan. The interplay between the two layers is the subject of ingredient testing vs finished product testing.

What documentation trail should you keep for audits?

When an FDA investigator, retailer auditor, or certifier reviews your supplier program, they are reconstructing a chain of decisions. The checklist below is the file you want to already have, per supplier and per ingredient:

A brand holding this file can answer any question a buyer or auditor asks about supplier metals control in minutes. It is also, not coincidentally, most of the documentation a certification program needs; certification packages this evidence against a published standard with public verification. See our overview of heavy metal certification for supplements.

Faq: Supplier Coa verification

Can a supplement brand legally rely on a supplier's COA? Yes, for most component specifications (identity testing excepted), but only after qualifying the supplier by confirming their results through your own testing, and only with documentation and periodic re-confirmation, per 21 CFR 111.75(a)(2)(ii).

What must a supplier COA contain to be usable under FDA rules? The regulation requires a description of the test methods used, the limits of the tests, and actual results. A bare "conforms" or "Pass" without methods and numbers does not meet that standard.

How do I verify a supplier COA is real? Confirm the report number directly with the issuing laboratory using independently sourced contact details, check lot numbers against received goods, and prefer original lab reports over results retyped on supplier letterhead.

What if a supplier COA does not list heavy metals? Then it does not verify your metals specification. Request elemental analysis data with methods and reporting limits, or test the material yourself. Silence on metals is a gap, not a pass.

What is spec shopping? Accepting or setting specifications loose enough that passing is nearly guaranteed. Protect against it by deriving ingredient limits from your finished-product dose benchmark and inclusion rates, and judging supplier COAs against your specification.

How often must supplier COAs be re-confirmed? FDA requires periodic re-confirmation but sets no interval. Risk-based programs confirm new suppliers every lot, step down to skip-lot testing as history accumulates, and reset on any change or failure.

Does supplier COA verification replace finished-product testing? No. Finished-batch verification under 111.75(c) applies regardless, for every batch or a statistically sound subset, because the finished product is where dose-based limits are judged.

If your supplier file is solid, certification is the shortest path to making that work visible. Heavy Metal Certified evaluates finished products against a published standard through qualified independent laboratories, with public verification your buyers can check. Review the heavy metal testing and certification standard, request a preliminary assessment, or apply for certification.