Key points
- A COA answers three questions: what was tested, which lot the sample represented, and how each result compares with the agreed specification. If it cannot answer all three, it is a marketing document.
- Every results row is a five-part statement: analyte, result, unit, method, limit. A row missing any part cannot be assessed.
- “ND” does not mean zero. It means below the reporting limit of that method — always ask for the limit of quantification.
- A specification, a COA and a laboratory report are three different documents. Do not let one stand in for another.
- A COA cannot tell you about foreign material, fraud, storage since testing, or anything outside the tested sample.
Buyers ask us for a certificate of analysis before they ask us for a price. That is the right instinct. It only helps, though, if somebody actually reads the thing.
Three questions decide whether a certificate means anything at all: what was tested, which lot the sample came from, and how each result compares with what you agreed to buy. Plenty of official-looking documents fail all three — not because anyone is being dishonest, but because a COA copied from a template repeats last quarter’s numbers with a new date on top.
First, prove that the COA belongs to the material
This is the step most often skipped, and it is the one we would check first if we were buying. Match the lot code on the certificate to the code printed on the bag in front of you — not to the code on the packing list, which was typed by a person. Where the two disagree, the bag wins and the paperwork needs explaining. Review the header before reading any number.
- Supplier and manufacturing site: Is the issuer the manufacturer, a trader or a third-party laboratory?
- Product name and code: Does it match the approved specification, including form and grade?
- Lot or batch number: Does it match every bag, drum, pallet and shipping document?
- Manufacturing and test dates: Is the sequence possible? Was the report issued after sampling and analysis?
- Sample identifier: For a third-party report, can it be traced to a chain-of-custody record?
- Report status: Is it final, revised, replaced or a template?
- Authorisation: Is the report signed or electronically approved by an identifiable function?
“Typical COA,” “sample COA” and “specification sheet” are not batch results. They can explain what a supplier normally tests, but they cannot release a shipment.
Read every results row as a five-part statement
A defensible row contains five elements:
| Element | Question |
|---|---|
| Parameter | What property or hazard was measured? |
| Method | How was it measured, including preparation where material? |
| Specification | What is the acceptance rule? |
| Result | What did the tested sample actually produce? |
| Unit / qualifier | On what basis and with what reporting convention? |
The difference between a limit and a result is fundamental. “Moisture ≤5.0%” is a requirement; “3.7%” is a result. A row showing only “conforms” removes information needed for trend review and independent confirmation.
Methods are not decorative
Two laboratories can report different values if they use different sample preparation, extraction, instruments or endpoints. For xanthan gum, viscosity is meaningless without concentration, solvent or salt level, temperature, hydration, instrument and speed. For moisture, oven, vacuum-oven, loss-on-drying and Karl Fischer methods do not necessarily answer the same question.
Water activity needs its own result and test temperature. FDA defines it through equilibrium vapour pressure; it is not interchangeable with percent moisture. (FDA water-activity guide)
Check units and basis
Look for mg/kg versus µg/kg, ppm versus percent, as-is versus dry basis, and per gram versus per 25 grams. A thousand-fold unit error can hide in a visually tidy table. If the specification says “not detected,” the reporting limit must be low enough to support the relevant acceptance limit.
Understand result qualifiers
- ND should be paired with a detection or reporting limit.
- <LOQ means the analyte was not quantified above the stated quantification limit; it does not necessarily mean zero.
- Absent in 25 g describes a test outcome and analytical portion, not sterility of the entire lot.
- Complies is meaningful only when the referenced legal or contractual limit is explicit and current.
A worked review example
The following values are fictional and illustrate the review method; they are not Union Sure data or recommended limits.
| COA line | Buyer review |
|---|---|
| Moisture: limit ≤5.0%; result 4.2%; method stated | Numerically passes; confirm method and whether the buyer’s specification uses the same basis |
| Water activity: result 0.31; no temperature | Incomplete for comparison; request the test temperature and acceptance limit |
| Salmonella: absent/25 g; method stated | Result is interpretable; confirm sampling plan and whether the application is ready-to-eat |
| Pesticides: “pass” | Not adequate; request analyte list, results, reporting limits and market basis |
| SO₂: ND; LOQ 20 mg/kg | Cannot support a contractual “<10 mg/kg” claim because the method cannot quantify that low |
The correct action is not always rejection. It may be a clarification, corrected report, targeted retest or temporary hold. Record the decision.
Specification, COA and laboratory report are different
A specification defines what is acceptable. A COA summarises results for an identified lot. A laboratory report may contain fuller method, sample, uncertainty and accreditation information. One document may serve more than one role, but the reviewer should know which role it is performing.
Compare the COA to a controlled copy of the buyer-approved specification. If the supplier silently changes a limit, method or test frequency, the COA can still look compliant while the commercial agreement has changed.
Verify the laboratory, not just the logo
ISO describes ISO/IEC 17025 as the international standard for competent, impartial and consistently operating testing and calibration laboratories. (ISO overview) Accreditation is valuable evidence, but check:
- the accreditation body’s identity;
- certificate status and laboratory address;
- the scope covering the relevant test, matrix and method;
- whether the report marks tests outside the accredited scope;
- whether the laboratory actually received the stated sample.
A copied accreditation mark or QR code is not verification. Use the accreditation body’s directory or contact the laboratory through independently found details when authenticity matters.
What a COA cannot tell you
We would rather a customer send back a lot on a documented specification failure than accept it on a certificate nobody read. A COA describes a sample at a moment. It says nothing about the four weeks the container spent crossing the tropics afterwards, which is exactly why water activity, seal integrity and arrival inspection belong in the quality agreement alongside the test panel. Even a genuine, accurate COA has boundaries.
- It describes the submitted analytical portion, not every unit in a heterogeneous lot.
- It cannot repair a weak or biased sampling plan.
- It does not disclose hazards that were not tested.
- It does not prove the product stayed dry, sealed or uncontaminated after sampling.
- It does not establish that the analyte panel matches the destination market.
- It does not replace supplier qualification, audit, traceability or change control.
For example, the EU Pesticides Database applies substance- and commodity-specific limits. (European Commission database) A five-analyte screen may be accurately reported yet insufficient for the buyer’s risk and market.
A practical COA release workflow
1. Match
Match supplier, product code, grade, lot, dates, quantity and packaging to the purchase and receipt records.
2. Compare
Compare each parameter, method, unit and result with the current buyer specification. Do not approve by the supplier’s pass/fail column alone.
3. Challenge
Investigate missing results, unexplained rounding, copied values, method changes, results exactly at recurring limits and impossible chronology.
4. Verify
Apply the risk-based verification plan: periodic independent testing, identity confirmation, trend analysis, record review or audit. FDA identifies sampling/testing and review of supplier records as possible verification activities in its foreign-supplier guidance. (FDA FSVP guidance)
5. Decide and record
Release, hold, reject or release conditionally under an authorised procedure. Link deviations and corrective actions to the supplier-performance record.
COA checklist for an RFQ or quality agreement
Require the supplier to state:
- exact product and physical grade;
- batch-specific results rather than a typical report;
- agreed test methods and units;
- actual numerical results where the method produces them;
- LOD/LOQ for contaminant panels;
- identity of the testing laboratory;
- sampling responsibility and plan;
- rules for subcontracted testing;
- electronic approval or authorised signature;
- notification before method, specification, site or laboratory changes;
- record-retention and corrected-report controls.
When requesting an ingredient quotation, send the required parameters and methods with the application and destination market. Ask for a representative sample, the current specification and a recent batch-specific COA. That makes the technical comparison possible before price becomes the only visible difference.
Frequently asked questions
Does “ND” mean the ingredient contains none of the analyte?
No. It means the result was below a stated detection or reporting threshold under that method. The threshold must be low enough for the intended claim or limit.
Is an in-house COA acceptable?
It can be, if the supplier and methods are qualified and the buyer periodically verifies reliability. Higher-risk or disputed attributes may justify an independent accredited laboratory.
Should every line have an actual number?
Not every test produces a numerical result; identity and absence tests can be qualitative. Where a quantitative method is used, an actual result is more informative than “pass.”
Where to go next
A certificate is one link in the evidence chain. These cover the links either side of it.
- what to verify at the supplier, not on paper — a COA describes one lot; the audit describes whether lots are made the same way twice.
- moisture content versus water activity — the two most commonly misread rows on a dried-ingredient certificate.
- specify the tests in the RFQ, not after the order — the panel, methods and units belong in the enquiry — retrofitting them costs a re-test.
- request a batch-specific COA — tell us the destination market and application so the panel matches the risk.
Published 14 October 2025. Last reviewed 15 August 2026 by the Union Sure technical team. Regulatory limits, standards and market requirements change — verify every legal limit against the current official source before it is used to approve a shipment.
