The Difference Between a Test Report and a Compliance COA: What FDA Auditors Look for Under 21 CFR Part 111

Ask a typical supplement brand what happens when a pallet of ashwagandha root powder arrives at their dock, and you’ll usually get some version of the same answer: the supplier’s COA is checked against a short internal criteria list, the material passes a visual check, and it moves to storage. That workflow is standard practice across much of the Midwest supplement industry. It’s also the workflow that generates 483 observations.

The problem isn’t that brands aren’t testing. Many are. The problem is that “testing” and “testing against established specifications” are not the same thing — and FDA’s 21 CFR Part 111 is very clear about which one it requires.

What “Established Specifications” Actually Means

Under 21 CFR Part 111.70(b), you are required to establish component specifications in advance. Not when the lot arrives. Not when you send it to your analytical testing laboratory. Before the first lot of that material is ever received.

Those specifications must include, at minimum: a description of the component, any identity tests you’ll perform, acceptance criteria for purity and strength, and limits for any contaminants you’ve identified as risks for that specific ingredient. Every parameter needs a defined acceptable range — not just a target, but a clearly bounded pass/fail threshold.

This is the core distinction. A specification-driven COA documents that a material was tested against pre-defined limits and either passed or failed. A test report documents what a material was found to contain. One is a compliance record. The other is data. Auditors are trained to tell the difference in about 30 seconds.

The practical consequence: a COA showing “Lead: 0.03 ppm” with no specification limit, no method reference, and no pass/fail statement does not satisfy 21 CFR Part 111.75 — even if 0.03 ppm is well within any defensible acceptance range. Implied compliance is not compliance.

The Three Things FDA Auditors Look for on Every COA

In practice, the gaps in dietary supplement COAs tend to cluster around the same three areas. Get all three right and you’re well ahead of most of what FDA sees during routine GMP inspections.

Specification limits linked to each parameter. The result column and the specification column must both be populated. Leaving the specification column blank — or keeping it only in a separate internal document without a direct cross-reference — creates an audit trail that’s hard to defend. The cleanest format is unambiguous: Arsenic (As): Specification NMT 0.50 ppm; Result: 0.12 ppm; Status: PASS. Three fields. Linked. Explicit.

Method citations for every analytical parameter. Every number on a COA was generated by a method. That method needs to appear on the document. For elemental contaminants in botanical dietary supplements, USP <2232> is the applicable compendial reference. For pesticide residues, AOAC 2007.01 or an equivalent validated method. For microbial limits, USP <61> and <62>. For botanical identity, USP <561> or a validated HPTLC or DNA barcoding procedure with an in-house method reference number. If your analytical testing laboratory is issuing COAs without method citations, they’re shortchanging your audit documentation — and your exposure at any future inspection.

Explicit pass/fail determinations. This sounds obvious. It surprises many brands how often COAs arrive in QC inboxes with a column of numbers and no determination stated anywhere. “NMT 10 CFU/g” with a result of 7 CFU/g and no pass/fail line is not a completed compliance record. Your COA should not require interpretive work from whoever reviews it — including an FDA investigator working through your batch records under time pressure.

Where Midwest Supplement Brands Get Caught

Chicago’s position in the bulk botanical ingredient distribution network means a significant volume of herbal raw materials — ashwagandha, elderberry, turmeric, valerian, rhodiola — moves through Illinois, Ohio, Indiana, and Wisconsin distributors before reaching small and mid-size supplement brands. Much of it arrives with supplier COAs generated overseas, often by labs that are not ISO 17025 accredited, and frequently with the specification column left blank.

The brands receiving these materials aren’t doing anything unusual. But “standard practice” and “FDA compliant” have never been synonyms.

The failure usually looks like this: the brand’s internal specification document exists — built when they launched the product, filed in a quality binder. The contract analytical testing laboratory uses its own COA template, built for a different client type, which doesn’t include a specification column. The QC team reviews the results, mentally compares them to the binder, decides it looks fine, and signs off. Nobody notices that the COA doesn’t reflect a specification-driven review — until an auditor asks to see the documented pass/fail determination at the time of component release.

The other common failure is supplier verification programs that exist on paper but haven’t been executed. 21 CFR Part 111.75(a)(2)(ii) permits you to rely on a supplier’s COA, but only if you’ve verified that supplier’s results at least periodically through independent testing. That “periodically” needs to be defined in your SOP — typically every 6 to 12 months, or every N lots — and you need records showing the comparison was actually done and that results aligned within an acceptable tolerance. An SOP that says “periodic verification” with zero corresponding testing records is a first-pass 483 observation at most sites.

What a Compliant COA Template Looks Like

The cleanest way to close these gaps: don’t accept the default format from your analytical testing laboratory. Build your own specification table first — listing every parameter, the specification limit for each, and the expected method — and give it to the lab as a submission requirement before the first sample goes out.

A DSHEA-compliant COA for a botanical raw material should include, at minimum:

• Material name, botanical name with authority, plant part, and CAS number
• Lot number cross-referenced to your incoming receipt and purchase order
• Specification limit for each tested parameter, stated explicitly (e.g., “NMT 5 µg/day Pb, calculated at maximum daily dose per USP <2232>”)
• Test method reference for each parameter
• Quantitative or qualitative result with units
• Pass/fail determination for each parameter, signed or electronically authenticated by a qualified analyst
• Testing date and COA issuance date
• ISO 17025 accreditation number and scope reference confirming the specific methods are within the lab’s accredited scope

That last point deserves a separate conversation with your lab. ISO 17025 accreditation is lab-level; the accredited scope lists specific methods and matrices. A lab can carry ISO 17025 accreditation and still conduct certain tests entirely outside that scope. Request the scope document. Confirm the methods used for your materials are listed on it. If they’re not, the accreditation reference on your COA is technically accurate but functionally misleading.

A Workable Supplier Verification Protocol

For brands relying on supplier COAs with periodic independent verification, here’s a defensible minimum program that satisfies the 21 CFR Part 111 requirement without requiring a dedicated QC team of five.

1. Initial qualification. Independently test the first 3 lots from any new supplier using an ISO 17025-accredited analytical testing laboratory. Document that your results align with the supplier’s certificate within ±20% for quantitative parameters, or that the material meets the same pass/fail threshold for qualitative identity tests. This becomes your baseline.

2. Periodic re-verification. For established suppliers with a clean history, independent testing every 12 months on at least 1 lot, covering the highest-risk parameters: identity, heavy metals, and pesticides. Increase frequency if any lot shows a discrepancy or if you observe result drift over time.

3. Deviation management. A written procedure defining what happens when your independent result and the supplier’s COA diverge. Who reviews it? How is the material held pending investigation? Does the supplier get notified? The procedure doesn’t need to be complex — it needs to exist in writing and be followed consistently.

Brands in the greater Chicago area have a genuine logistics advantage here. Getting samples to an accredited analytical testing laboratory within 24 to 48 hours of receipt is realistic when the receiving hub is local, which makes same-lot verification the standard rather than the exception. Retrospective qualification — testing lots that have already been released into production — doesn’t satisfy the requirement to verify before use.

Start With the Specification, Not the Result

The mindset shift isn’t complicated, but it does require changing the order of operations. Build your specification table before you place your first purchase order for any new ingredient. Give it to your analytical testing laboratory before you collect the first sample. When the COA comes back, it should tell you, unambiguously, whether the material is in or out — not hand you a table of numbers to interpret on your own.

That’s the document FDA expects. And frankly, it’s the document your QC team deserves to work with.

---

Written by Nour Abochama, VP Operations, Qalitex | Quality Consultant, Ayah Labs. Learn more about our team

Ship your sample to our Chicago facility — get a Qalitex CoA in 5–7 days Contact us

Related from our network

• ISO 17025 Accreditation: What It Means for Your Supplement Testing Program — Qalitex Laboratories explains what accreditation scope means for raw material and finished product COA documentation.
• Raw Material Testing for Supplement Brands — From ICP-MS heavy metals to botanical identity, ISO 17025-accredited testing supporting nationwide DSHEA compliance programs.