What Is a Certificate of Analysis (COA)?
A Certificate of Analysis (COA) is a formal, data-rich report issued by an analytical testing laboratory that documents the results of specific tests performed on a product sample. If you have ever wondered how to read a COA without getting lost in chemical terminology, this guide is written for you. Understanding a COA matters because it is one of the few independently verifiable tools that connects what a brand claims on a label to what a laboratory actually measured. In the pages below, you will learn to decode every section of a COA, interpret analytical methods, verify lab credibility, and spot the red flags that separate transparent products from marketing noise.
Key Takeaways
- A COA is a laboratory-generated document that reports what was tested, how it was tested, and what the results were for a specific batch or lot.
- The header identifies the product, batch/lot number, testing lab, dates, and method references — all of which must align with the product in your hand.
- The results table uses units (mg/g, %, ppm, CFU/g) that mean different things; confusing them is one of the most common consumer errors.
- "ND" (Not Detected) and "
- Purity and identity are different measurements: purity tells you how much of the target compound is present; identity confirms that the compound is what it claims to be.
- ISO 17025 accreditation is the strongest single indicator of a credible testing lab, but accreditation scope matters.
- Every credible COA can be verified directly with the issuing lab via lot lookup, QR code, or direct contact.
- Red flags include missing lot numbers, vague methods, inconsistent results, reused certificates, and no way to contact the lab.
- COAs do not guarantee product safety on their own — they are one part of a broader quality-control system.
- Consumers should always cross-check the COA against the physical product label, including concentration, form, and serving size.
Why COAs Matter for Product Safety and Transparency
In regulated industries — pharmaceuticals, food, cosmetics, dietary supplements — a COA functions as the paper trail of quality assurance. It is the documentation that tells a manufacturer, retailer, or consumer what was measured on a given batch of product and confirms whether those measurements met predetermined specifications.
For consumers, the value of a COA comes down to three things:
- Verification: It lets you confirm that a product actually contains the active compound at the labeled concentration.
- Safety screening: Contaminant testing (heavy metals, microbials, pesticides, residual solvents) provides evidence that the product was screened for common hazards.
- Accountability: A verifiable COA makes it harder for brands to substitute ingredients, under-dose, or exaggerate claims.
For manufacturers and retailers, COAs support regulatory compliance. In the US, for example, the FDA requires dietary supplement manufacturers to establish identity, purity, strength, and composition under 21 CFR Part 111. In the EU, similar requirements are reflected in food supplement directives. COAs are the practical evidence used to demonstrate this due diligence.
That said, transparency is not the same as proof of safety. A COA confirms that specific tests were performed and passed against specific specifications on a specific sample. It does not evaluate long-term safety, interaction risks, or suitability for a given individual. Reading a COA well means understanding what it does — and does not — tell you.
Key Entities in a COA: Who, What, When, and Where
The top of every COA — the header — should immediately answer four questions: who tested the product, what was tested, when it was tested, and under what conditions. If any of these elements is missing, the document loses traceability.
Product Name and Description
The product name must match the product you are holding. Watch for generic descriptors ("Herbal Extract Powder") versus specific ones ("Organic Valerian Root Extract 4:1, Lot #xxxx"). Brands sometimes publish a COA for a raw ingredient while selling a finished product that contains it — these are not equivalent.
Batch or Lot Number
The batch number (or lot number) is the single most important identifier on the document. Every physical unit of product from that batch should be traceable to this number. Without a lot number, a COA is not product-specific — it is essentially a generic or historical test report.
A well-formatted lot number typically contains a date or manufacturing code (e.g., "VITC-20260214-A"). If the lot number on the COA does not exactly match the lot number printed on the product packaging, the COA does not apply to that product.
Manufacturer and Testing Laboratory Details
The COA should identify both the manufacturer (or client who submitted the sample) and the testing laboratory. Look for:
- Full legal name of the lab
- Physical address (not just a PO box)
- Contact information — phone, email, or a lab website with a verification portal
- Accreditation logos and numbers (e.g., ISO 17025)
A COA without a verifiable lab identity is not useful — you cannot confirm that the lab exists, is independent, or actually produced the report.
Dates: Report Date, Sample Receipt, and Analysis Date
Good COAs usually list several dates:
- Sample receipt date: When the lab received the sample
- Analysis or test date: When the testing was performed
- Report or issue date: When the COA was finalized
- Expiration or retest date (sometimes): When the results would need to be reconfirmed
Older COAs can still be valid, but their relevance depends on the product's shelf life and stability. A COA dated two years ago for a product with a six-month shelf life is no longer meaningful.
Sample and Specification Reference
Some COAs include a "Specification Sheet" reference or "Acceptance Criteria" column. This tells you what the limits for each test were before the analysis began. Example: "Assay: 98.0% – 102.0%." Without this column, you cannot always tell whether a result was "good" — only what the number is.
Decoding the Analytical Results Table
The results table is the heart of the COA and where most readers lose confidence. It is also where clear interpretation matters most. Every row usually has four components: the parameter tested, the method used, the specification (acceptance criteria), and the result.
The Structure of a Standard COA Table
| Parameter | Method | Specification | Result | Status |
|---|---|---|---|---|
| Identification (HPLC retention time) | HPLC-UV | Matches standard | Conforms | Pass |
| Assay (Purity) | HPLC-UV | ≥ 98.0% | 99.2% | Pass |
| Heavy Metals (as Pb) | ICP-MS | ≤ 10 ppm | < 1 ppm | Pass |
| Lead | ICP-MS | ≤ 3 ppm | ND (< 0.05 ppm) | Pass |
| Total Aerobic Microbial Count | USP <61> | ≤ 10³ CFU/g | < 100 CFU/g | Pass |
| E. coli | USP <62> | Absent | Absent | Pass |
Purity Percentage vs. Identity Confirmation
These two concepts are frequently confused, and the misunderstanding has real consequences.
- Identity confirmation answers: "Is this the correct substance?" It usually involves comparing a sample to a certified reference standard using a method like HPLC retention time, LC-MS mass signature, or FTIR spectroscopy.
- Purity percentage answers: "How much of the sample is the target compound?" It is expressed as a percentage of the total measured content.
A product can be 99% pure of the wrong compound. Identity and purity must both be confirmed to trust a COA.
Understanding "ND," "<LOQ," and "Pass/Fail"
- ND (Not Detected): The compound was not detected at or above the method's detection limit.
- <LOQ (Below Limit of Quantification): The compound may be present, but it is below the concentration the method can reliably quantify.
- <LOD (Below Limit of Detection): Similar to LOQ but describes the lowest concentration at which the method can identify a signal.
- Pass: The result is within the specification. This depends on the specification — a "Pass" for a broad spec may not mean much.
"ND" does not mean the sample is guaranteed free of a contaminant. It means the analytical method, at its sensitivity, could not detect it.
Units Matter: mg/g, %, ppm, CFU/g
One of the most common consumer errors is misreading units. For example:
- 10 mg/g equals 1% (because 1 g = 1,000 mg)
- 1 ppm = 1 mg/kg = 0.0001%
- 1,000 CFU/g = 10³ CFU/g
If a COA lists a "purity of 10 mg/g" but the label claims 10%, the product is ten times weaker than the label. Always compare units before comparing numbers.
Understanding Analytical Methods: HPLC, LC-MS, and More
The "Method" column on a COA tells you how each result was generated. Knowing the strengths and limitations of each method makes you a sharper reader.
HPLC (High-Performance Liquid Chromatography)
HPLC separates the components of a sample as they travel through a column and are detected at specific wavelengths. It is the most common technique for measuring the concentration of cannabinoids, vitamins, and many active compounds. It is reliable and reproducible, but a standard HPLC-UV assay can sometimes confuse molecules with very similar structures — which is why identity confirmation usually relies on additional methods.
LC-MS and GC-MS (Mass Spectrometry)
Mass spectrometry adds a mass-based confirmation step. LC-MS (Liquid Chromatography–Mass Spectrometry) combines separation with mass analysis, confirming that the target compound's molecular weight matches. GC-MS (Gas Chromatography–Mass Spectrometry) is used for volatile compounds and residual solvents. Together, these techniques confirm identity with higher confidence than chromatography alone.
ICP-MS (Inductively Coupled Plasma Mass Spectrometry)
ICP-MS is the gold standard for heavy-metal analysis. It can quantify arsenic, lead, cadmium, and mercury at parts-per-billion levels. When a COA shows heavy metals as "<1 ppm," ICP-MS is usually the underlying method.
Microbiological Methods (USP <61>, <62>, <63>)
Microbial screening uses standardized methods including total aerobic microbial count, yeast and mold count, and specific pathogen testing (E. coli, Salmonella, Staphylococcus aureus, Pseudomonas aeruginosa). Referencing USP chapters tells you the lab followed recognized pharmacopeial protocols.
Why Method Choice Matters
A result is only as trustworthy as the method behind it. A "purity" claim measured with a cheap, non-specific assay is weaker than one confirmed with HPLC plus LC-MS. When reading a COA, look for specificity, sensitivity (LOD/LOQ), and reference-standard calibration.
Safety Tests and Contaminant Limits
Purity is not the only concern. A genuinely well-rounded COA includes contaminant testing. What follows are the standard safety categories and how to interpret them.
Heavy Metals
Tests measure lead, cadmium, arsenic, and mercury. Typical limits vary by industry and jurisdiction; common dietary-supplement thresholds are in the single-digit ppm range. Look for individual metal results, not a single "heavy metals" line — a total number hides which metal is present.
Pesticides and Herbicides
Pesticide panels usually test for dozens or hundreds of compounds. A "Pass" is only meaningful if the panel is comprehensive and the LOQ is low enough to be protective.
Microbial Screening
Standard tests include total aerobic count, yeast/mold count, and absent/present testing for pathogens. For topical or inhaled products, additional microbial tests may be required.
Residual Solvents
Solvent residuals (ethanol, hexane, acetone, isopropyl alcohol) are measured against ICH Q3C or USP <467> thresholds. Products produced through extraction processes should always report residual solvent data.
Mycotoxins and Other Specialized Tests
Aflatoxins, ochratoxin A, and other mycotoxins are relevant for botanical ingredients. Not every COA will include these — their absence is not a red flag for all industries, but the question "was this tested?" is always a fair one.
Verifying Lab Credibility: ISO 17025 and More
If the lab is not credible, the results are not credible. The single most reliable indicator of independent laboratory quality is ISO/IEC 17025 accreditation. This international standard specifies the general requirements for the competence of testing and calibration laboratories.
What ISO 17025 Actually Means
Accreditation under ISO 17025 confirms that a lab has demonstrated:
- Appropriate technical competence for the specific tests within its scope
- Validated analytical methods
- Reliable equipment calibration and maintenance
- Documented quality management systems
- Ongoing proficiency testing
Importantly, accreditation is scope-specific. A lab may be accredited for microbial testing but not for heavy metals. A credible COA indicates which tests were performed within the accredited scope — ideally with an accreditation body logo (e.g., A2LA, PJLA, UKAS, IAS) and scope number.
Third-Party Testing and Independence
Broadly speaking, there are two testing models:
- In-house testing: Performed by the manufacturer's own lab. Useful for process control but less independent.
- Third-party testing: Performed by an external lab with no financial stake in the product's outcome.
For consumer-facing confidence, third-party COAs are strongly preferred. The best brands use third-party labs and publish results openly — including failures, not only passes.
Red Flags in Lab Credibility
- Accreditation logos shown but no scope number
- Labs that list the brand as the testing facility (in-house testing presented as independent)
- Lab names that cannot be found in independent accreditation databases
- Generic tests with no method reference
Step-by-Step: How to Verify a COA with the Issuing Lab
Verification is where many consumers stop — and where transparency either proves itself or falls apart. Every authentic COA should be verifiable.
Step 1: Locate the COA on the Product Page
Reputable brands display COAs on the product page, in a dedicated "Lab Results" section, or through a QR code printed on the packaging. Scanning the QR code should lead directly to the specific COA for that lot number — not to the brand homepage.
Step 2: Match Lot Numbers
Locate the lot number on the physical product. It is usually printed near the expiration date or on the base of the container. It should be an exact character-for-character match with the lot number on the COA.
Step 3: Use the Lab's Verification Portal
Most accredited labs provide an online verification tool where you can enter the report number, lot number, or scan a QR code. This confirms that the lab issued the document.
Step 4: Contact the Lab Directly
If no portal exists, contact the lab via the email or phone number listed on the COA. Ask them to confirm the report number and the product tested. A legitimate lab will confirm authenticity.
Step 5: Look for Tamper Indicators
Authentic reports often include signature blocks, watermarks, unique report numbers, and digital seals. If a COA looks like a screenshot from a design program rather than a generated PDF from a LIMS system, extra caution is warranted.
The Fine Print: Uncertainty of Measurement, LOD, and LOQ
Analytical measurements are not absolute truths. They carry uncertainty, and understanding this helps you interpret results more honestly.
Uncertainty of Measurement
Every result has an associated uncertainty (often ± a small percentage). A result of 99.2% purity might have an expanded uncertainty of ± 1.0%, meaning the "true" value is plausibly between 98.2% and 100.2%. ISO 17025-accredited labs are expected to estimate uncertainty appropriately.
LOD and LOQ Explained
- Limit of Detection (LOD): The lowest concentration at which the method can reliably distinguish signal from background.
- Limit of Quantification (LOQ): The lowest concentration at which the method can reliably quantify a compound's amount.
When a COA reads "Lead: <0.05 ppm (LOD)," it is saying "we could not detect lead at or above 0.05 ppm with this method." A more sensitive method might detect lead at 0.005 ppm. Detection limits are a methodological statement, not a claim of absence.
Debunking Common COA Myths
"Purity can be over 100%."
Purity percentages are capped at 100% by definition. Reports that show 102% or 105% are usually showing a recovery-based assay against a reference standard — not a purity figure above 100%. Read the parameter name carefully: "Assay" and "Purity" are not always used interchangeably.
"If it passes, it must be safe."
A COA confirms specific measured values against specific acceptance criteria. It does not confirm long-term safety, product-specific suitability, or absence of all contaminants.
"All COAs are the same as a Certificate of Compliance."
A Certificate of Compliance (CoC) states that a product meets a specific standard or regulatory requirement — often without data. A COA contains the actual analytical results. A CoC is a claim; a COA is a measurement.
"A COA proves the brand tested every batch."
Some brands publish a single COA and apply it to every future batch. Always check the report date and lot number.
Product Label vs. COA: A Detailed Comparison
The COA must be consistent with the physical product. Here is how to compare them systematically:
- Compound name: Match the chemical or botanical name exactly — not just the marketing name.
- Concentration: Convert everything to the same unit (mg/g or %) before comparing. A label claiming "500 mg per capsule" needs to be compared against the COA's per-unit measurements.
- Form: A COA for a free-base compound does not verify a salt or derivative form.
- Serving size: If the label claims 30 servings per bottle, check that the COA reflects per-gram or per-unit content accordingly.
- Plant part and origin: Botanical COAs may list the part used (root, leaf, aerial parts) and region of origin.
- Lot number: If it does not match, the COA is not for your product.
If you use multivitamin products, for example, your COA should list each active nutrient at its labeled concentration — not just total "vitamin content." Similarly, a single-nutrient vitamin D supplement should show a specific assay (e.g., cholecalciferol or ergocalciferol) and a measured IU or µg quantity. For products where chelated minerals matter, the COA for magnesium should specify the elemental content and the compound form (e.g., magnesium glycinate, citrate, or oxide).
Industry-Specific Considerations: CBD, Peptides, Pet Products, and Supplements
Cannabinoid COAs (CBD, CBG, THC)
CBD COAs typically include a cannabinoid profile (potency) and safety panel. Look for individual cannabinoid values — CBD, CBG, CBN, THC, THCA — and confirm that total THC is within legal limits for the local jurisdiction. A "0.0% THC" claim should be backed by a clearly stated LOQ. A full panel should include heavy metals, pesticides, microbials, and residual solvents.
Peptide COAs
Peptide purity claims (e.g., "≥99% purity") should be supported by HPLC chromatograms and, ideally, mass confirmation. Identity matters most here — distinguishing one peptide from a closely related analog requires LC-MS. Look for:
- HPLC purity chromatogram
- Mass spectrometry confirmation (observed vs. theoretical mass)
- Water content and counter-ion data (trifluoroacetate is common)
Pet Product COAs
Pet supplement and CBD-for-pets COAs should confirm species appropriateness, exclude ingredients toxic to animals (e.g., xylitol, certain essential oils), and include contaminant screening. Pet product regulations vary widely — verification of lot number and lab independence is essential.
Dietary Supplement COAs
Supplement COAs should align with USP or equivalent monographs where applicable, and demonstrate identity, potency, contaminant, and, where relevant, dissolution or disintegration data.
Common Consumer Errors When Reading COAs
- Comparing numbers with different units (e.g., mg/g vs. %).
- Confusing purity with identity — assuming a "99% pure" claim confirms the compound is what it says it is.
- Treating "ND" as absolute absence rather than as a method-dependent result.
- Ignoring lot numbers and treating any COA as applying to any unit of the product.
- Overweighting a single test while ignoring missing contaminant panels.
- Missing accreditation scope details — assuming all listed tests were performed under ISO 17025 scope.
- Reading only the "Pass" column without checking what the specification was.
- Assuming all brands publish every batch's COA when many publish a single historical report.
Common Red Flags and How to Spot Them
A COA can look polished and still be unverifiable. The red flags below deserve close attention.
Missing Information
- No lot or batch number
- No lab name, address, or contact information
- No report date
- No method references
- No signatures or report number
Inconsistencies
- Product name or lot number on the COA does not match the physical product
- Label claim (e.g., 20 mg per serving) does not match the COA (e.g., 2 mg per gram)
- Confusing units (mg vs. µg, % vs. mg/g)
- Different fonts or formatting suggesting partial editing
Unrealistic or Suspicious Results
- Purity claims reported above 100%
- "Zero" values reported for every contaminant without LOQ references
- No uncertainty values or detection limits anywhere on the report
Document Reuse
- The same COA used across multiple lots or products
- Same report date for many months of sales
- Identical results across batches — real analytical data varies
Unverifiable Lab
- Lab cannot be located in databases
- No portal, no contact, no report number
- Accreditation badge displayed but no scope number
Putting It All Together: A Practical Checklist
Use this checklist every time you evaluate a COA. It applies whether you are reviewing CBD, peptides, supplements, pet products, or botanicals.
- Does the product name match the product in your hand?
- Does the lot number on the COA exactly match the lot number on the packaging?
- Is the report date recent relative to the product's shelf life?
- Is the testing lab independently identifiable (name, address, contact)?
- Does the lab show ISO 17025 accreditation with a scope number?
- Are the methods listed (HPLC, LC-MS, ICP-MS, USP <61>, etc.)?
- Are identity and purity both tested?
- Are heavy metals, microbials, pesticides, and residual solvents included where relevant?
- Are results reported with units, specifications, and LOQ/LOD?
- Have you verified the COA with the issuing lab directly?
- Have you cross-checked the label's claimed concentration and form against the COA data?
- Are there any signs of document editing, reuse, or missing sections?
Frequently Asked Questions About Reading a COA
What is a Certificate of Analysis?
A Certificate of Analysis is a formal report from a laboratory that documents the identity, purity, potency, and/or safety of a product sample. It lists the tests performed, the methods used, the specifications that applied, and the measured results for a specific batch or lot.
How do I find the batch or lot number on a COA?
The lot number is typically in the header or near the sample information section, labeled "Lot," "Batch," or "Lot #." Compare it to the number printed on the physical product (usually near the expiration date or at the base of the container). If they do not match, the COA does not apply to your product.
What does "ND" mean on a COA?
ND stands for "Not Detected." It means the analytical method used could not detect the compound at or above its detection limit. ND is not equivalent to absolute absence — it reflects the sensitivity of the method.
What is the difference between purity and identity?
Identity confirms that a compound is what it claims to be (e.g., through mass spectrometry or reference-standard comparison). Purity describes how much of the sample consists of that compound. A product can be pure but still be the wrong compound — which is why both matter.
Can a COA be faked? How do I verify one?
Yes, COAs can be falsified or edited. Verify authenticity by contacting the issuing lab directly, using the lab's online verification portal, checking the report number, and confirming the lot number matches. Reputable labs will confirm their own reports on request.
How often are COAs updated?
Credible brands update COAs per batch or lot. If a product is sold continuously and the COA has not changed in over a year, it may reflect an older batch rather than the current one. Ask the brand whether a new COA exists for the current lot.
What is a passing purity percentage?
The "passing" threshold depends on the product category and its specification sheet. Pharmaceuticals often require ≥98–99% purity for reference standards, while dietary supplements and botanicals may have different acceptance criteria. What matters is that the specification is disclosed on the COA.
Why is a COA different from a certificate of compliance?
A certificate of compliance (CoC) is a statement that a product meets a specific standard, often without analytical data. A COA contains the actual measured results. A CoC is a declaration; a COA is evidence.
Does a COA prove a product is safe?
No. A COA confirms that specific tests were performed and that results met specific specifications. It does not evaluate long-term safety, drug interactions, or suitability for an individual user.
What does ISO 17025 mean on a COA?
ISO/IEC 17025 is the international standard for testing and calibration laboratory competence. Labs accredited to this standard have demonstrated technical proficiency, validated methods, and robust quality systems for the specific tests within their accredited scope.
Why do some COAs show purity above 100%?
These figures are usually "assay" values (recovery against a reference standard), not true purity percentages. True purity cannot exceed 100%. Read the parameter label carefully to distinguish assay recovery from purity.
Can I request a COA directly from a manufacturer?
Yes. You can contact any reputable brand and ask for the COA for a specific lot number. A brand that cannot or will not provide one for the lot you received is a transparency red flag.
Conclusion: Reading a COA With Confidence
A COA is not a marketing document — it is a technical one. Reading it well means matching lot numbers, understanding methods, verifying lab credibility, and interpreting units and detection limits honestly. No single line on a COA guarantees safety or quality, but the combination of identity testing, purity assays, contaminant screening, ISO 17025-accredited methods, and direct lab verification provides meaningful evidence.
Use this guide as a working checklist. When in doubt, verify the report directly with the lab, and always cross-check what you read against what the product label claims. Transparency is a choice brands make — and a COA that can be verified is one of the clearest signals of that choice. Readers interested in how quality assurance intersects with everyday nutrition may find broader context in Topvitamine's guides on vitamin C and vitamin K, both of which benefit from the same transparency standards discussed here.
Keywords
how to read a COA, certificate of analysis, read a COA, COA explained, COA verification, COA interpretation, lab test report, cannabinoid profile, peptide purity, HPLC purity, LC-MS identity, ISO 17025, certified lab, batch number, lot number, contaminant testing, heavy metals analysis, microbial screening, solvent residual analysis, potency testing, purity percentage, identity confirmation, quality control, third-party lab, COA red flags, product label matching, QR code on COA, COA lookup, analytical method, detection limit (LOD), quantification limit (LOQ), test report date, expiration date, product compliance
