Building Specification-Driven COAs for Herbal Ingredients: What 21 CFR Part 111 and Amazon Both Require

Specification failures don’t make headlines. Contamination events do, product recalls do, label fraud does. But when FDA auditors walk into a dietary supplement facility and leave with a Form 483, one of the most consistently cited findings isn’t any of those — it’s something far more procedural: the company couldn’t demonstrate that its incoming botanical ingredients were tested against written specifications that the brand actually owned.

Under 21 CFR Part 111, you’re required to establish specifications for every component before it enters your manufacturing process, and you’re required to confirm the identity of each incoming lot independently. “We have a COA from our supplier” doesn’t satisfy that requirement. It never has. But with Amazon’s supplement marketplace enforcement tightening through third-party audits and accredited-lab partnerships over the past year, the consequences of that gap now extend beyond the FDA inspection cycle into listing suspensions and account-level holds.

The fix isn’t expensive or complicated. It’s a documentation workflow. Here’s exactly what that workflow needs to contain.

What 21 CFR Part 111 Actually Requires — And Where Most Brands Misread It

Section §111.70 of 21 CFR Part 111 requires written specifications for every component you use — every dietary ingredient, every excipient, every packaging material. “Component” is not limited to active botanicals; it includes the magnesium stearate in your capsule, the rice flour in your filler, and the silicon dioxide in your flow agent.

Section §111.75 is where enforcement concentrates. Specifically, §111.75(a)(1) requires you to conduct at least one appropriate test or examination to verify the identity of each lot of dietary ingredient received. Not each supplier relationship — each lot. If your ashwagandha arrives in 25 kg drums across three separate shipments, each shipment represents a distinct lot with its own identity verification requirement.

FDA has made this explicit in numerous warning letters. Sole reliance on a certificate of analysis provided by the raw material supplier — without independent identity testing — is cited as a violation of §111.75(a)(1). The agency’s rationale is straightforward: a supplier’s COA tells you what the manufacturer found in their facility, under their conditions, using their methods. It says nothing about whether the material was substituted, blended, or degraded before it reached your dock.

For botanical ingredients with documented adulteration histories — ashwagandha, turmeric, elderberry, rhodiola, and dozens of traditional Chinese herbs — that independent identity step is especially critical. DNA barcoding studies published in peer-reviewed journals have found substitution and adulteration rates as high as 30–40% in certain botanical ingredient categories sampled across commercial supply chains. The problem isn’t hypothetical.

The Six Elements of a Compliant Herbal Ingredient Specification

A specification that satisfies §111.70 and holds up to FDA scrutiny covers six elements. Missing even one can turn a routine inspection into a Form 483 observation.

Identity parameters. Define what the ingredient is: botanical name (genus, species, plant part), standardization markers where applicable (e.g., ≥5% withanolides for ashwagandha root extract), and the test method used to confirm identity. Acceptable methods include USP botanical monographs, HPTLC fingerprint comparison, DNA barcoding, or a validated HPLC marker-compound assay.

Purity limits. For herbal ingredients, this primarily means elemental impurities under USP <232>/<233>. For oral dosage forms, the Class 2 daily exposure limits are: lead ≤5 µg/day, cadmium ≤2 µg/day, inorganic arsenic ≤15 µg/day, and mercury ≤3 µg/day. If you’re sourcing any root material from South Asian, East Asian, or Eastern European supply chains, these aren’t academic thresholds — soil heavy-metal contamination in those regions is well-documented, and ICP-MS is the only method sensitive enough to quantify at these levels with regulatory defensibility.

Microbial limits. Per USP <61> and <62>: total aerobic microbial count (TAMC), total combined yeast and mold count (TYMC), and absence tests for Salmonella spp. and E. coli. For botanical dry powders used in oral supplements, a TAMC ≤10⁵ CFU/g is the standard limit under USP <2021>. Your specification should state the exact numerical limits, not merely reference the standard by number.

Moisture content. Typically ≤10% for botanical powders, though the appropriate limit varies by material. High moisture promotes mold growth during storage and affects potency calculations for standardized extracts. Your specification should state the limit and the method — Karl Fischer titration or loss on drying per USP <921> are both acceptable.

Physical attributes. Color, odor, appearance, and particle size. These serve as the first checkpoint in incoming QC, before you ever send a sample to an analytical testing laboratory. A specification that describes only chemical parameters misses the opportunity to catch substitutions at the receiving dock.

Rejection criteria. State explicitly what makes a lot rejectable. “Fails identity” is not sufficient. Which method? Against which reference standard? What does a failing result look like versus a passing one? A specification that two different analysts could interpret differently isn’t a specification — it’s a starting point for a compliance disagreement.

What Amazon’s Supplement Compliance Program Now Looks For

Amazon’s requirements for dietary supplement sellers have evolved considerably. The platform’s compliance program can request documentation at any time, and for supplement listings it typically expects:

• A COA from an ISO 17025-accredited laboratory — not a general contract testing lab — showing the product meets its label claims
• Lot-specific documentation, not a blanket annual or batch-level COA
• Test results dated within 12 months of the listing review
• For botanical products, confirmation that active marker compounds were tested, not only heavy metals and microbial limits

The ISO 17025 accreditation requirement is the detail that catches brands off guard most often. An accredited analytical testing laboratory has undergone independent third-party assessment of its methods, equipment calibration, analyst competency, and data integrity controls. That accreditation is what allows Amazon — and FDA — to treat a COA as a verifiable document rather than a piece of paper. A COA from a non-accredited facility, even a technically competent one, carries no auditable chain of confidence in either compliance context.

For herbal ingredient COAs specifically, Amazon has flagged submissions that address purity and microbial limits but contain no identity confirmation. That mirrors exactly what FDA requires under §111.75: identity is the primary test. Everything else follows.

Building a COA Workflow That Satisfies Both FDA and Amazon

The workflow that satisfies both FDA cGMP and Amazon marketplace compliance doesn’t require a quality department overhaul — it requires six deliberate steps executed consistently:

1. Write your specification before you source. Don’t let a supplier’s technical data sheet become your specification by default. Write your own document anchored in the USP monograph for the ingredient (if one exists), and set acceptance limits based on your intended daily dose and target consumer population.

2. Require lot-specific COAs from every supplier. Any supplier that provides a blanket annual COA rather than a lot-specific document is a quality risk. Each lot arrives with a unique growing origin, processing history, and contamination profile. Make lot-specific documentation a non-negotiable condition of the supplier agreement.

3. Submit a sample from every incoming lot to an independent analytical testing laboratory for identity confirmation. For high-risk botanicals, request HPTLC fingerprinting or DNA barcoding — both identify the plant at the species level, not just by marker compound concentration. For lower-risk ingredients, a USP organoleptic examination or microscopy may be justifiable, but document the risk rationale explicitly.

4. Test heavy metals via ICP-MS on a risk-stratified schedule. Under §111.75(b), you may reduce testing frequency once you have documented supplier qualification data in hand. But for root materials and any ingredient from a supply chain with established soil contamination risk, testing every lot is the defensible position — and the one that protects your brand if a contamination event reaches retail.

5. Link your COAs to lot numbers in your records system. FDA’s record retention requirement under §111.95 is two years from the date of manufacture. Amazon may request documentation covering the past 12 months. Keep your specification, the supplier’s COA, and your third-party lab COA all tied to the same lot identifier and retrievable within minutes.

6. Review your specifications on an annual cycle. As lot-specific data accumulates, your acceptance criteria should reflect what you’re actually seeing from qualified suppliers. If every lot comes in at ≤0.2 ppm lead when your specification permits the equivalent of ≤5 µg/day, that consistency is worth examining and documenting. An annual specification review is evidence of a living, functional quality system — not a paper exercise.

The Supplier Qualification Step Most Brands Skip

A specification-driven COA workflow is only as strong as the supplier qualification program behind it. FDA’s §111.80 requires you to maintain a list of approved suppliers backed by supporting data.

In practice: for the first two or three lots from any new botanical supplier, run the full analytical panel — identity, heavy metals by ICP-MS, complete microbial, and moisture. That data forms the foundation of your supplier qualification record. After demonstrating consistent results across multiple lots, you can build a risk-based case for reduced frequency testing on specific parameters — but only if you have that initial data to reference.

And for brands sourcing certified organic botanicals, one detail worth stating plainly: USDA organic certification does not address heavy metals or microbial contamination. Organic certification attests to agricultural practice — the absence of synthetic pesticides and fertilizers during cultivation. It says nothing about what accumulated in the soil or what occurred during post-harvest processing. Your specification must address heavy metals and microbial limits regardless of whatever organic designation appears on the supplier’s certificate.

---

For supplement brands shipping botanical samples from Illinois, Indiana, Wisconsin, Michigan, and Ohio, our Countryside, IL receiving hub accepts samples with same-day accessioning on shipments arriving before 3 PM local time. Standard identity panels, ICP-MS heavy metals per USP <232>/<233>, and full microbial testing per USP <61>/<62> return results within 5–7 business days, with a COA formatted for FDA cGMP records and Amazon compliance submissions.

---

Written by Nour Abochama, VP Operations, Qalitex | Quality Consultant, Ayah Labs. Learn more about our team

Ship your sample to our Chicago facility — get a Qalitex CoA in 5–7 days. Contact us

Related from our network

• ISO 17025-Accredited Supplement and Botanical Testing — Qalitex Laboratories — Full-panel identity, heavy metals, and microbial testing for dietary ingredients and finished supplements under ILAC-recognized ISO 17025 accreditation.