How to Spot a Falsified Certificate of Analysis Before It Reaches Your Warehouse

One of the more instructive cases from FDA enforcement files involved an ashwagandha root extract that consistently showed 5% withanolides on supplier-provided COAs. The manufacturer accepted those numbers without independent verification — reasonable, on the surface. The supplier was established, the COAs arrived promptly, and the documentation looked professional. When finished product began underperforming in stability studies, they finally sent retained samples to an independent analytical testing laboratory. The extract contained 0.4% withanolides. The COA hadn’t been optimistic. It had been fabricated.

That kind of discovery doesn’t happen during an FDA audit if your incoming material program is doing its job.

COA fraud isn’t limited to fringe operators. The American Herbal Products Association (AHPA) and NSF International have both documented systematic adulteration in botanical supply chains, and falsified documentation is a recurring thread. In an industry where raw materials cross multiple borders, trade through brokers, and arrive with paperwork that no one at the lab ever actually generated, the pattern is more common than most QC teams want to admit.

Here’s what to look for — and what to do about it.

What a Legitimate COA Actually Contains

Before you can identify fraud, you need a clear picture of what genuine documentation looks like. A well-structured COA for a botanical raw material should include:

• Full material identification: botanical name in Latin (genus, species, and authority citation), the plant part used, and the form of the material (dry extract, standardized extract, whole powder, tincture ratio)
• A unique, traceable lot number that doesn’t look like it was formatted from a date
• Testing parameters with method citations: not just “heavy metals — PASS” but “arsenic by ICP-MS per USP <232>, result: 0.08 ppm, specification: ≤1.0 ppm”
• Actual numerical results, not only pass/fail designations: the FDA’s cGMP regulations expect this, and more importantly, you need actual numbers for trending and anomaly detection
• The issuing laboratory’s identity and, ideally, accreditation number: a COA from an internal QC department is not the same as one from an ISO/IEC 17025-accredited facility
• Date tested relative to manufacturing date: these should be within a reasonable window — typically 30 to 60 days

What a legitimate COA should not look like: perfectly round numbers across every row. If a supplier’s documentation shows moisture at exactly 5.0%, ash at exactly 2.0%, and every heavy metal at precisely the specification limit — lot after lot — real analytical variability has been engineered out. Real instruments produce real scatter.

Red Flags That Signal a COA Has Been Altered or Fabricated

Experienced QC reviewers develop pattern recognition for fraudulent documentation. These are the signals that consistently appear:

Font and text layer inconsistencies. A COA that mixes typefaces, shows unusual character spacing in the results column, or has values that appear in a slightly different weight or color than surrounding text has almost certainly been edited in a PDF tool. The original values were replaced. Open the document in Adobe Acrobat Pro or a similar application and inspect the text layers — edited PDFs frequently show evidence of layered content that doesn’t match the base document. This takes under two minutes and catches a significant proportion of crude alterations.

Lot numbers that look like recycled dates. “Lot 20231015” might be a genuine internal identifier — or it might be a previous passing lot’s data being reused. Cross-reference the lot number against your purchase order date. A COA dated months before your order was placed should prompt you to call the issuing laboratory directly, quote the lot number, and confirm it corresponds to your shipment.

Results clustered suspiciously near specification limits. Real laboratory data is distributed. If 18 consecutive COAs from the same supplier show EGCG content between 40.1% and 40.4% — never dipping below, never varying by more than 0.3% — either their manufacturing consistency is extraordinary or the results are being trimmed. Request raw instrument data (HPLC chromatograms, ICP-MS spectra) for at least one lot per supplier per year. A legitimate analytical testing laboratory will provide these without hesitation. One that won’t is telling you something.

Accreditation claims that don’t verify. ISO/IEC 17025-accredited laboratories appear in publicly searchable databases. The A2LA directory at a2la.org, the ILAC MLA network, and UKAS (for UK labs) all support public lookups by accreditation number or laboratory name. If a COA cites ISO/IEC 17025:2017 accreditation and that laboratory returns no results in any of these databases, the accreditation is fabricated. We’ve reviewed COAs from facilities that don’t exist at the listed address.

Missing botanical taxonomy on herbal COAs. An ingredient COA that identifies material only as “ashwagandha extract” without specifying Withania somnifera (L.) Dunal, the plant part (root, leaf), and the extraction solvent has not been properly characterized. Whether the gap reflects laboratory carelessness or something more deliberate, the outcome is the same: you don’t actually know what you received.

How an Analytical Testing Laboratory Confirms What the Paperwork Claims

There is no substitute for sending samples to an independent analytical testing laboratory. The COA your supplier provides tells you what they claim. Third-party testing tells you what’s actually there. For botanical raw materials, these are the tests that provide maximum signal per dollar:

HPLC or UHPLC for marker compound verification. For any extract with a potency claim — withanolides in ashwagandha, curcuminoids in turmeric, EGCG in green tea, ginsenosides in ginseng — HPLC quantification against a certified reference standard directly confirms whether the stated potency is real. A result more than 15% below the COA-stated value warrants a formal discrepancy investigation. A result 50% below it is fraud. This is the single highest-value test for catching falsified potency claims.

FTIR or NIR for identity screening. Fourier-transform infrared spectroscopy generates a spectral fingerprint of the material that can be compared against authenticated reference spectra. Most accredited analytical testing laboratories maintain botanical reference libraries for this purpose. FTIR screening runs in under 30 minutes per sample and costs relatively little — it’s among the most cost-effective identity verification tools available, and it catches gross substitutions (e.g., rice flour subbing for botanical powder) almost immediately.

DNA barcoding for species-level confirmation. For materials where adulteration typically involves a related but cheaper species — elderberry vs. other Sambucus varieties, bilberry vs. blueberry, or echinacea species substitution — PCR-based DNA barcoding confirms taxonomy at the genus and species level. It’s particularly valuable when FTIR spectra of the adulterant are chemically similar to the authentic material.

ICP-MS for actual heavy metal concentrations. USP <232> specifies permissible daily exposures for arsenic, cadmium, lead, and mercury in oral dosage forms. ICP-MS returns actual concentrations — typically in ppb or ppm — not a pass/fail designation. If your supplier’s COA states arsenic at 0.1 ppm and your ICP-MS result is 1.8 ppm, you have a meaningful discrepancy even if both values technically fall within some broad threshold. Trending actual numbers across lots is how you catch drift in a supplier’s material quality before it becomes a product problem.

Microbial testing per USP <2021>/<2022>. Total aerobic microbial count (TAMC), total combined yeast and mold count (TYMC), and testing for specified organisms — Salmonella spp., E. coli, S. aureus, P. aeruginosa — should be independently verified for any botanical with a documented contamination risk profile. Dried herbs and powdered extracts from subtropical growing regions are particular concerns. A supplier COA showing clean microbial results doesn’t mean a lot wasn’t contaminated in transit or storage after testing.

In our experience, the gap between supplier COA values and third-party results is most pronounced for potency claims, less so for physical parameters like moisture and ash content. A manufacturer who independently verifies potency on 100% of incoming botanical lots — and tests physical and microbial parameters on a risk-stratified schedule — will catch most fraudulent documentation before it affects finished product quality or triggers an FDA observation.

Building COA Verification Into Your Incoming Inspection Process

Under 21 CFR Part 111, dietary supplement manufacturers are required to conduct at least one test to verify the identity of each component before use. The FDA clarified in the 2007 cGMP final rule that a supplier’s COA alone does not satisfy this requirement. You must perform actual testing — or contract it out to a qualified third-party laboratory. Here’s a practical framework:

1. Tier your suppliers by risk. New suppliers, sole-source suppliers, and suppliers from regions with documented adulteration history warrant full incoming testing on every lot. Established suppliers with a verified multi-year track record may qualify for reduced frequency — but “reduced” doesn’t mean zero, and every tier should include identity testing on 100% of lots.

2. Establish a minimum acceptable COA format and communicate it. If a supplier’s COA omits actual numerical results, method citations, or botanical taxonomy, require them to revise it before the lot is conditionally accepted. Sending suppliers a one-page document describing your COA requirements takes an afternoon to write and prevents years of inadequate documentation.

3. Verify accreditation claims independently on first receipt. Before accepting any new supplier’s documentation, look up the issuing laboratory in A2LA or ILAC. This takes five minutes. It catches fabricated accreditation numbers immediately and gives you a documented due-diligence record that FDA investigators will want to see.

4. Request raw instrument data periodically. Even from trusted suppliers, ask for HPLC chromatograms or ICP-MS spectra for one lot per year per material. A legitimate supplier relationship can survive this request easily. A fraudulent one often can’t — the underlying data doesn’t exist.

5. Retain samples from every incoming lot. 21 CFR 111.83 requires retaining reserve samples of components for at least one year beyond the product’s shelf life or two years after distribution of the last batch using the component, whichever is longer. Retained samples are your ability to investigate retrospectively when a finished product issue surfaces months after manufacturing.

The COA that arrives promptly, looks professional, and shows every result passing is often the one that gets no scrutiny. That’s exactly the pattern that fraudulent suppliers rely on. A verification program that targets only slow, late, or messy documentation is protecting itself against the wrong threat.

One practical note: when third-party testing diverges significantly from a supplier COA, issue a supplier corrective action request (SCAR) in writing before making any supplier disposition decision. The SCAR creates a documented record of the discrepancy and your response to it. The supplier’s reply — or silence — will tell you whether the problem was a one-time error or something structural.

---

Written by Nour Abochama, VP Operations, Qalitex | Quality Consultant, Ayah Labs. Learn more about our team

Talk to our team about raw material testing. Contact us

Related from our network

• Third-Party Potency and Identity Testing for Supplement Manufacturers — ISO 17025-accredited analytical testing for finished supplements and raw materials, including HPLC and ICP-MS
• Supplier COA Verification and Incoming Material Testing — Independent laboratory confirmation of supplier-provided COA values for dietary supplement ingredients