The COA Blind Spot: Why Independent Raw Material Testing Protects Your Supplement Brand

Most supplement brands treat a supplier’s certificate of analysis as quality documentation. It isn’t. It’s sales documentation.

That’s a deliberately blunt framing, but it holds up under scrutiny. A supplier COA tells you what the supplier’s lab — or a contracted analytical testing laboratory the supplier hired — found on a single lot, at a point in time, using a method you probably haven’t audited. It doesn’t tell you whether that lot matches what’s sitting in your warehouse right now, whether the testing method was fit for purpose, or whether the lab that generated the values held ISO 17025 accreditation. For brands working with botanically derived raw materials, where identity fraud and heavy metal contamination are thoroughly documented problems, that distinction is the difference between a compliant product and an FDA warning letter.

What a Supplier COA Actually Guarantees

A COA is a record of a test result. The quality of that result depends entirely on: when the sample was collected (at origin, at a distributor’s warehouse, or somewhere in between?), which analytical method was applied, the accreditation status of the testing laboratory, and whether you’re looking at a lot-specific result or a specification pulled from a master template.

Lot-to-lot variability in botanical raw materials is significant and well-documented. Turmeric curcuminoid content can swing from 1% to 7% depending on cultivar, growing season, and post-harvest processing. Ashwagandha withanolide concentrations vary by 40% or more across sourcing regions. A COA showing “curcuminoids: 95% by HPLC” from a prior lot tells you very little about the lot currently on your receiving dock.

And that’s before you factor in intentional adulteration.

A 2013 DNA barcoding study published in BMC Medicine by researchers at the University of Guelph tested 44 herbal products from 12 companies. Approximately 59% contained species substitution, contamination with unlisted plant material, or the use of cheap fillers like rice, soybean, or wheat. Several products contained no detectable DNA from the labeled species whatsoever. That study used what is now standard methodology at serious analytical testing labs: DNA barcoding cross-referenced against authenticated botanical voucher specimens.

Your supplier’s COA almost certainly did not include DNA barcoding.

What 21 CFR Part 111 Actually Requires

FDA’s dietary supplement cGMP regulation (21 CFR Part 111, Subpart E) is unambiguous on this point. Under §111.75(a)(1), manufacturers must “conduct at least one appropriate test or examination to verify the identity of any component that is a dietary ingredient.” The rule does not allow you to rely solely on a supplier’s COA for identity verification.

§111.75(c) does permit reliance on a COA — but only if you have formally established the reliability of that supplier’s COAs through documented means such as periodic onsite audits, and only if you still conduct identity testing on each received lot yourself. In plain language: even with a fully qualified supplier and a signed quality agreement, you still test each lot for identity. That’s not a best practice. It’s the regulatory minimum.

FDA warning letters over the past five-plus years have consistently cited §111.75(a)(1) violations as a primary finding. A substantial portion of those cases involved manufacturers who had supplier COAs on file — they just hadn’t conducted their own incoming identity testing. The COA gave them a false sense of compliance.

Beyond identity, Part 111 also requires you to test against the specifications you’ve established for each component in your master manufacturing record. For botanical raw materials, that typically means covering heavy metals by ICP-MS, microbial limits under USP <61>/<62>, and active marker compounds by HPLC or another validated method.

Four Tests That Should Be Non-Negotiable for Botanical Incoming Materials

1. Botanical Identity — HPTLC + DNA Barcoding

High-performance thin-layer chromatography (HPTLC) provides a visual phytochemical fingerprint of the raw material, compared against authenticated reference standards. It’s fast, relatively cost-effective, and well-validated across dozens of common botanicals — echinacea, valerian, ginkgo, ashwagandha, milk thistle, and many others.

But HPTLC has real limits. It won’t reliably distinguish between closely related species or detect adulteration where the adulterant’s chromatographic profile overlaps substantially with the authentic material. That’s where DNA barcoding adds genuine value. Sequencing the ITS2 or rbcL genetic regions and matching the results against curated reference databases allows species-level identification with high specificity, even in dried and powdered materials where morphological identification is impossible.

The two methods are complementary, not redundant. HPTLC confirms chemistry; DNA barcoding confirms species identity. Using both closes the detection gap that adulteration strategies are specifically designed to exploit.

2. Heavy Metals by ICP-MS (USP <232>/<233>)

Inductively coupled plasma mass spectrometry is the only analytical method that gives you accurate multi-element quantification at parts-per-billion concentrations. It’s the procedure referenced in USP <233> and cited in FDA’s own guidance on elemental impurities.

Botanical raw materials — particularly those sourced from South Asia, India, and parts of China — carry well-documented elevated risk for lead, cadmium, arsenic, and mercury. Soil contamination and traditional agricultural practices are the primary drivers. Lead levels in certain Ayurvedic herbal materials have been measured above 100 µg/g in published analyses. The USP <2232> action limit for lead in botanical dietary supplement ingredients is 10 µg/g. The gap between what can arrive in a shipment and what’s permissible in a finished product is not theoretical.

For brands selling into retail channels where third-party audits are routine, running ICP-MS on every incoming botanical lot is not optional — it’s table stakes.

3. Microbiology — USP <61>/<62>

USP <61> provides enumeration procedures for total aerobic count (TAC) and total combined yeast and mold count (TYMC). USP <62> covers specified pathogen testing: Salmonella spp., Staphylococcus aureus, E. coli, and Pseudomonas aeruginosa, among others.

Botanical raw materials are unusually susceptible to microbial contamination across the field-to-warehouse supply chain. A 50 kg bag of dried root that spent weeks in transit through humid conditions may arrive with counts that push against or exceed USP limits for your finished product category. A supplier COA generated at the point of origin won’t reflect what happened in a shipping container off the Gulf Coast in August.

If your formula targets an immunocompromised population, aging consumers, or children, there is no defensible reason to skip microbial limits testing on incoming raw materials.

4. Potency and Active Marker Compounds

For standardized botanical extracts carrying explicit potency claims — “standardized to 5% withanolides,” “containing 95% curcuminoids,” “10:1 extract ratio” — incoming testing must verify the marker compound content against your stated specification. HPLC is standard for most alkaloids, glycosides, and polyphenolics. UV-Vis can be appropriate for simpler chromophore systems when properly validated.

If you’re accepting a supplier COA as verification for a potency claim you’re putting on a finished product label, you’re making a claim you cannot fully defend. That carries both FDA and FTC exposure.

Building a Practical Incoming Testing Program for Midwest Brands

The logistics barrier is real. Adding a round of analytical testing laboratory fees to every incoming lot increases cost per batch and adds days to your production timeline. Here’s how brands in the Chicago area can make the math work without cutting corners.

Tier your testing by risk. A 500 lb lot of magnesium oxide from a long-qualified domestic supplier doesn’t warrant the same panel as a 50 kg lot of standardized botanical extract arriving from a new overseas source for the first time. Build a risk matrix based on ingredient category, supplier qualification status, geographical origin, and historical testing data. Reserve your full four-test panel for high-risk botanicals and new supplier qualification. Use a streamlined identity + microbial screen for established, low-risk materials.

Use regional receiving hubs to cut turnaround time. Shipping samples cross-country from the Midwest to reach a lab in California or New Jersey adds 3–5 days before testing even starts. Our Countryside, IL receiving facility accepts samples from Chicago-area brands directly — drop-off or shipped — and we route them to our ISO 17025-accredited analytical testing laboratory on the West Coast. The resulting CoA comes back in 5–7 business days from the date of sample receipt. For brands in the Chicago metro, DuPage County, or northern Indiana, that’s a meaningful logistical advantage.

Execute and document quality agreements with every botanical supplier. A signed quality agreement doesn’t eliminate your incoming testing obligation under Part 111, but it establishes shared expectations: COA format, method references, required testing scope, out-of-spec notification timelines, and retain sample requirements. A supplier who won’t sign a basic quality agreement is showing you something about how they operate.

Retain incoming samples. Keep a retain from each incoming lot for at least 1 year beyond the expiration date of the finished product in which that lot was used. FDA inspectors can request material from specific lots during an inspection. Consumer complaints can surface 18 months after purchase. Having the ability to retest is inexpensive insurance.

---

The actual risk of skipping these steps isn’t hypothetical. FDA’s Office of Criminal Investigations has pursued cases against supplement manufacturers where incoming testing failures — failing to verify identity, failing to screen for heavy metals — allowed adulterated materials to reach finished products and ultimately consumers. The consent decrees and reputational damage in those cases ran into the millions. The testing that would have caught the problem cost a few hundred dollars per lot.

A supplier’s COA is a starting point. Treat it as one data point in a larger incoming quality system — not as the system itself.

---

Written by Nour Abochama, VP Operations, Qalitex | Quality Consultant, Ayah Labs. Learn more about our team

Ship your sample to our Chicago facility — get a Qalitex CoA in 5–7 days. Contact us

Related from our network

• Botanical Identity and Adulteration Testing at Qalitex Laboratories — HPTLC, DNA barcoding, ICP-MS, and full USP microbiology panels under ISO 17025 accreditation for US supplement brands.