CoA Red Flags: What Analytical Testing Labs Look for When a Supplier's Certificate Doesn't Add Up

One of the more reliable warning signs we see in raw material receiving is a CoA where every heavy metal result sits at exactly the instrument reporting limit. Lead: <0.01 mg/kg. Arsenic: <0.01 mg/kg. Cadmium: <0.01 mg/kg. Mercury: <0.01 mg/kg. Four separate elements, four identical values — on a turmeric root powder sourced from South Asia, a region where agricultural soil lead concentrations routinely measure 5–15 mg/kg in conventional farming zones.

Real ICP-MS runs don’t produce four simultaneous reporting-limit results on a heavy-metal-accumulating botanical matrix. Instrument variance alone prevents it. This doesn’t automatically mean fraud — it might be stock data applied to a new lot, a reporting template populated with placeholder values that never got replaced, or a supplier who outsourced testing and didn’t understand the results they received back. But all of those explanations are problems. And each one is something a good analytical testing laboratory should catch before your brand’s name goes on the label.

The Anatomy of a Suspicious CoA

A well-constructed Certificate of Analysis from an ISO 17025-accredited lab contains information that most purchasing managers scan and file. That’s exactly what suppliers who cut corners count on.

The most telling pattern is what we call “dead column” syndrome: numerical columns where every result is identical across multiple analytes, all landing at the reporting limit or on a whole number. Real ICP-MS data has variance. An instrument scanning lead, arsenic, cadmium, and mercury in a plant matrix will return different decimal tails on each element because the physics of the measurement differ by element, and matrix interference effects don’t cancel uniformly.

Microbiology results can show the same pattern. A total aerobic count of exactly <10 CFU/g alongside a yeast-and-mold count of <10 CFU/g, E. coli absent, Salmonella absent, and Staph <10 CFU/g — all on the same document, all at the same round limit — is statistically improbable for an unprocessed botanical powder. Unprocessed botanicals are not sterile environments.

Other red flags worth building into your incoming CoA review:

• “ND” with no LOD/LOQ stated. “Not Detected” means nothing without a detection limit. ND at 0.5 µg/kg for aflatoxin B1 satisfies the EU Regulation 1881/2006 limit of 2 µg/kg for most herbal foodstuffs. ND at 10 µg/kg doesn’t. An incomplete result is an unusable result.
• Method column reading “USP” without a chapter number. Was this USP <232>, <233>, or <561>? The chapter dictates the method, the element list, and the acceptance criteria. “Tested per USP” is not a method citation.
• CoA dates that predate the stated batch manufacturing date. This happens more often than most brands realize, and it’s a reliable indicator that the document wasn’t generated from the lot it accompanies.
• Results that land exactly on a specification limit. When your purchase order specifies lead ≤3.0 µg/day per USP <232> oral category limits, and the supplier’s CoA returns exactly 3.000 µg/day — that number was written, not measured.
• Identical data across multiple lot numbers. Pull CoAs from three consecutive lots of the same ingredient from the same supplier. If heavy metals, microbial counts, and identity markers match to two decimal places across all three lots, you’re looking at a single testing event being reused as documentation across batches.

How Analytical Testing Laboratories Actually Verify Incoming Material

Reading the CoA is step one. Step two is running the material.

At our Countryside, IL receiving hub, incoming raw materials are logged, photographed, and quarantined before any release decision is made. The supplier’s CoA accompanies the sample through the process — but it functions as a comparison document, not a release document. That distinction matters for both regulatory compliance and practical quality.

Botanical identity verification typically starts with macroscopic and organoleptic review: does the material look, smell, and feel consistent with the declared species? Experienced botanical quality staff catch adulteration at this stage more often than the industry acknowledges. A bag of “elderberry powder” with a faint raisin-like sweetness, or a “turmeric extract” that fluoresces more orange than yellow under UV light, are observable signals before a single analytical run begins.

HPTLC (High-Performance Thin-Layer Chromatography) follows, confirming botanical identity against a certified reference standard. DNA barcoding adds a second orthogonal method for species confirmation — particularly important for processed or extracted materials where the HPTLC fingerprint may be degraded by extraction temperatures or solvent treatment.

Heavy metals verification via ICP-MS under USP <233> runs in parallel with microbial limit testing under USP <61> and <62>. When results come back, we compare them against the supplier’s stated values. A deviation of more than 30% on any element — particularly lead or arsenic in a high-accumulation botanical like ashwagandha, turmeric, or rice-based excipients — triggers a quarantine flag. The material stays on hold while we request the supplier’s raw instrument data, review their QC records, and make a disposition decision.

Compliant material is released with a Qalitex ISO 17025 CoA attached. Non-compliant material gets rejected with documentation that protects your brand in the event of an FDA inspection or a third-party retailer audit.

What 21 CFR Part 111 Actually Requires — and Why a Supplier CoA Alone Won’t Satisfy It

Here’s a clause that surprises more supplement brands than it should: under 21 CFR Part 111.75(a)(1), if a dietary ingredient is an herbal ingredient, you must conduct at least one appropriate identity test on every incoming lot, regardless of what documentation the supplier provides. You cannot satisfy this requirement by accepting the supplier’s CoA and filing it. The regulation requires you — or your contract testing partner — to actually run the test.

FDA has cited this gap directly in Warning Letters to supplement manufacturers. The language in those letters is consistent: “failed to establish the identity of dietary ingredients.” The root cause, almost every time, is a quality team that assumed supplier documentation was a substitute for verification testing.

There is a provision under 21 CFR 111.75(a)(2) that allows reduced testing frequency once you’ve established a supplier qualification program with a documented track record — but the baseline before any reduction is 100% lot-by-lot testing, not CoA review. Brands that skip the qualification process and go straight to reduced testing are exposed, and FDA’s inspection approach to cGMP compliance has grown considerably more targeted in recent years.

For Midwest supplement brands working with imported botanical ingredients — which describes most brands in the Chicago area that source from South Asian or Chinese supply chains — this creates a documentation obligation that’s easy to underestimate. Three years of batch records, identity testing results, and lot disposition decisions need to be on file and retrievable within 24 hours of an FDA inspector’s request.

When the Numbers Don’t Match: A Decision Framework

Suppose you’ve received a raw material, reviewed the CoA, run your incoming tests, and the results don’t reconcile. Your ICP-MS shows lead at 4.2 µg/g where the supplier’s CoA states <0.5 µg/g. Here’s what happens next.

First: quarantine. Nothing leaves the receiving hold area until the discrepancy is resolved. Document the date, the specific analytes that deviated, and the magnitude of the deviation. This documentation becomes your protection.

Second: request the supplier’s raw instrument data. Not their CoA — their raw instrument printout, including QC samples, blanks, and calibration standards for the original run. A legitimate ISO 17025-accredited laboratory will provide this within 48 hours. A supplier who cannot or will not provide raw instrument data is telling you something important about how that CoA was generated.

Third: evaluate the deviation against your specification. A 30% variance on a trace element that still clears your acceptance limit is a different situation than a result three times over threshold. Document the evaluation and the rationale, whatever the outcome. Your batch record needs to show that a trained person reviewed this and made a deliberate decision.

Finally: disposition and supplier action. If the material exceeds specification, it’s rejected. The economic pressure to release a borderline lot is real — but the liability exposure from a non-compliant release is not a trade-off worth making. And if this is the second discrepancy from the same supplier in 24 months, that supplier needs a full re-qualification event before they remain on your approved list.

The 5–7 day turnaround from sample receipt at our Countryside, IL hub to a verified analytical testing lab report in your inbox is designed to fit inside the receiving hold window most brands already maintain. Verification testing doesn’t have to be a bottleneck — it needs to be a documented, repeatable habit.

---

Written by Nour Abochama, VP Operations, Qalitex | Quality Consultant, Ayah Labs. Learn more about our team

Ship your sample to our Chicago facility — get a Qalitex CoA in 5–7 days. Contact us

Related from our network

• ICP-MS Elemental Impurities Testing Under USP <232>/<233> — Qalitex Laboratories runs heavy metals verification under ISO 17025 accreditation, with CoAs accepted by major supplement retailers and contract manufacturers across the US.
• Botanical Identity and Adulteration Screening Services — HPTLC and DNA barcoding for herbal ingredient verification, supporting supplier qualification programs for supplement brands.