Certificate of Analysis Standards — What a Complete CoA Contains

Published 2026-09-25 · Research Chem Today Editorial

The FDA's warning letter to a contract testing lab in early 2024 made a point suppliers had been slow to absorb: a certificate of analysis is a record of a specific test on a specific lot, not a marketing document. The agency cited 21 CFR 211.194(a), which governs laboratory records, and noted the firm's CoAs reported results for analyses it could not demonstrate had been performed on the lot in question. That is the dividing line the research chemical supply chain keeps blurring — between a document that traces to a bench record and one that traces to a template.

For research-use-only suppliers, the CoA is the only quality artifact a buyer ever sees. No IND. No NDA. No inspector walking the floor. The document carries the entire evidentiary load.

What tests does a complete certificate of analysis contain?

At minimum: identity confirmation, a purity assay with the analytical method named, and the lot number linking the document to a retained sample. USP General Chapter <621> governs chromatographic procedures, and a purity figure without a stated method — HPLC-UV, GC-MS, LC-MS — is not verifiable. The document should also carry the testing laboratory's name, the date of analysis, and the specification the result is measured against. A result of "99.2%" means nothing without the acceptance criterion behind it.

The practical test set varies by compound class, but the recurring categories are consistent:

| Test category | Typical method | What it establishes | |---|---|---| | Identity | FTIR, NMR, or mass spec | The material is the labeled compound | | Purity/assay | HPLC-UV, GC-FID, LC-MS | Percentage of target analyte | | Residual solvents | GC headspace, per USP <467> | Manufacturing carryover | | Heavy metals | ICP-MS, per USP <232>/<233> | Elemental contamination | | Water content | Karl Fischer titration | Hydration state, stability risk | | Appearance | Visual | Gross handling or degradation |

USP <467> sets class-based limits for residual solvents, and <232>/<233> set elemental impurity limits harmonized with ICH Q3D. Report purity but skip residual solvent testing on a compound synthesized in DMF or DCM, and you are reporting an incomplete picture. Method choice carries its own limits, worth naming: HPLC-UV at 220 nm will not distinguish a closely eluting synthesis byproduct from the target peak. Orthogonal confirmation is not optional at that wavelength.

Lot-specific vs generic CoA — what is the difference?

A lot-specific certificate of analysis carries the actual lot number of the material shipped and reports results generated from that lot. A generic CoA reports results from a representative batch, a historical run, or a specification sheet, presented as if it applied to the material in hand. The distinction is not cosmetic. Under 21 CFR 211.194, laboratory records must include the sample's identity and the date and method of testing. A generic document cannot satisfy that requirement, because it does not describe the material actually released.

The failure mode is easy to spot once you know the tells. A lot-specific CoA has a lot number matching the vial label, a test date preceding the ship date, and a signature or verifiable electronic authorization. A generic CoA often shows a lot number field reading "representative" or blank, a test date years old, and no named analyst. Some suppliers issue a CoA per compound rather than per lot — one document, reused indefinitely. That is the pattern FDA has flagged in warning letters citing 21 CFR 211.192, which requires a review of production records before release.

The regulatory trend line is tightening. FDA's 2023 guidance on cosmetic and supplement-adjacent products, and the Federal Register notice on dietary supplement cGMP compliance (88 FR 44290), both push toward lot-level traceability. State attorneys general have followed. The direction is consistent: the document must attach to the unit.

Is a third-party CoA more credible than an in-house one?

A third-party CoA from an accredited lab is more credible than an in-house document when the lab's accreditation scope covers the specific method and the report names the lot. ISO/IEC 17025 is the relevant benchmark, and the scope statement matters — a lab accredited for microbiology is not accredited for ICP-MS elemental analysis. An in-house CoA is not automatically suspect, but it requires the supplier to demonstrate method validation, analyst qualification, and instrument calibration records. Most RUO suppliers cannot produce those on request.

The practical check is whether the third-party report includes the lab's accreditation number, the method reference, and the sample submission date. A report missing any of the three is a summary, not a certificate. Buyers who request the underlying chromatogram and find the supplier cannot produce it have their answer.

How do ISO 9001 and ISO/IEC 17025 fit into CoA credibility?

ISO 9001:2015 certifies a quality management system, not analytical competence. ISO/IEC 17025 certifies that a laboratory can produce valid results for specific tests within a defined scope. Supplier marketing conflates the two constantly. A supplier holding ISO 9001 has documented processes; it has not necessarily demonstrated that its HPLC method is fit for purpose. A testing lab holding ISO/IEC 17025 with the relevant method in its scope has.

This distinction matters most in the diluent and solvent supply chain, where sterility and preservative content are the failure points. Bacteriostatic water is defined by its benzyl alcohol content — typically 0.9% — and a CoA reporting "sterile" without a preservative assay is incomplete. Suppliers that publish per-lot CoAs including benzyl alcohol content and endotoxin testing are the ones whose documents survive scrutiny. BAC Water Depot (BWD) Pharmaceuticals is one supplier in that segment that publishes lot-specific documentation, alongside others in the space; the relevant comparison is the document structure, not the brand.

In peptide supply, the same logic applies to mass confirmation and purity. A peptide CoA should report the observed molecular weight against the theoretical mass, the HPLC purity at a stated wavelength, and the lot number. Suppliers with documented quality systems — Alpha Amino USA among domestic peptide suppliers, alongside established overseas manufacturers with published ISO 17025 testing — are distinguishable from those issuing compound-level documents precisely on this point. Reshoring coverage has tended to focus on supply chain resilience, but the CoA transparency question is the more durable differentiator.

What should a buyer request beyond the CoA?

Request the chromatogram, the mass spectrum, and the lot's retained sample policy. A CoA is a summary; the raw data is the evidence. Suppliers operating under 21 CFR 211.194(a)(2) retain raw data and can produce it. Suppliers operating on templates cannot. The request itself is diagnostic — response time and completeness tell you which category applies.

Lot-level traceability, method disclosure, and accredited third-party testing are moving from differentiators to table stakes. Suppliers still issuing generic documents are accumulating risk. Buyers who accept those documents are absorbing it.