7 Red Flags on a Supplier COA That Should Send Your Raw Materials to an Analytical Testing Laboratory

In 2024 and 2025, FDA warning letters to dietary supplement manufacturers cited one failure more consistently than almost any other: accepting raw materials based solely on a supplier’s certificate of analysis, without conducting any independent verification. That’s not a paperwork problem. Under 21 CFR Part 111.75(a)(1), every DSHEA-regulated manufacturer is required to perform at least one appropriate test to establish the identity of each incoming dietary ingredient. A supplier’s COA, standing alone, doesn’t satisfy that standard — and FDA investigators know it.

The practical consequence is that a lot of supplement brands are sitting on a compliance gap they don’t know exists. The supplier sends a clean-looking COA, the QC manager signs off, and the material goes into production. And nine times out of ten, nothing bad happens. But that tenth time — when the material is adulterated, mislabeled, or contaminated at levels the supplier’s own lab didn’t detect — is the situation that ends in a recall, a Form 483, or worse.

Here’s what to look for before you sign off on the next incoming lot.

---

What a COA Actually Certifies (Less Than Most Buyers Assume)

A certificate of analysis is a summary of results. That’s all it is. It documents what a specific lab measured on a specific sample — but it says nothing about who collected that sample, how representative it was of the full shipment, how the testing equipment was calibrated, or whether the batch you’re receiving is even the same material that was analyzed.

Supplier-issued COAs carry an additional limitation: they’re produced by the same organization with a financial interest in selling you the material. This doesn’t mean suppliers are dishonest. Many aren’t. But it means there’s no independent check on the supplier’s equipment, methods, personnel qualifications, or interpretation of borderline results.

The regulatory framework recognizes this. FDA’s guidance on dietary supplement GMPs has been consistent: manufacturers cannot rely solely on a supplier’s COA. You either need to test incoming components yourself or have a qualified, independent third party do it. That’s the requirement. Everything below is about identifying which lots most urgently need that independent look.

---

7 Red Flags That Should Trigger Third-Party Testing

1. Round-Number Purity Results — On Every Lot, Every Time

A purity result of exactly 98.0%, appearing on three consecutive COAs from the same supplier for three different production lots, is a statistical anomaly. Real analytical measurements have variability. HPLC assays carry an inherent method precision of roughly ±1–2% depending on calibration, column condition, and standard preparation. When results consistently land on clean, round numbers — 95.0%, 98.0%, 99.5% — it often suggests the COA was filled in manually rather than generated directly from instrument output.

This pattern shows up repeatedly on ashwagandha, turmeric extract, and green tea extract raw materials from certain overseas suppliers. If you see it, request the raw chromatogram data. If the supplier can’t or won’t produce it, that’s your answer.

2. Missing or Vague Analytical Method Citations

A COA that says “purity tested by HPLC” without citing a specific method — USP <561>, AOAC 2012.14, or a validated in-house procedure with a reference number — is nearly useless for verification purposes. Without a cited method, you can’t assess whether the analytical approach was appropriate for the matrix, whether the calibration standards were suitable, or whether the detection limit was adequate for the specification you’re trying to confirm.

USP methods are specific for a reason. A general HPLC assay for “total curcuminoids” looks quite different from a validated USP <561> method, and the numerical results aren’t directly comparable between the two. “Tested by HPLC” without the method detail is closer to a statement of equipment ownership than a verified result.

3. No ISO 17025 Accreditation or Lab Identifier

COAs issued by labs without ISO 17025 accreditation carry significantly less evidentiary weight — in a regulatory context and in practice. ISO 17025 is the international standard for testing laboratory competence. It covers instrument calibration, method validation, personnel qualifications, sample handling, and result reporting. A lab operating without it has no independent oversight verifying any of those elements.

Look for an accreditation body name and registration number on the document: A2LA, Perry Johnson Laboratory Accreditation (PJLA), NVLAP, or an equivalent body in the country of origin. If neither appears, you’re accepting results from a lab whose competence has never been externally verified.

4. Heavy Metal Limits That Don’t Match USP <232>/<233>

USP <232> (Elemental Impurities — Limits) established oral daily exposure limits for the four elements of primary concern in dietary ingredients: arsenic (≤1.5 µg/g), lead (≤0.5 µg/g), cadmium (≤0.3 µg/g), and mercury (≤1.5 µg/g). Many overseas supplier COAs still report results against older, looser thresholds — or against food-grade limits that don’t apply to concentrated botanical extracts used in finished supplements.

A COA reporting lead as “ND (<10 ppm)” is not USP <232>-compliant. At that detection limit, a result of 9.9 ppm would appear clean on paper while sitting nearly twenty times above the USP specification. The method needs to be ICP-MS (inductively coupled plasma mass spectrometry), with detection limits well below 0.1 µg/g. Atomic absorption spectroscopy (AAS) in graphite furnace mode can approach that threshold but is increasingly difficult to defend as the reference method when ICP-MS is available.

5. Microbiology Results That Show Nothing at All

Botanical root powders and leaf materials grown in soil harbor microbial life — full stop. Total aerobic plate counts (TAPC) below detection, yeast and mold below detection, and objectionable organism screens all coming back negative on every lot, from every shipment, is statistically improbable unless the material has been aggressively treated with something like ethylene oxide (EtO) fumigation or high-pressure steam sterilization.

USP <61> and <62> establish acceptance criteria for microbial limits in non-sterile dietary supplements and ingredients. A realistic COA should show detected values within acceptable ranges — not a column of “<LOD” on every parameter. If you’re seeing universally clean micro results without any documentation of a validated bioburden-reduction treatment, that’s worth investigating before the material reaches your blending floor.

6. The Same Lot Number on Multiple Shipments Over Many Months

This is more common than it should be. A supplier generates a high-quality COA on one production run, then continues referencing that same lot number — and that same COA — on shipments going out over the next 12 or 18 months. You receive the documentation, the lot number matches what’s on file, and the material goes in.

Your incoming material SOP should specify that COAs must be dated within the past 12 months and must correspond specifically to the lot number on the current shipment’s packaging and bill of lading. If a new shipment arrives with a COA dated 20 months ago, stop the receipt. The original test results — however good they were — don’t tell you anything about what’s in the containers that just arrived.

7. Botanical Identity Confirmed Only by Organoleptic Inspection

“Identified by physical characteristics and odor” is a sensory description, not a botanical identity test. For any ingredient where economic adulteration is documented — and that list is long, including turmeric, elderberry, black cohosh, echinacea, ginger, and most common adaptogens — identity needs to be confirmed by a validated analytical method.

HPTLC (High-Performance Thin-Layer Chromatography) is the USP approach of record for botanical identity verification. It produces a fingerprint chromatogram specific to the species and part of plant used, and it’s difficult to fake. DNA barcoding complements HPTLC by identifying the species even in heavily processed or extracted materials where the morphological characteristics are no longer recognizable. Neither method is prohibitively expensive relative to the cost of a batch release failure or a market withdrawal.

---

What Third-Party Testing Actually Turns Up

When materials flagged by any of the above criteria are submitted to an independent analytical testing laboratory, the findings aren’t always dramatic — but they’re consistently informative.

In our experience receiving and processing samples at our Countryside, IL facility before routing them to accredited labs for analysis, common findings on flagged lots include purity values running 8–15% below supplier-reported figures on standardized botanical extracts, heavy metal concentrations at or slightly above USP <232> specifications (particularly lead and cadmium in root materials sourced from certain growing regions in South Asia and China), and botanical identity discrepancies where the HPTLC fingerprint doesn’t match the declared species.

The most operationally significant findings, though, tend to be microbiology. Materials that arrived with supplier COAs showing clean micro have occasionally tested positive for objectionable organisms under USP <62> — particularly bile-tolerant gram-negative bacteria in plant-based protein concentrates and in select root extracts. Those aren’t margin issues. They’re release-hold situations that require investigation, disposal decisions, and supplier notifications under your CAPA process.

---

Building COA Review Into Your Incoming Material SOP

A structured COA review process doesn’t have to be elaborate. The goal is a decision rule your QC team can apply consistently to every lot, with no ambiguity about when to hold and when to release.

Start with a one-page COA review checklist: confirm the supplier lab’s accreditation and registration number, verify that each test has a specific method citation, check the lot number against the shipping container label and bill of lading, compare heavy metal limits against USP <232> specifications, and flag any result format that looks atypical for the method cited. Any lot that trips one of the seven criteria above should go to hold-pending-testing status, not to release.

For higher-risk material categories — botanicals with known adulteration histories, ingredients from new or unaudited suppliers, or high-volume inputs that represent significant formulation risk — independent identity testing should be a standard incoming material requirement, not an exception. Under 21 CFR Part 111.75, you need to be able to show FDA an actual testing record for every lot’s identity, and “we reviewed the supplier’s COA” is not a defensible response when an investigator asks for documentation.

Third-party turnaround at a qualified analytical testing laboratory typically runs 5–10 business days for a standard raw material panel covering identity, elemental impurities, and microbiology. That window fits comfortably within most receiving and production timelines — and the cost per sample is almost always less than the cost of one rejected production run, one consumer complaint investigation, or one FDA correspondence that starts with a Form 483 observation.

The math isn’t complicated. The harder part is building the habit.

---

Written by Nour Abochama, VP Operations, Qalitex | Quality Consultant, Ayah Labs. Learn more about our team

Ship your sample to our Chicago facility — get a Qalitex CoA in 5–7 days Contact us

Related from our network

• ISO 17025-Accredited Raw Material Testing — Qalitex Laboratories performs the full analytical panel behind every Ayah Labs report, including ICP-MS, HPTLC, and USP microbiology testing from our California facility.
• Botanical Identity and Adulteration Screening Services — HPTLC fingerprinting, DNA barcoding, and HPLC marker quantification for supplement brands that need more than a supplier’s word.