COA Red Flags: 5 Signs Your Supplier's Testing Data Can't Be Trusted

In 2013, a research team at the University of Guelph used DNA barcoding to test 44 commercial herbal products from 12 major companies. The results were damaging: 59% of products contained plant species not listed on the label, and 32% contained undeclared fillers — wheat, rice, and soybean — that posed real allergen risks for vulnerable consumers. Every one of those products almost certainly shipped with a Certificate of Analysis declaring it authentic.

That study, published in BMC Medicine, isn’t ancient history. Subsequent FDA inspections under 21 CFR Part 111 have repeatedly turned up the same pattern: manufacturers relying exclusively on supplier-provided documentation that was never independently verified — and in some cases, came from labs that either didn’t exist or couldn’t support the results. The raw material fraud problem didn’t get smaller as the supplement industry grew. If anything, global sourcing has made the supply chain longer and the documentation less traceable.

Understanding how to read a COA with a skeptical eye — and knowing exactly which red flags demand a follow-up call to an independent analytical testing laboratory — is one of the most practical quality skills a supplement brand can develop.

Why Supplier COA Fraud Is Subtler Than You’d Expect

The easiest fraud to spot involves obviously altered numbers or mismatched fonts. That’s not how most of it actually works. More common patterns include:

• Lot carryover: Results from a previously tested lot copied onto a new COA without retesting. The chemistry is real; the lot number has been swapped.
• Header borrowing: A legitimate lab’s letterhead used without the lab’s involvement — possible when suppliers obtain blank templates from prior business relationships.
• Spec-defined testing: Testing performed against a custom in-house spec written to guarantee a pass, rather than against USP monograph limits or validated reference standards.
• Partial testing: Heavy metals panel performed once per year on a representative lot, then listed verbatim on every COA for that SKU regardless of actual lot.

Midwest and Chicago-area brands sourcing through international brokers face heightened exposure. Brokers often aggregate inventory from multiple origins and repackage under a single supplier label. By the time a COA reaches your receiving dock, it may represent an aggregated lot that was never tested as a unified batch.

None of this is obvious from the document itself. That’s the point.

Red Flag #1: Test Methods Are Missing, Vague, or Listed as “Proprietary”

A COA generated by a real analytical testing laboratory names the specific method used for each parameter. Not just “HPLC” — but “USP <621>, reversed-phase HPLC” or “AOAC 2007.01” or “Ph.Eur. 2.2.29.” Vague citations like “in-house method,” “per specification,” or “proprietary procedure” with no protocol number or publication reference are a consistent marker of documents not produced by an accredited lab.

The reason is structural. Accredited labs maintain method validation records and embed the validated method citation into their LIMS output for every report. It’s automatic. When a COA says “in-house” with nothing else, there’s nothing to audit — and that’s often intentional.

This matters most for identity testing. For botanical ingredients, USP <563> establishes macroscopic examination, microscopic examination, HPTLC against authenticated reference standards, and (increasingly) DNA barcoding as the standard toolkit. A COA that confirms botanical identity via “visual inspection” on a powdered extract should stop you cold. Powdered material is visually indistinguishable between species. Visual inspection proves nothing.

Red Flag #2: Results Cluster Suspiciously Close to Spec Limits — Across Every Lot

Real analytical data has natural variation. Potency values for a botanical extract fluctuate between lots. Heavy metal readings don’t land at exactly 0.10 ppm on twelve consecutive shipments. When you pull COAs from the same supplier across multiple lots and see results that are nearly identical — particularly values that fall just inside specification limits with unusual consistency — you’re looking at one of two possibilities. Either the supplier is batching and retesting until they hit a target range (which is its own problem), or the numbers have been edited.

Request raw data or instrument output files for at least one prior lot. A legitimate lab retains chromatograms, ICP-MS spectra, and plate count records as part of their quality management system and can release them upon request. If the supplier declines or says the data “isn’t available in that format,” treat it as a meaningful signal.

Also worth checking: whether the listed specifications on the COA match the relevant USP monograph. Suppliers occasionally write custom specs with wider tolerances, then report passing results against those custom numbers. That passes their COA. It doesn’t necessarily pass yours.

Red Flag #3: The Testing Lab Is Unaccredited or Can’t Be Verified

ISO 17025 accreditation means an independent accreditation body — in the US, typically A2LA (American Association for Laboratory Accreditation) or NVLAP (National Voluntary Laboratory Accreditation Program) — has audited the lab’s technical competence, equipment calibration, method validation, and quality management system. Every accredited lab has a publicly searchable certificate listing its scope of accreditation and expiration date.

When a COA lists a laboratory, take two minutes to check. Search the A2LA or NVLAP online directory. If the lab doesn’t appear, if their certificate is expired, or if their accreditation scope doesn’t cover the specific methods cited on your COA — that document cannot be treated as reliable. Full stop.

We’ve seen cases where the lab listed on a supplier’s COA had ceased operations entirely. The supplier continued issuing documents under the old letterhead for years. This pattern shows up in FDA 483 observations from inspections of both finished goods manufacturers and raw material distributors. It’s not rare.

Beyond accreditation status, it’s worth verifying that the lab operates in the country the supplier claims. Some COAs list domestic lab names while testing is performed — if at all — at overseas facilities with no equivalent accreditation standing.

Red Flag #4: No Sample Identification or Traceable Chain of Custody

A COA for a specific lot of raw material should trace back to a specific sample event. That means a sample accession number or work order that could theoretically allow you to contact the lab and confirm the results independently. It also means clear production lot traceability — not just your purchase order number, but the supplier’s internal lot designation and the date of manufacture or harvest where applicable.

COAs that list only a product name and a calendar date — with no sample-level identifiers — describe a test that happened to some material at some point. There’s no mechanism to confirm the tested material corresponds to the specific inventory on your receiving dock.

Under DSHEA Section 402(g) and the implementing regulations at 21 CFR 111.75, dietary supplement manufacturers must verify the identity of each lot of dietary ingredient upon receipt. “We have a COA from this supplier” doesn’t satisfy that requirement when the COA can’t be traced to the actual lot in question. This is the specific regulatory gap that FDA investigators look for — and find — during cGMP inspections of Midwest supplement manufacturers.

Red Flag #5: The Panel Omits Heavy Metals, Microbiology, or Both

A complete COA for a botanical raw material addresses at minimum five categories: identity confirmation, potency or active constituent content, heavy metals (the four elemental analytes under USP <232>: arsenic, cadmium, lead, and mercury), microbiology per USP <61> and <62>, and pesticide residue screening — particularly relevant for botanicals sourced from South Asia, Southeast Asia, or parts of China.

A COA that tests potency but omits individual heavy metal results — or reports only a total metals figure without breaking out the four individual elements — is incomplete. The USP <232> permitted daily exposure for lead is 5 µg/day for oral supplements. That’s a tight limit, and for high-volume botanical ingredients like ashwagandha, turmeric, or morinda root sourced from historically contaminated soils, it’s one that demands individual elemental analysis by ICP-MS, not an aggregate colorimetric test.

Microbiological results deserve equal scrutiny. A COA that shows total aerobic plate count but doesn’t address Salmonella or E. coli O157:H7 under USP <62> leaves meaningful gaps. Both pathogens have caused illness in dietary supplement contexts and are explicitly covered by USP compendial methods for this reason.

If any of these parameters are absent from a supplier’s COA, the appropriate response isn’t to assume they passed — it’s to assume they weren’t tested.

Choosing an Analytical Testing Laboratory for Independent Verification

Independent verification means using a lab with no commercial relationship to your supplier and a scope of accreditation that explicitly covers the methods you need. For Midwest brands, the practical question is logistics: who handles the paperwork, chain of custody, and routing?

Our Chicago-area sample receiving hub — located in Countryside, IL — accepts incoming raw material samples directly from your facility, manages chain-of-custody documentation, and routes testing to ISO 17025-accredited labs. A standard botanical verification panel covering identity (HPTLC + DNA barcoding), heavy metals (ICP-MS, USP <232>/<233>), and microbiology (USP <61>/<62>) typically returns a CoA within 5–7 business days.

The cost of that panel runs roughly $250–$450 depending on the number of parameters. Compare that to the exposure: product recalls in the dietary supplement category regularly cost firms upward of $5 million when factoring in legal fees, inventory write-downs, retailer chargebacks, and the near-certain FDA warning letter that follows. The math on verification spending isn’t complicated.

One additional point worth making: independent testing doesn’t just catch fraudulent COAs. It also catches legitimate supplier drift — cases where a supplier’s quality has declined since their last audit, where a new source region has been quietly substituted, or where a seasonal harvest has different contamination characteristics than prior lots. Those wouldn’t show up as document fraud. They show up as test failures.

Document skepticism and independent testing aren’t expressions of distrust toward your suppliers. They’re expressions of your obligation to the consumer buying your product.

---

Written by Nour Abochama, VP Operations, Qalitex | Quality Consultant, Ayah Labs. Learn more about our team

Ship your sample to our Chicago facility — get a Qalitex CoA in 5–7 days. Contact us

Related from our network

• ISO 17025-accredited supplement testing for US brands — Qalitex Laboratories performs full botanical identity, heavy metals (ICP-MS), and microbiology panels under ISO 17025 accreditation, issuing traceable CoAs accepted by major US retailers.