7 COA Red Flags That Should Make You Question Your Supplier's Testing Data

A supplement brand we consulted with last year received a COA for a standardized turmeric extract showing 95% curcuminoids — exactly what they’d specified. The document looked professional: company letterhead, a full list of tests, pass/fail designations in a tidy column. They released the lot and ran it through manufacturing.

Third-party testing later showed curcuminoid content at 22%.

The supplier’s COA wasn’t forged, exactly. It had been carried over from a different lot — one that had genuinely tested at spec. Nobody caught it because the procurement team had no protocol for COA verification. The document looked right, so it passed. By the time the discrepancy surfaced, 40,000 units were already in production.

This happens more than most quality teams want to admit.

Why COAs Are the Most Trusted and Least Verified Document in Your Supply Chain

Under 21 CFR Part 111.75(a)(1), dietary supplement manufacturers must conduct 100% identity verification on every dietary ingredient they receive. That’s a hard regulatory requirement, not a recommendation. Yet the FDA’s inspection data has consistently shown that failures to establish or follow component testing specifications rank among the five most-cited cGMP violations, year after year.

The industry has developed a workaround that feels like compliance: accepting the supplier’s COA and conducting a reduced incoming testing program based on supplier qualification history. Done properly, this is a legitimate approach. But “done properly” requires actually knowing whether the COA in front of you reflects real testing — not just whether it looks like it does.

Internationally sourced botanical raw materials are especially exposed here. Supply chains for ingredients like ashwagandha, black elderberry, and milk thistle extract often pass through three or four intermediaries before reaching a US or EU manufacturer. At each step, a COA can be modified, re-issued, or simply copied from a previous lot. By the time the material reaches your receiving dock, you may be looking at a document that has drifted substantially from the actual testing performed — or was never grounded in real data to begin with.

Here’s what to look for.

Red Flags on the COA Itself

1. The testing laboratory has no accreditation you can verify

Every credible third-party COA should reference a laboratory accredited to ISO/IEC 17025:2017 — the international standard for testing and calibration laboratory competency. Accreditation means the lab has been independently audited, participates in ongoing proficiency testing, and maintains documented quality systems that are periodically reassessed. It’s not a guarantee of perfect results, but it’s the baseline for analytical credibility.

If the COA lists an internal supplier lab with no accreditation number, that’s not automatically fraudulent — but it means no external party has verified that lab’s methods, equipment, or personnel. You’re taking the supplier’s word for it, entirely. For high-risk botanical ingredients, heavy metal panels, or pesticide screening, that’s a meaningful exposure.

Search the lab’s name against the A2LA (American Association for Laboratory Accreditation) database or the broader ILAC-MRA network. A legitimate ISO 17025-accredited lab will provide their accreditation scope certificate on request without hesitation. If they deflect, press harder or send the material to an independent analytical testing laboratory.

2. Identical results across multiple lots — especially for heavy metals

Real analytical data shows variation. Instrument noise, sample heterogeneity, and natural biological variability mean that lead levels in botanical raw materials will read differently from lot to lot: 0.08 ppm this shipment, 0.11 ppm the next, 0.06 ppm the one after. When a supplier’s COA shows lead at exactly ”< 0.10 ppm” for every single lot across 18 months — same value, same format, no deviation — that uniformity is itself a data quality signal.

Pull the last three to five COAs from the same supplier for the same material and run a column comparison. If heavy metals, pesticide residues, and microbiological results are consistently identical down to the decimal, ask the supplier for raw instrument data. Request the ICP-MS run report, the chromatograms, or the plate count worksheets. If they can’t or won’t provide primary analytical records, escalate.

3. Method citations that don’t match the analyte

A COA should cite a specific, recognized analytical method for every test listed. “HPLC” is not a method. “In-house method” without a version number and validation summary is not a method. And an AOAC method number cited for an analyte it doesn’t cover is a sign that someone populated that field from memory, not from the actual testing protocol.

For botanical identity, appropriate methods include USP <561> (Articles of Botanical Origin), HPTLC using validated reference fingerprints per HPTLC Association monographs — which now cover more than 150 botanical species — or DNA barcoding where morphological methods fall short. For pesticide residue screening, EN 15662 (QuEChERS extraction) or AOAC 2007.01 are the recognized standards. For elemental impurities in botanical ingredients, ICP-MS per USP <232> and <233> is the current expectation. If the method cited doesn’t match the analyte or isn’t cited at all, the result tells you nothing.

4. Specifications listed as pass/fail with no numerical result

A compliant COA includes three elements for each quantitative test: the specification (your acceptance criterion), the actual result (what the instrument measured), and the unit of measure. “Heavy metals: Pass” fails all three. “Arsenic: < 1.5 ppm / Result: Complies” is marginally better but still doesn’t tell you what was actually detected.

This matters in practice. A result of 1.49 ppm and a result of 0.03 ppm both “pass” a < 1.5 ppm arsenic specification, but they carry very different risk profiles — particularly for products intended for daily use over years, or for sensitive populations like children or pregnant women. Numerical results also allow you to track lot-to-lot trends over time, which is how you catch gradual drift before it becomes a rejection. Insist on COAs that report actual measured values for every quantitative test.

5. Botanical identity marked “Pass” with no method cited

This is the most common compliance gap we see in B2B botanical ingredient procurement, and it has direct regulatory teeth. Under 21 CFR Part 111.75(a)(1), 100% identity testing is not optional for dietary ingredients. A COA that shows “Identity: Pass” with no method cited provides no assurance that identity was actually tested — it provides a populated field on a form.

Adequate botanical identity for a root powder or dried extract requires at minimum macroscopic and microscopic examination per USP <563>, and ideally an HPTLC fingerprint or quantitative marker compound analysis to confirm species and distinguish from adulterants or substitutes. For high-value botanicals — saffron, ashwagandha, lion’s mane — economically motivated adulteration is well-documented. “Pass” without a method doesn’t protect you from any of it. Ask what method was used. If your supplier can’t answer specifically, that is your answer.

6. Microbiology results that are implausibly low for the material type

Dried botanical powders — roots, leaves, bark, seeds — carry environmental microorganisms by nature. USP <2023> sets a Total Aerobic Microbial Count (TAMC) acceptance criterion of 10^5 CFU/g for herbal preparations intended for oral use, and that ceiling exists precisely because clean, properly handled botanical material genuinely carries bioburden at that level. A raw ashwagandha root powder with a TAMC of < 10 CFU/g hasn’t been carefully harvested — it’s been treated.

Ethylene oxide sterilization, gamma irradiation, and electron beam treatment can all bring botanical bioburden to near-zero. None of those processes is inherently disqualifying. But they must be disclosed, because they’re relevant to your quality decisions. Irradiated material may conflict with certain certifications or customer requirements. ETO treatment leaves residuals that require their own analytical testing. A COA that reports implausibly clean microbiology without documenting the treatment method is withholding information you’re entitled to have.

7. The report date doesn’t align with the production timeline

Cross-reference the COA issuance date against the lot’s documented manufacturing date and your purchase order receipt date. A COA dated before the lot could have finished production is a timeline anomaly — and timeline anomalies require an explanation.

In legitimate supply chains, administrative re-issuance and testing delays can create date discrepancies with innocent explanations. But a COA dated three weeks before a lot was reportedly manufactured, for material that arrived at your facility last Tuesday, is worth querying formally. Ask the supplier to confirm which specific lot the testing was performed on and request the original instrument run dates. If they can’t provide run-level documentation confirming the chain from sample to result, you don’t have traceability — you have paperwork.

What to Do When You Spot Red Flags

A COA with one or two concerns doesn’t automatically mean fraud. It might mean the supplier uses an outdated template, sources testing from a subcontractor lab with inconsistent documentation practices, or has never had a customer push back on their format before. Red flags warrant verification, not automatic rejection.

The appropriate first response is incoming verification testing through an accredited analytical testing laboratory with scope covering the relevant analytes: botanical identity, elemental impurities by ICP-MS, pesticide screening by GC-MS/MS and LC-MS/MS, and microbiology by USP-compliant methods. A targeted verification panel for a botanical extract typically runs between $400 and $900 and returns results in five to ten business days. That cost is negligible relative to the expense of a cGMP violation finding, a product recall, or a consumer complaint that traces back to a mislabeled ingredient.

If verification testing reveals a meaningful discrepancy between the supplier COA and independent results, that’s a supplier corrective action event. Place the lot on hold, document the discrepancy in your quality system, and issue a formal SCAR. Whether you continue sourcing from that supplier depends on the severity of the gap, the supplier’s willingness to investigate, and their ability to demonstrate corrective action with evidence.

For high-volume or critical ingredients, build semi-annual skip-lot testing into your supplier qualification program, and re-verify lab accreditation status annually. The ongoing investment is modest. The protection it provides against a single compliance failure more than justifies it.

---

Written by Nour Abochama, Quality Consultant, Ayah Labs. Learn more about our team

Talk to our team about raw material testing. Contact us

Related from our network

• ISO 17025-Accredited Supplement and Raw Material Testing — Qalitex Laboratories offers full-panel incoming material verification including heavy metals by ICP-MS, botanical identity by HPTLC, and pesticide screening for supplement manufacturers.
• How to Build a Compliant Component Testing Program Under 21 CFR Part 111 — A practical guide to identity verification requirements, reduced testing programs, and supplier qualification documentation for US dietary supplement brands.