When Supplier COAs and Third-Party Lab Results Disagree: Root Causes and What to Do Next

You’ve been in this position. A raw material shipment arrives with a supplier COA showing 99.2% assay, total aerobic microbial count well within USP limits, and a clean heavy metals panel. Your contract lab returns results three days later: 93.4% assay, a microbial count that’s borderline, and a cadmium reading that made you scroll back up to re-read it. Purchasing is on hold. Your production schedule is slipping. And you need an answer — fast.

The instinct is to assume the supplier falsified the data. That’s sometimes correct. But it’s also sometimes wrong — and making that call prematurely can damage a legitimate supplier relationship, delay a compliant shipment, and create more chaos than the original discrepancy. The better approach is systematic: understand why these gaps happen, distinguish analytical variation from fraud, and know exactly when to hold the line.

Why Legitimate Discrepancies Happen More Than You Think

The first thing to understand is that two analytical testing labs working on the same material can legitimately return different numbers. ISO 5725, which defines the principles of measurement precision and accuracy, acknowledges that reproducibility across labs is always wider than repeatability within a single lab. For a complex botanical extract, assay reproducibility between labs can span ±3–5% under normal, good-faith conditions. That’s not a red flag — that’s physics.

Here are the most common sources of legitimate variation:

Different analytical methods. USP publishes monographs for hundreds of ingredients, but not every ingredient has one. For materials outside the pharmacopeia, suppliers often use in-house methods or AOAC procedures, while your contract lab may apply a different HPLC gradient, column chemistry, or extraction protocol. A shift of 4–6% on assay between HPLC methods isn’t unusual when the mobile phases or reference standards differ.

Different reference standards. This one catches manufacturers off guard constantly. A supplier using a secondary reference standard that was calibrated at 96.3% purity will report lower assay values than a lab using a USP Certified Reference Standard (CRS) calibrated to 99.8%. The same molecule, the same instrument, different numbers — all because of what’s in the calibration curve.

Sampling variance. Your supplier tested a 1-gram subsample from the top of a 25-kg drum. You tested from the middle of a different drum in the same lot. For inhomogeneous materials — powders with particle size variation, botanical extracts with moisture gradients — sampling location matters enormously. USP <2040>, which covers sampling procedures for dietary supplements, exists for exactly this reason.

Unit conversion and calculation errors. These are rare but embarrassing when they occur. A supplier reporting on a dry-weight basis versus an as-is basis can show a 2–8% difference depending on moisture content. Always confirm which basis the COA uses before comparing numbers.

None of this excuses a supplier from providing inadequate documentation. But it does mean your first response to a discrepancy shouldn’t be an accusation — it should be a question.

The Data Patterns That Should Actually Worry You

Legitimate analytical variation has a signature: it’s random, it’s consistent with known method differences, and it doesn’t cluster suspiciously. Fraudulent or unreliable COA data has a different signature, and once you know what to look for, it becomes hard to unsee.

Results that cluster just inside spec limits. If a supplier’s COA consistently reports 101.0% assay on a material with a 98.0–102.0% spec, or always shows TAMC at exactly 9,000 CFU/g on a 10,000 CFU/g limit, that statistical pattern suggests the numbers were reverse-engineered from the spec rather than derived from testing. Real analytical data is noisy. It doesn’t land at exactly 90% of the limit on every single lot.

Missing method information. A compliant COA under 21 CFR Part 111 requirements should identify the test method used for each parameter. A COA that lists “HPLC” without specifying the method number, instrument, or reference standard is not verifiable. If you can’t reproduce the test as described, you can’t evaluate the result.

Inability to produce raw data. Any accredited lab operating under ISO/IEC 17025 retains raw data — chromatograms, spectra, plate counts, calibration records — for a minimum period (typically five years, though this varies by jurisdiction). A supplier who can’t or won’t produce these records on request is not working with an accredited lab. Full stop.

Microbiological results that are suspiciously clean. Total aerobic plate counts at exactly 0 CFU/g or <10 CFU/g on every lot of a botanical powder are not credible. Real powders have real microbial loads that vary. A supplier showing consistently perfect micro results across multiple botanicals and multiple lots almost certainly isn’t running real plate counts.

Third-party lab not disclosed. FDA’s current thinking on good manufacturing practice, expressed through multiple Warning Letters, is that suppliers should be able to identify the laboratory that performed testing and provide evidence of that lab’s qualifications. If your supplier says “tested internally” but is a broker with no lab infrastructure, that’s a contradiction worth pursuing.

A Systematic Investigation Process

When your results don’t match, don’t guess — investigate. Here’s the sequence our team follows when a client brings a discrepancy to us.

Step 1: Request the full method details from the supplier. Not just “HPLC” — the method number, column specifications, mobile phase composition, detector wavelength, run time, and reference standard lot and purity. Compare this against the method your contract lab used. If the methods are substantively different, that explains a lot.

Step 2: Check the reference standards used on both sides. Request the certificate for the supplier’s reference standard, including the purity assignment and the traceability chain (ideally back to NIST, USP, or a pharmacopeial authority). If the purity differs from what your lab used, apply the correction factor and see if the results converge.

Step 3: Retest from the retained sample. If you retained a representative sample at intake (which you should be doing per 21 CFR 111.80), retest from that portion. This controls for sampling variance.

Step 4: Run a side-by-side method comparison. If the discrepancy persists after steps 1–3, request that your contract lab run both the supplier’s method and their own on the same sample. This directly isolates whether the gap is methodological.

Step 5: Issue a Supplier Corrective Action Request (SCAR) if warranted. If steps 1–4 don’t explain the gap, or if you find evidence of missing documentation, you have grounds for a formal SCAR. Document the discrepancy, your investigation steps, and the supplier’s response. That paper trail matters during an FDA inspection.

The Lines You Don’t Cross

Method variation can explain a lot of things. It cannot explain these.

Identity mismatches. If your lab runs FTIR or HPTLC and confirms the material is not what it was sold as — adulterated turmeric that’s actually dyed starch, ashwagandha bulked out with fillers, or a “plant extract” that fingerprints as a synthetic isolate — no method argument holds water. Identity testing doesn’t produce 5% variation between labs. A mismatch on identity means the material is wrong.

Pesticide or heavy metal exceedances. Heavy metal testing by ICP-MS is one of the most precise analytical methods in use. Interlaboratory variation on cadmium, lead, arsenic, and mercury in botanical matrices is typically under ±10%, and the USP <232>/<233> elemental impurity limits have safety margins built in. If your lab reports cadmium at 0.8 ppm against a 0.5 ppm limit, that’s not a method artifact.

Lot acceptance under these conditions is not defensible during an inspection. FDA’s review of finished supplement recalls consistently traces contamination events to failures in raw material testing — either it wasn’t performed, or conflicting results were rationalized away without adequate investigation. Over the past five years, FDA has issued more than 60 Warning Letters citing deficiencies in component testing under 21 CFR Part 111. “The supplier’s COA said it was fine” is not a defense the agency accepts.

The practical standard is this: when in doubt, retest. A second retest from a well-drawn sample, using a validated method and a traceable reference standard, is the cleanest way to close the question. It’s also the evidence your quality system needs to show it took the discrepancy seriously.

What This Looks Like in Practice

A nutritional ingredient buyer recently brought us a curcumin extract with a 5.2% assay gap between their supplier’s COA and our results. The supplier reported 95.1% curcuminoids; we reported 89.9%. After working through the investigation:

• The supplier had used a UV-Vis spectrophotometric method; we used HPLC with baseline separation of curcumin, demethoxycurcumin, and bisdemethoxycurcumin.
• UV-Vis methods for curcuminoids are known to overestimate total curcuminoids by 4–8% when interfering compounds are present in the matrix.
• Our HPLC results were the more accurate figure.

The result: the material wasn’t fraudulent, but it didn’t meet the buyer’s specification as-labeled. The supplier adjusted their pricing, and the buyer updated their COA acceptance criteria to require HPLC-based assay for curcuminoids going forward. That’s a resolved discrepancy — and a better supply chain on the other side of it.

Not every investigation ends this cleanly. But the ones that don’t at least give you the data to make the right call.

---

Written by Nour Abochama, VP Operations, Qalitex | Quality Consultant, Ayah Labs. Learn more about our team

Talk to our team about raw material testing Contact us

Related from our network

• Third-Party Supplement and Raw Material Testing Services — ISO 17025-accredited testing for identity, purity, potency, and microbiology, with turnaround times built for production schedules.
• Amazon Compliance and Label Verification Testing — How US-market supplement brands use independent analytical testing labs to validate COA claims before product listing.