A certificate of analysis (COA) is a document that confirms a product has been tested and meets specific quality standards. It travels with a batch of product from manufacturer to buyer, listing the exact tests performed, the acceptable limits for each test, and the actual results. You’ll encounter COAs most often when buying supplements, CBD products, chemicals, pharmaceuticals, or food ingredients, and they serve as proof that what’s on the label matches what’s in the container.
How a COA Works in Practice
Think of a COA as a product’s report card. A lab tests a specific batch of product, measures it against a set of standards, and records whether it passed or failed each one. The document then follows that batch through the supply chain. Distributors check it before storing or forwarding products. Manufacturers review it before using a raw ingredient. Consumers can request or download it to verify what they’re buying.
Each COA is tied to a single batch or lot number, which means it only applies to the specific production run it was created for. A product you bought last month and the same product you buy today could have different COAs with slightly different results, because they came from different batches.
What’s Listed on a COA
While the exact format varies by industry, most COAs share a core set of information:
- Product name and description: the specific item tested, including its grade or type
- Batch or lot number: the unique identifier linking the document to a specific production run
- Date of testing: when the sample was collected and analyzed
- Laboratory information: the name, location, and license or accreditation number of the lab that performed the testing
- Test methods: a description of how each test was performed
- Acceptance limits: the minimum and maximum values a product must fall within to pass
- Actual results: the numerical values the lab measured
- Pass/fail determination: whether the product met each specification
For supplements and CBD products, you’ll typically see results for potency (how much active ingredient is present), heavy metals like lead and mercury, pesticide residues, microbial contamination, and moisture content. Water activity, a measure of how much moisture is available for mold growth, is also checked for products prone to degradation. For pharmaceutical ingredients, the COA includes purity levels and detailed chemical identity confirmation.
Why COAs Matter for Supplements and CBD
The supplement and CBD industries are where consumers interact with COAs most directly. Under federal regulations (21 CFR Part 111), dietary supplement manufacturers can use a supplier’s COA instead of running their own tests on incoming ingredients, but only after qualifying the supplier. That means they have to independently verify the supplier’s results first, document how they did it, and periodically re-confirm accuracy. The COA must include the testing methods used, the acceptance limits, and the actual numerical results.
For CBD products specifically, a COA should show the full cannabinoid profile, confirming the CBD concentration matches the label and that THC levels fall within legal limits. Some state testing programs have known gaps. California’s required testing panel, for example, doesn’t include certain cannabinoids that form when products are heated, meaning the COA may not fully reflect what you actually consume. This is one reason checking a COA is valuable but not a guarantee of completeness.
Third-Party Labs vs. In-House Testing
A COA can come from the manufacturer’s own lab or from an independent third-party lab. Both can produce accurate results, but they carry different levels of credibility. In-house labs give companies direct control over their testing processes, instrument calibration, and quality checks. Third-party labs, especially those accredited to standards like ISO 17025, bring independent verification and specialized equipment that smaller manufacturers may not have access to.
For consumers, a COA from an accredited third-party lab is generally more trustworthy because the lab has no financial incentive to produce favorable results. If a company only provides in-house test results and won’t share third-party verification, that’s worth noting.
How to Read and Verify a COA
Start by matching the batch or lot number on your product’s label to the one printed on the COA. These must be identical. If a company posts a single COA for all their products without batch-specific results, that’s not useful verification. The lot number is usually printed on the product label after the words “Lot” or “Batch.”
Next, look at the actual results column alongside the specification limits. For heavy metals, results are typically reported in parts per billion (ppb). To put that in context, the FDA sets the lead limit for bottled drinking water at 5 ppb, and levels above 50 ppb in juice may be considered a health hazard. The COA will show concentrations, but whether those concentrations are acceptable depends on the regulatory standards for that product category.
Check that the lab is clearly identified with a name, address, and license number. A legitimate COA should also show the date of analysis, and that date should make sense relative to when the product was manufactured.
Spotting a Fake COA
Fraudulent COAs do circulate, particularly in the CBD market where inflating potency percentages can increase a product’s sale price. A few red flags to watch for:
- Inconsistent formatting: different font sizes or styles within the same document, misaligned columns, or visible crease lines and shadows that suggest parts were cut and pasted from other documents
- No QR code: many reputable labs now embed QR codes that link directly to the results stored in their database. These are difficult to forge. If a COA has a QR code, scan it and compare the digital version to the paper one. Any discrepancy between them means the paper version was altered.
- Unverifiable lab name: search for the lab listed on the COA. If you can’t find a website, accreditation records, or contact information, treat the document with skepticism.
- Missing test methods or limits: a legitimate COA lists how tests were performed and what the acceptable ranges are, not just the results
When you scan a QR code, it should direct you to a laboratory information management system hosted on a recognizable server. If the link goes to an unfamiliar or generic website, contact the lab directly to confirm whether the results are authentic.
COAs in International Trade and Manufacturing
Beyond consumer products, COAs are essential in global supply chains. When raw materials cross borders, the COA acts as an identification document during transfers between facilities, warehouses, and shipping points. It ensures that a batch of material can be traced from its origin through every stop along the way. For pharmaceutical manufacturers operating under Good Manufacturing Practice (GMP) standards, a COA from the ingredient supplier must include the ingredient’s name, grade, batch number, release date, and the numerical results of every required test.
In food manufacturing, chemical supply, and industrial applications, COAs function as a risk control tool. Every time a product changes hands, the receiving party reviews the COA to confirm identity and quality before accepting the shipment. Without this step, mislabeled, contaminated, or substandard materials could enter production and compromise finished products downstream.