The COA Gap: Why Your Supplier's Certificate of Analysis Needs Third-Party Verification

Every quarter, we receive raw material samples from supplement brands across Illinois, Indiana, and Ohio — some of them well-established companies, others newer entrants scaling their first product line. Many arrive with thorough supplier COAs: protein or marker compound content, heavy metals panels, microbial limits, even HPTLC chromatograms attached as appendices. Clean documentation, professional formatting, reassuring numbers.

And a troubling share of those samples don’t match what the paper says.

That’s not a blanket accusation of deliberate fraud. COA discrepancies happen for reasons ranging from sample mix-ups to analytical method variability to genuine supply chain substitution — intentional or otherwise. But the consequence is identical regardless of root cause: your finished product is built on a foundation you haven’t independently verified. Under DSHEA and FDA’s cGMP framework, that’s both a regulatory risk and a product quality one.

What a Supplier COA Actually Tells You — And What It Doesn’t

A COA is a snapshot of one batch, tested once, by an analytical testing lab selected and paid by your supplier. That’s not a flaw in the document itself; it’s simply the nature of the relationship. The supplier’s contract lab was hired to confirm conformance. Most of the time the results are defensible. But the COA tells you nothing about:

• Whether the same testing method was used as the one referenced in your own specification
• What reference standard the supplier calibrated against — botanical identity is especially method-dependent
• Whether the sample they tested was truly representative of your specific lot
• The accreditation status, or lack thereof, of the lab that ran it

Under FDA 21 CFR Part 111 — the current Good Manufacturing Practice regulation governing dietary supplement manufacturers — you are required to verify the identity of each incoming component, regardless of what supplier documentation says. Section 111.75 is direct: a supplier’s COA may be used to reduce the extent of testing you conduct, but it cannot replace identity testing entirely for botanical ingredients. For each botanical raw material, at least one identity test must be conducted per incoming lot, every single time.

That’s a regulatory floor, not a quality ceiling. For botanicals with well-documented adulteration histories, operating at the floor is a risk posture, not a quality posture.

The Three Root Causes of COA Discrepancies in Botanical Raw Materials

Not every COA failure mode looks the same. Across years of incoming raw material verification, the discrepancies we see fall into three categories, each with a different testing implication.

Substitution and upstream misidentification

This is the category that generates the most regulatory and press attention, and for good reason. The American Botanical Council’s Botanical Adulterants Prevention Program has documented economically motivated adulteration (EMA) across more than 40 botanical species traded in commercial supplement supply chains. High-value or high-demand ingredients — ashwagandha, turmeric, black cohosh, elderberry, berberine, and saffron among the most cited — face elevated substitution risk, especially when global commodity prices spike. Sometimes a lower-cost species is swapped in whole or partially. Sometimes it’s genuine misidentification upstream, particularly with botanicals traded under multiple regional common names or species complexes.

The supplier’s analytical testing lab won’t catch this if their own testing didn’t. And many supplier labs use marker compound HPLC assays, which confirm that a compound is present at a given level — not that the material is authentically the labeled species.

Inter-laboratory method variability

A supplier COA may show curcuminoids at 95% by HPLC. Your specification requires 95% as measured by a validated method calibrated against a USP reference standard for curcumin I, II, and III combined. Same headline number, entirely different basis. We’ve seen gaps of 10–15 percentage points emerge between supplier-reported and independently verified marker compound assays for standardized botanical extracts — not because anyone was dishonest, but because the methods diverged.

This is a systemic issue with adaptogens and standardized herbal extracts. The phrase “standardized to X%” is essentially meaningless without the method behind it, and suppliers and buyers don’t always agree on which method defines conformance. Engaging an independent analytical testing laboratory that uses validated, pharmacopeial-aligned methods removes that ambiguity.

Heavy metals: lot-to-lot variation the supplier may not track

A batch of ashwagandha root from a particular region can show total lead well within the USP <232> limit of 0.5 µg/g. The next batch from the same supplier — different growing season, different source farm, same country of origin — can run two to four times higher. Not due to industrial contamination, but due to natural soil composition differences and the species’ variable accumulation profile. Suppliers who test heavy metals annually or quarterly against a fixed lot are issuing COAs that describe that lot, not yours.

ICP-MS analysis under the USP <232>/<233> framework gives elemental data at sub-ppb detection limits for arsenic, cadmium, lead, and mercury — the four Class 1 elements FDA considers of primary concern for supplement ingredients. No other technique in common use approaches that sensitivity for complex botanical matrices. If you’re formulating for a sensitive population — pregnant women, children, or anyone with compromised kidney function — you need that data from your specific lot, not an annual composite.

What an Independent Analytical Testing Lab Actually Finds

Industry testing programs have consistently documented substantial non-conformance rates for botanical raw materials and finished products alike. ConsumerLab’s ongoing independent testing program has found that, in some product categories, more than 30% of tested supplements fail to meet label claims or quality thresholds. A 2015 investigation by the New York State Attorney General’s office found that 4 of 6 major retailers had store-brand herbal products that could not be confirmed as containing the labeled botanical species by DNA barcoding — a result disputed methodologically by some researchers, but illustrative of the identity problem regardless of its precision.

At the raw material level, before any blending or encapsulation, the failure picture is at least as complicated. When we run botanical identity testing using HPTLC (high-performance thin-layer chromatography) against authenticated reference chromatograms, we’re examining a full chemical fingerprint — not a single marker peak. That fingerprint comparison catches partial substitution, species blending, and some processing-related alterations that a routine HPLC marker assay won’t detect. The American Herbal Products Association and the American Botanical Council both recommend HPTLC as the primary identity method for most botanical ingredients, precisely because the fingerprint approach is harder to game than a single-compound target.

For microbiology, USP <61> total microbial count and USP <62> specified organisms testing rounds out the incoming material picture. Powdered botanical materials — especially roots, barks, and dried aerial parts — can carry significant yeast, mold, and total aerobic plate counts. We routinely see results that are technically within acceptance criteria but tracking close to the upper limit. That’s a signal worth knowing before you blend 400–600 kg of material: one nonconforming lot can compromise an entire production run.

Building a Supplier Qualification Program That Actually Works

The goal isn’t distrust. It’s building an incoming material testing program robust enough that supplier relationships can grow on a verified foundation rather than assumed compliance.

A practical verification program under DSHEA and 21 CFR Part 111 has five non-negotiable elements:

1. Botanical identity verification per lot, every time. HPTLC against authenticated reference standards is the AHPA-recommended approach. DNA barcoding adds value for species-level confirmation but has limitations with concentrated extracts and complex matrices.

2. Heavy metals testing frequency matched to material risk. For botanicals with known Class 1 elemental accumulation patterns, test every lot. For lower-risk materials, quarterly sampling with lot-level traceability is a defensible minimum.

3. Independent assay confirmation for all standardized extracts. If you’re paying for 20% ginsenosides, 5% withanolides, or 35% polyphenols, an independent analytical testing laboratory should confirm those numbers against a traceable reference standard under a validated method — before you write the spec into a label claim.

4. Lab qualification for your suppliers’ test labs. A COA from an ISO 17025-accredited contract laboratory carries materially more weight than one from an in-house supplier facility with no external quality oversight. Know who ran the test and what quality system governed it.

5. Longitudinal data tracking across lots. A single test result is a data point. Twelve months of results from the same supplier is a pattern — one that will tell you things about supply chain consistency and seasonal variability that no single COA ever could.

At our receiving hub in Countryside, IL, we handle sample intake and chain-of-custody coordination for Midwest supplement brands before routing materials to ISO 17025-accredited testing. A standard incoming material verification package — botanical identity, heavy metals, and microbiology — comes back in 5 to 7 business days. That’s fast enough to integrate into most purchasing lead times without holding up production scheduling.

The COA from your supplier is a starting point. It’s documentation of what your supplier believes is in that bag. Third-party verification is how you confirm it — and under 21 CFR Part 111, that confirmation is your obligation, not your supplier’s favor.

Your quality system is only as strong as the least-tested link in your raw material supply chain. Make sure yours isn’t a sheet of paper.

---

Written by Nour Abochama, VP Operations, Qalitex | Quality Consultant, Ayah Labs. Learn more about our team

Ship your sample to our Chicago facility — get a Qalitex CoA in 5–7 days Contact us

Related from our network

• ISO 17025-Accredited Supplement Testing at Qalitex Laboratories — Full-panel raw material and finished product testing under ISO 17025 accreditation, with results you can put on a CoA.