Certificate of Analysis (COA): Required Fields, How to Verify One, and When It Isn’t Enough

A Certificate of Analysis (COA) is a document issued by a manufacturer or supplier’s quality control laboratory that reports the actual test results obtained for a specific batch or lot of a material, and confirms those results meet the material’s stated specification before that lot is released for use. It is a lot-specific quality record, not a generic product datasheet: a COA for lot 4471 of a reagent describes only lot 4471, and a new lot requires a new COA. For procurement and QA staff receiving reagents, raw materials, calibration standards, or active ingredients, the COA is the primary evidence a supplier provides that a given shipment actually is what it was ordered as.

This guide covers what a COA must contain to be usable, how to check one against the material it accompanies, and — the part most incoming-inspection SOPs get wrong — why a supplier’s COA, however complete, is rarely sufficient on its own in a GMP or accredited-testing environment.

What Is a Certificate of Analysis (COA) For?

A COA exists to transfer quality information from the party that tested a material to the party that will use it, without the receiving lab having to re-run every test itself. It typically accompanies chemicals, reagents, active pharmaceutical ingredients (APIs), reference standards, biological materials, and manufactured components at the point of shipment. The issuing lab — usually the manufacturer’s own QC unit, sometimes a contract or third-party testing lab — lists the specification for each tested parameter (an acceptable range, limit, or identity criterion) alongside the actual result obtained for that specific lot, and states whether the lot conforms.

A COA is evidence of testing performed at the point of manufacture or release. It is not, by itself, evidence that the material still meets specification when it arrives, that the container wasn’t compromised in transit, or that the lot number on the paperwork matches the lot number on the container in front of you — all of which is why receiving inspection exists as a separate step (see “When a Supplier COA Is Not Enough” below).

What Fields Does a Usable COA Need to Include?

There’s no single universal COA template — format varies by supplier, industry, and material type — but a COA that’s actually usable for incoming-material qualification needs to include, at minimum:

• Manufacturer/supplier name and address — who tested and released the material.
• Product name and catalog/part number — unambiguous identification of what was ordered.
• Lot or batch number — the single most important field to cross-check; this is what ties the paper to the physical container.
• Manufacture date and expiration or retest date — when the lot was produced and how long the stated results remain valid.
• Each tested parameter, its specification, and the actual result — not just a pass/fail summary. A COA that states only “conforms to specification” without the underlying numeric or qualitative results for each parameter is materially weaker evidence than one that shows, for example, assay = 99.7% against a specification of 98.0–102.0%.
• Test method reference — the compendial method (USP, EP, ASTM, ISO) or in-house method used for each result, so the receiving lab can judge whether the method is appropriate and comparable to its own.
• Units for every quantitative result.
• An overall conformance statement (e.g., “meets specification” / “released”).
• Signature, name, and date of the authorized QC/QA reviewer who approved the lot for release — an unsigned or undated COA has no accountable approver behind it.

Chemical COAs commonly add a CAS number and purity/assay percentage; biological materials commonly add sterility, endotoxin, and identity (e.g., species/strain) results; calibration standards and reference materials commonly add traceability to a national metrology institute (e.g., NIST) and an assigned uncertainty value.

How Do You Read and Verify a COA?

Verifying a COA is a specific, repeatable checklist step in incoming inspection, not a glance to confirm a document exists:

1. Match the lot number. Confirm the lot/batch number on the COA is identical to the lot number printed on the physical container’s label. A COA for the right product but the wrong lot is not valid evidence for the material in hand — this is the single most common COA-verification failure found in supplier audits.
2. Check results against your own specification, not just the supplier’s pass/fail statement. Your specification and the supplier’s may not be identical; a result that satisfies the supplier’s internal spec can still fall outside what your process requires. Read the actual numbers.
3. Confirm the test method is appropriate. If your process depends on a specific compendial method (e.g., a USP identity test) and the COA reports results from a different method, that’s a gap worth flagging, not assuming away.
4. Check the expiration/retest date against your intended use window. A COA reporting results that were valid at release doesn’t extend the material’s shelf life indefinitely.
5. Confirm signature and approval. An authorized-signatory field left blank, or a photocopied/reused signature block, is a red flag worth escalating.
6. Use the supplier’s verification portal where one exists. Many manufacturers now let customers look up a COA by lot number directly on the supplier’s website (via a QR code on the container or a lot-lookup tool) — cross-checking the document you received against the supplier’s own system is a stronger control than trusting a PDF alone, since it catches altered or mismatched paperwork.

When Is a Supplier’s COA Not Enough?

Relying on a supplier’s COA without any independent verification is a recurring finding in FDA inspections and ISO/IEC 17025 and ISO 9001 audits (see GxP Compliance: What GLP, GCP, GMP, and GDP Actually Require for the broader framework), and for GMP-regulated manufacturers it isn’t optional to skip. Under 21 CFR Part 211 (current Good Manufacturing Practice for finished pharmaceuticals), Subpart E governs testing and approval of components — 21 CFR 211.84 specifically addresses supplier certificates of analysis, and the general expectation regulators apply is that a manufacturer cannot simply file an incoming COA and release the component on that basis alone. At minimum, the receiving firm is expected to perform at least one confirmatory identity test on each lot of a component, and may only reduce further testing and rely more heavily on a supplier’s COA where it has established, and periodically re-validates, the reliability of that supplier’s testing through documented supplier qualification (e.g., periodic on-site or remote audits, historical conformance data, and comparative testing; see Nonconformity: ISO Definition, Major vs. Minor, and the NCR/NCAR Process for how a failed verification should be handled).

ISO 9001:2015 builds in the same principle from the buyer’s side under its requirements for control of externally provided processes, products and services (clause 8.4): an organization has to define and apply criteria for verifying that purchased material meets requirements before use, and a COA is one input to that verification, not a substitute for it. ISO/IEC 17025-accredited testing laboratories face an equivalent expectation for any reference materials, reagents, or calibration standards they bring in and rely on for accredited test results — the same accreditation logic that underpins proficiency testing and external quality assessment — the accreditation body expects to see the lab’s own verification activity, not just a filed supplier certificate.

In practice, “not enough on its own” usually means one or more of the following, calibrated to the material’s risk and criticality: an identity confirmation test performed in-house, a documented supplier-qualification program that periodically audits or re-verifies the supplier’s own testing reliability, comparative or trend analysis of COA results across multiple lots from the same supplier, and a physical/visual inspection of the container and label against the COA on every receipt regardless of testing decisions.

How Does a COA Differ From Related Documents Like a CoC or SDS?

COAs are frequently confused with, or bundled alongside, several adjacent documents that serve different purposes:

• Certificate of Conformance (CoC) — a shorter statement that a lot meets its specification, typically without reporting the underlying test results. A CoC tells you the supplier says it passed; a COA shows you the numbers behind that claim. Where both are available, the COA is the stronger record for incoming inspection.
• Safety Data Sheet (SDS) — covers hazard, handling, and safety information for a chemical product generally; it is not lot-specific and does not report quality test results.
• Certificate of Origin — a customs/trade document confirming where a product was manufactured, used for import/export and tariff purposes, unrelated to quality testing.

What to Do When a COA Is Missing, Incomplete, or Fails

Incoming-inspection SOPs usually describe the happy path in detail and the failure path in a sentence. In practice the failure path is where the regulatory exposure sits, and 21 CFR Part 211 is unusually explicit about the starting point. Under 21 CFR 211.84(a), each lot of components, drug product containers and closures “shall be withheld from use until the lot has been sampled, tested, or examined, as appropriate, and released for use by the quality control unit.” Quarantine is the default state of received material, not a punishment applied after something goes wrong. Everything below is a variation on how a lot leaves quarantine, or does not.

The COA never arrived, or arrived for the wrong lot

Treat these identically, because a COA bearing a different lot number is not evidence about the material in front of you. The material stays in quarantine and is physically or systematically segregated so it cannot be drawn into use. Request the correct lot-specific document from the supplier, referencing the purchase order, the catalog number and the lot number printed on the container. Suppliers that operate a lot-lookup portal will often let you retrieve the document yourself against the lot number or the QR code on the label, which is the faster route and also the stronger control, because a document pulled from the supplier’s own system cannot be an altered PDF. Record the discrepancy in the receiving record whether or not it is resolved quickly – a pattern of missing or mismatched paperwork is exactly the trend a supplier-qualification review is supposed to catch.

The COA is present but incomplete

A document that states only “conforms to specification” with no per-parameter results, or that has an empty signature or date field, or that cites no test method, is not a usable release record even though a COA technically exists. Ask the supplier for the complete document rather than accepting the summary. If the supplier declines or cannot produce per-parameter data, that is a finding about the supplier, and it should feed the qualification decision rather than being absorbed silently by the receiving lab.

A result is out of specification

Distinguish two cases, because they have different consequences:

• The result is outside the supplier’s own specification. The lot should not have been released to you, and the reasonable step is to reject it and return it. Under 21 CFR 211.84(e), a lot that does not meet the appropriate written specifications of identity, strength, quality and purity “shall be rejected” – the regulation offers no discretion to accept a failing component because the schedule is tight.
• The result is inside the supplier’s specification but outside yours. This is the more common and more dangerous case, because the paperwork says “pass” and the material is nonetheless unsuitable for your process. It is a nonconformity against your own requirement, not against the supplier’s, and it needs to be raised and dispositioned as one rather than waved through on the strength of the supplier’s conformance statement.

Either way the disposition belongs in a documented nonconformance record with an owner and a decision – accept, reject, return, or use under a formally justified concession – not in an email thread. CASRAI’s guide to nonconformity and the NCR/NCAR process covers how that record should be structured. Where the receiving lab’s own confirmatory test disagrees with the supplier’s COA for the same parameter, that discrepancy is itself the finding: it calls the supplier’s testing reliability into question, which is the specific thing 211.84(d)(2) requires a manufacturer to have established before leaning on supplier data at all.

The verification burden the regulation actually imposes

It is worth reading the operative sentence rather than paraphrasing it. 21 CFR 211.84(d)(1) requires that “at least one test shall be conducted to verify the identity of each component of a drug product,” using specific identity tests where they exist. 211.84(d)(2) then sets the terms on which a supplier’s document can substitute for your own full testing: a report of analysis may be accepted from the supplier “provided that at least one specific identity test is conducted on such component by the manufacturer, and provided that the manufacturer establishes the reliability of the supplier’s analyses through appropriate validation of the supplier’s test results at appropriate intervals.”

Two obligations sit inside that sentence, and firms routinely satisfy the first while neglecting the second. The identity test on every lot is the visible one. The periodic re-validation of the supplier’s results – comparative testing, trend review across lots, audit – is the one that lapses quietly, and its absence is what converts a reasonable reliance on supplier data into an inspection finding. Containers and closures follow a parallel but lighter rule under 211.84(d)(3): a certificate of testing may be accepted from the supplier provided the manufacturer conducts at least a visual identification and likewise establishes the reliability of the supplier’s test results at appropriate intervals.

COA Recordkeeping

Because a COA is the documented evidence behind a lot-release decision, it becomes part of the batch or lot record and is subject to the same retention and data-integrity expectations as other quality records under a GMP or ISO-based quality management system — attributable, legible, contemporaneous, original, and accurate (the ALCOA+ data-integrity principles commonly applied by regulators and auditors). Retention periods should follow the organization’s document-control procedure and any applicable regulatory minimum rather than a single fixed default.

For GMP-regulated material the minimum is set out in 21 CFR 211.180, and it is more specific than the “tied to shelf life” shorthand suggests:

• 211.180(a) – any production, control or distribution record specifically associated with a batch of a drug product must be retained for at least one year after the expiration date of the batch; for certain OTC drug products that lack expiration dating because they qualify for the exemption under 211.137, the period is instead three years after distribution of the batch.
• 211.180(b) – records for components, drug product containers, closures and labeling, which is the category a supplier COA falls into, must be kept for at least one year after the expiration date, or, for those same exempt OTC products, three years after distribution of the last lot of drug product that incorporated the component. That last clause is the one that catches firms out: the clock runs from the final product that used the component, not from the date the component was received.
• 211.180(c) – records must be readily available for authorized inspection at the establishment where the activities they describe occurred, throughout the retention period, and must be capable of being photocopied or otherwise reproduced during that inspection. Records retrievable immediately from another location by computer or other electronic means satisfy this, which is what makes a centralized electronic document system acceptable; an archive that takes days to recall from off-site storage does not.
• 211.180(d) – records may be kept as originals or as true copies such as photocopies, microfilm or microfiche, provided suitable reading and copying equipment is readily available.

Outside the GMP context the driver is different: an ISO/IEC 17025-accredited laboratory retains supplier certificates for reference materials and reagents for as long as its own accredited results depend on them being defensible, and an ISO 9001 organization sets the period in its own documented information controls. Neither imposes the 21 CFR 211.180 numbers, so a lab operating under both frameworks should not assume the pharmaceutical minima apply to it, nor that its own shorter default is adequate for any GMP-regulated work it takes on.

Frequently Asked Questions

Is a Certificate of Analysis legally required?

Requirements depend on the material and the regulatory framework governing its use. GMP-regulated pharmaceutical components fall under 21 CFR 211.84’s testing-and-approval requirements in the U.S.; many other materials (general lab reagents, non-regulated chemicals) have no independent legal mandate for a COA, but most reputable suppliers issue one as standard practice, and most quality management systems (ISO 9001, ISO/IEC 17025, ISO 13485) require some form of documented incoming verification for which a COA is common supporting evidence.

What’s the difference between a COA and a Certificate of Conformance (CoC)?

A COA reports the actual test results obtained for a specific parameter against its specification. A CoC is a shorter statement that a lot conforms, generally without the underlying data. A COA is the more informative document for verification purposes.

Does a COA guarantee the material is sterile or safe to use?

Only for whatever parameters it actually reports on. A COA that doesn’t include a sterility or endotoxin result says nothing about sterility, regardless of how complete the rest of the document looks — always check which specific tests were run, not just that testing happened.

Can a COA be trusted without any further verification?

Not in a GMP, ISO/IEC 17025, or ISO 9001 context. Regulators and accreditation bodies expect documented, risk-based verification beyond simply filing the supplier’s paperwork — see “When a Supplier COA Is Not Enough” above.

How long should a COA be retained?

Follow your organization’s document-control procedure and any applicable regulatory minimum retention period; for GMP-regulated components this is typically tied to the shelf life of the finished product the component went into, plus an additional defined period, not a single universal number.

Who signs and issues a Certificate of Analysis?

A Certificate of Analysis is issued by the manufacturer or supplier’s quality control laboratory and signed by an authorized QC/QA reviewer who approved that specific lot for release; an unsigned or undated COA has no accountable approver behind it and should be treated as incomplete. See the required-fields section above for the full signature and approval requirement.

Does every new lot need its own Certificate of Analysis?

Yes. A Certificate of Analysis is a lot-specific quality record, not a generic product datasheet — a COA for one lot describes only that lot, and receiving a different lot number always requires its own matching COA, verified by cross-checking the lot number on the paperwork against the lot number on the physical container.

What is the difference between a COA and a product specification sheet?

A product specification sheet (or datasheet) describes the general, expected properties of a product across all lots; a Certificate of Analysis reports the actual test results measured for one specific lot against that specification. A specification sheet tells you what should be true in general; a COA tells you what was actually measured for the material in hand.

What should you do if a shipment arrives without a Certificate of Analysis?

Keep the material in quarantine and segregate it so it cannot be drawn into use, then request the lot-specific document from the supplier against the purchase order, catalog number and the lot number on the container – or retrieve it yourself from the supplier’s lot-lookup portal if one exists. Record the discrepancy in the receiving record either way. Under 21 CFR 211.84(a), GMP-regulated components are withheld from use until sampled, tested or examined and released by the quality control unit, so quarantine is the default state of received material rather than an exceptional measure.

What if the COA arrives with the wrong lot number on it?

Treat it exactly as a missing COA. A certificate for a different lot is not evidence about the material in front of you, however complete it looks and however clearly it identifies the right product. Lot-number mismatch is the most common COA verification failure found in supplier audits, which is why matching the lot number on the paperwork to the lot number on the physical container is the first step of the verification checklist rather than a formality.

What happens if a COA result is out of specification?

If the result falls outside the supplier’s own specification, the lot should not have been released; 21 CFR 211.84(e) requires that a lot failing the appropriate written specifications be rejected. If the result is inside the supplier’s specification but outside yours – the more common case – it is a nonconformity against your requirement and needs raising and dispositioning as one, not accepting on the strength of the supplier’s conformance statement. Either way the disposition belongs in a documented nonconformance record with a named owner and a decision.

How long must a Certificate of Analysis be kept under 21 CFR 211.180?

Records for components, containers, closures and labeling must be retained for at least one year after the expiration date, or three years after distribution of the last lot of drug product incorporating the component for certain OTC products that lack expiration dating under the 211.137 exemption. The records must stay readily available for authorized inspection at the establishment where the activities occurred, and must be reproducible during that inspection; immediate electronic retrieval from another location counts.

Does a Certificate of Conformance satisfy the identity-testing requirement?

No. A CoC states that a lot conforms without reporting the underlying results, and neither a CoC nor a full COA removes the obligation under 21 CFR 211.84(d)(1) to conduct at least one test verifying the identity of each component. Supplier documentation can substitute for the rest of your testing only where you also conduct that specific identity test on the lot and have established the reliability of the supplier’s analyses through appropriate validation of their test results at appropriate intervals.

Regulatory text verified 23 August 2026 against the current eCFR for 21 CFR 211.84 and 21 CFR 211.180. Retention periods and testing obligations outside the U.S. GMP framework differ; confirm against the regulation or accreditation standard that governs your own operation.