A certificate of analysis, or COA, is the document that ships with a batch of a manufactured product to confirm it was tested and met its specifications, and the certificate of analysis requirements that govern it come from FDA and USDA regulations that differ by industry. At a minimum, every COA needs to identify the batch, list each test performed with its method, specification, and actual result, and carry an authorized signature. Pharmaceuticals, dietary supplements, hemp, and imported food each add their own rules on top of that baseline.
What Has to Appear on the Document
The identification block comes first: product name, lot or batch number, date of manufacture, and either an expiration date or a retest date. These fields tie the document to a specific production run. Strip them out and the numbers below could belong to anything.
The body of the COA is a table. Each row names a test, the analytical method used, the specification (the acceptable range), and the result the lab actually measured. Typical tests cover identity, potency or assay, purity, moisture, heavy metals, and microbial limits. Methods are usually standardized techniques such as High-Performance Liquid Chromatography (HPLC) or Gas Chromatography-Mass Spectrometry (GC-MS). Naming the method matters because it lets another lab reproduce the test if the number looks wrong.
For pharmaceutical products, federal regulations spell out what the underlying laboratory records must capture: a description of the sample with its source and lot number, the method used, the weight or measure of sample tested, all raw data and instrument readouts, every calculation performed, and a comparison of the results against established standards for identity, strength, quality, and purity. Each test entry must carry the initials or signature of the analyst who performed it, plus a second signature from someone who reviewed the record for accuracy and completeness.1eCFR. 21 CFR 211.194 – Laboratory Records
Dietary supplement COAs work under a parallel structure. Before using any component, the manufacturer must either test it in-house or rely on a supplier’s certificate of analysis to confirm identity and verify that purity, strength, and composition specifications are met. For dietary ingredients specifically, at least one identity test must be conducted on each incoming component; a supplier’s COA alone will not satisfy that requirement.2eCFR. 21 CFR Part 111 – Current Good Manufacturing Practice in Manufacturing, Packaging, Labeling, or Holding Operations for Dietary Supplements
Who Runs the Tests and Signs Off
COAs are issued either by the manufacturer’s own quality control lab or by an independent third-party laboratory. Internal labs handle routine production monitoring. Third-party labs add independence because they have no financial stake in whether a batch passes. Most regulated industries expect both: internal testing during production, independent verification before release.
Laboratory Accreditation
Not every lab’s COA carries the same weight. The international benchmark for testing lab competence is ISO/IEC 17025, which sets requirements for impartiality, technical proficiency, and consistent operation. The FDA’s own laboratory quality policies are built around it.3U.S. Food and Drug Administration. Laboratory Manual of Quality Policies (ISO 17025 Requirements) Accreditation means an independent body has audited the lab and confirmed it meets those criteria. Results from an accredited lab are more widely accepted across borders and by regulators, and they reduce the need for retesting on the receiving end.
Hemp is a separate case. USDA requires that laboratories performing THC compliance testing be registered with the DEA.4eCFR. 7 CFR Part 990 Subpart C – USDA Hemp Production Plan That registration is independent of ISO accreditation, and running compliance tests through a non-registered lab can invalidate the results.
Signature Requirements
A COA has to be signed by someone with the authority to certify the data. What federal rules actually require is that signed records show the printed name of the signer, the date and time the signature was executed, and the meaning of the signature, whether that is review, approval, or authorship.5eCFR. 21 CFR Part 11 – Electronic Records; Electronic Signatures Pharmaceutical laboratory records go further and require two signatures: the analyst who ran the test and a second reviewer who confirms accuracy and compliance with standards.1eCFR. 21 CFR 211.194 – Laboratory Records
Reading the Numbers
The practical work with a COA is comparing the “Result” column against the “Specification” column, line by line. Specifications set the acceptable range, drawn from the manufacturer, a pharmacopeial standard, or a regulatory limit. Every result inside its specification means the batch passes. Any result outside means the batch fails and should not ship without further investigation.
Units track the type of measurement. Trace contaminants such as heavy metals or pesticide residues appear in parts per million (ppm) or parts per billion (ppb). Potency or assay figures usually appear as a percentage of the labeled amount. Two technical terms show up on almost every COA:
- Limit of Detection (LOD): the lowest concentration the instrument can reliably distinguish from background noise. A result reported as “below LOD” means the substance was not found at any detectable level.
- Limit of Quantitation (LOQ): the lowest concentration the instrument can measure with acceptable accuracy. A substance detected between the LOD and LOQ is present but cannot be measured precisely.
Measurement Uncertainty
Every analytical measurement carries some imprecision. Laboratories accredited to ISO/IEC 17025 estimate and report that imprecision, called measurement uncertainty, alongside their results. The standard practice is to calculate an expanded uncertainty by multiplying the combined standard uncertainty by a coverage factor that gives roughly 95% confidence.6National Institute of Standards and Technology (NIST). SOP 29 Standard Operating Procedure for the Assignment of Uncertainty This matters most when a result sits near a specification limit. A potency of 99.5% with an uncertainty of ±1.0% means the true value could be as low as 98.5%. If the floor is 99.0%, that is a passing result, but only barely.
USDA hemp regulations explicitly require laboratories to estimate and report measurement uncertainty with THC test results.4eCFR. 7 CFR Part 990 Subpart C – USDA Hemp Production Plan It is one of the few areas where a federal regulation specifically mandates uncertainty reporting on a COA, reflecting how much rides on the 0.3% THC boundary between legal hemp and an illegal crop.
Rules by Industry
Testing and documentation mandates vary by what you are making. The strictest rules apply to pharmaceuticals. Dietary supplements and hemp each have their own frameworks.
Dietary Supplements
Manufacturers who make, package, label, or hold dietary supplements follow the FDA’s Current Good Manufacturing Practice (cGMP) rules in 21 CFR Part 111. Written specifications are required for identity, purity, strength, and composition of every component. Before use, each component must be verified against those specifications through testing or by relying on a supplier’s COA. For dietary ingredients, at least one identity test must be run in-house.2eCFR. 21 CFR Part 111 – Current Good Manufacturing Practice in Manufacturing, Packaging, Labeling, or Holding Operations for Dietary Supplements Accepting a supplier’s COA at face value with no independent verification is one of the most common cGMP violations FDA investigators cite.
Pharmaceuticals
Drug manufacturers work under tighter rules. Every batch of a finished drug product needs a complete set of batch production and control records, and the laboratory records for each batch must document all testing performed to confirm identity, strength, quality, and purity. The regulations do not use the phrase “certificate of analysis”; they require detailed laboratory records. In practice, the COA is the document that distills those records into a shippable format. Every test entry needs the analyst’s signature and a second reviewer’s signature.1eCFR. 21 CFR 211.194 – Laboratory Records
Hemp
The 2018 Farm Bill removed hemp from the Controlled Substances Act’s definition of marijuana, defining hemp as cannabis with no more than 0.3% total THC on a dry weight basis.7U.S. Food and Drug Administration. Hemp Production and the 2018 Farm Bill – 07/25/2019 The USDA rules implementing that law require analytical testing for total THC using post-decarboxylation or similarly reliable methods, with results reported on a dry weight basis.4eCFR. 7 CFR Part 990 Subpart C – USDA Hemp Production Plan Laboratories must share both passing and failing results with the producer, the state or tribal regulator, and USDA’s Hemp eManagement Platform, and they must retain copies of compliance test results for three years from the date of analysis.8U.S. Department of Agriculture. Laboratory Testing Guidelines U.S. Domestic Hemp Production A result showing total THC above 0.3% is treated as conclusive evidence that the lot is over the legal threshold.
Imported Food
Importers bringing food into the United States face additional COA-related obligations under the FDA’s Foreign Supplier Verification Program (FSVP). Sampling and testing of imported food is recognized as an appropriate verification activity. When testing is the verification method, the importer must retain documentation showing the food tested (with lot number), the number of samples, the analytical methods used, the test dates, the results, any corrective actions taken, and the identity of the laboratory.9eCFR. Foreign Supplier Verification Programs for Food Importers If verification results show a hazard has not been adequately controlled, corrective action must be taken promptly. Importing product on the strength of a failing supplier COA is a fast path to regulatory trouble.
Electronic Signatures and Record Retention
Most COAs are now generated, signed, and transmitted electronically. For FDA-regulated industries, electronic signatures must comply with 21 CFR Part 11, which treats them as the legal equivalent of handwritten signatures when the following conditions are met:
- Each signature belongs to a single individual and cannot be reused or reassigned.5eCFR. 21 CFR Part 11 – Electronic Records; Electronic Signatures
- Non-biometric signatures use at least two distinct identification components, such as a user ID and password.
- The signature is bound to the record so it cannot be copied or moved to a different document.
- The organization has certified to the FDA that its electronic signatures are intended as the legally binding equivalent of handwritten signatures.
Password controls, loss-management procedures for compromised credentials, and safeguards against unauthorized access are all required alongside those conditions.5eCFR. 21 CFR Part 11 – Electronic Records; Electronic Signatures If the underlying system does not meet Part 11, an FDA investigator can question the integrity of every COA the system produced.
Retention periods vary. Dietary supplement manufacturers must keep records required by Part 111 for one year past the product’s shelf life date, or two years beyond distribution of the last batch associated with the records, whichever applies. Records must be readily available for FDA inspection and copying throughout that period.10eCFR. 21 CFR Part 111 Subpart P – Records and Recordkeeping Pharmaceutical batch production, control, and distribution records must be kept for at least one year after the batch’s expiration date; for certain OTC products exempt from expiration dating, the retention extends to three years after distribution.11eCFR. 21 CFR 211.180 – General Requirements Records can be kept as originals, true copies, or electronic records, provided electronic records meet Part 11.
What Happens When a COA Is Wrong or Missing
Penalties range from administrative problems to federal criminal charges, depending on the conduct.
At the lower end, shipping a product that does not conform to its specifications, or shipping without proper documentation, can render the product adulterated or misbranded under the Federal Food, Drug, and Cosmetic Act. Adulterated or misbranded products in interstate commerce are subject to seizure and condemnation in federal court.12Office of the Law Revision Counsel. 21 USC 334 – Seizure A first criminal offense carries up to one year of imprisonment and a $1,000 fine.13Office of the Law Revision Counsel. 21 USC 333 – Penalties
Fraud pushes the numbers up sharply. A second offense, or any violation committed with intent to defraud or mislead, carries up to three years and a $10,000 fine. Knowingly adulterating a drug in a way that creates a reasonable probability of serious health consequences or death carries up to 20 years and a $1,000,000 fine.13Office of the Law Revision Counsel. 21 USC 333 – Penalties
Fabricating COA data also triggers the general federal false statements statute, which makes it a crime to falsify records or make materially false statements in any matter within federal jurisdiction. That charge alone carries up to five years of imprisonment.14Office of the Law Revision Counsel. 18 USC 1001 – Statements or Entries Generally Companies caught fabricating test data have faced not just prosecution but permanent loss of FDA registration, which effectively ends the business.