Why Your Supplier's CoA Isn't Enough: ICP-MS Heavy Metals Verification for Herbal Raw Materials

A botanical raw material arrives at your Chicago-area warehouse with a clean CoA attached — lead “ND,” arsenic “ND,” heavy metals “passes.” Three weeks later, an independent analytical testing laboratory runs ICP-MS on that same incoming lot and finds 1.8 ppm lead in the dry ashwagandha powder. At a typical 2-gram serving, that translates to 3.6 µg of lead per dose — more than seven times California Prop 65’s 0.5 µg/day MADL. The supplier’s “ND” result came from a colorimetric USP <231> screen, a method that registers lead as non-detectable at anything below 10 ppm.

This scenario isn’t hypothetical. It’s a pattern we see repeatedly with Midwest supplement brands that rely exclusively on supplier-issued CoAs for heavy metals disposition.

The problem isn’t that suppliers are dishonest. Most aren’t. The problem is that a Certificate of Analysis is only as good as the method behind it — and outdated or mismatched testing methods can hand you a clean bill of health for materials that would fail an ISO 17025-accredited ICP-MS analysis every single time.

What Supplier CoAs Actually Report (and What They Don’t)

A standard supplier CoA for an herbal raw material will list a heavy metals entry alongside moisture content, microbiology, and identity. In many cases, that entry reads something like: “Heavy Metals NMT 10 ppm — Passes USP <231>.”

That single line carries a lot of hidden assumptions. USP <231> — the older colorimetric heavy metals test — is a semi-quantitative method. It gives you a pass/fail result against one aggregate limit. It doesn’t differentiate between lead, arsenic, cadmium, and mercury. It doesn’t tell you whether you’re at 0.5 ppm lead or 9.8 ppm lead. And because its effective detection range tops out around 5–10 ppm, materials with lead at 1.5–4 ppm can pass with flying colors while still being problematic for high-dose-per-serving products or SKUs distributed into California.

USP formally retired <231> as the primary elemental impurities method in May 2018, replacing it with USP <232> (Elemental Impurities — Limits) and USP <233> (Elemental Impurities — Procedures). The new framework specifies Permitted Daily Exposure (PDE) values for 24 individual elements across three hazard classes — and it mandates modern analytical methods like ICP-MS or ICP-OES for quantitative, element-specific reporting.

If your supplier’s CoA references USP <231>, you are not getting current data. Worse, a significant share of supplier CoAs don’t specify which method was used at all. That ambiguity is itself a quality signal worth paying attention to.

ICP-MS vs. Older Methods: Why Sub-PPB Resolution Changes Everything

Inductively Coupled Plasma Mass Spectrometry (ICP-MS) is the gold standard for trace elemental analysis in dietary supplements and botanical raw materials. An accredited analytical testing laboratory operating under ISO 17025 can routinely achieve detection limits below 0.001 µg/g — that’s 1 ppb, or three orders of magnitude more sensitive than a colorimetric USP <231> screen.

That resolution matters for several practical reasons.

First, botanical matrices concentrate elements. Ashwagandha, turmeric, spirulina, and several Ayurvedic and traditional Chinese medicine herbs are known bioaccumulators. A sample that reads as clean at 10 ppm resolution may carry a genuine lead burden of 1.5–3 ppm, which — depending on your serving size and daily dose — can push the finished product well above regulatory thresholds.

Second, ICP-MS resolves the Class 1 elements individually. Under USP <232>, each has its own oral PDE:

• Lead (Pb): 5 µg/day
• Arsenic (As): 15 µg/day
• Cadmium (Cd): 2 µg/day
• Mercury (Hg): 30 µg/day (total mercury; inorganic mercury carries stricter controls under ICH Q3D)

Reporting these as an aggregate number obscures which element you actually have a problem with and by how much. A formulator trying to reduce cadmium loading in a blend of six botanical ingredients cannot do that from a single “heavy metals ≤ 10 ppm” data point. They need element-specific concentrations against element-specific limits — and those only come from ICP-MS.

Third, testing under USP <233> procedures also covers Class 2A elements (cobalt, nickel, vanadium) and Class 2B elements (including selenium) that don’t appear on most supplier CoAs at all. For brands formulating toward NSF/ANSI 173 certification or selling into EU markets, those elements matter and need to be on the table.

USP <232> and <233>: The Regulatory Framework Your Incoming Testing Should Match

The USP <232>/<233> framework has been mandatory for finished dietary supplements since May 2018. But here’s where it gets operationally complicated: there’s no equivalent mandatory requirement forcing your raw material suppliers — particularly international botanical suppliers — to run their own CoA testing under <232>/<233> before shipment.

Under FDA 21 CFR Part 111, the Current Good Manufacturing Practice regulation for dietary supplements, the finished product manufacturer bears responsibility for verifying that all incoming components meet established specifications. The regulation doesn’t care where the testing was done or by whom. If your incoming ashwagandha carries a cadmium load that ends up in a finished product, the accountability sits with your operation — not your supplier.

This is why independent incoming verification at an analytical testing laboratory isn’t a best-practice recommendation — it’s a GMP obligation hiding inside a broader compliance requirement.

A well-designed raw material specification for botanical ingredients should include:

• Quantitative limits for Pb, Cd, As, and Hg expressed as µg/g, not “NMT 10 ppm aggregate”
• A calculation bridge from raw material concentration to daily dose exposure using your formulation’s actual serving size and USP <232> PDEs
• An explicit supplier CoA requirement referencing a method at least equivalent to USP <233> or an ISO 17025-validated ICP-MS procedure
• A skip-lot or periodic requalification schedule with your own independent analytical testing laboratory

That last point deserves emphasis. Botanical raw materials are agricultural products — batch-to-batch variability in elemental content is real and well-documented in the literature. Heavy soil metal levels, irrigation water quality, drying practices, and storage all influence the final elemental profile. Relying on a single passing CoA as standing evidence of ongoing compliance is a GMP gap, and it’s one that FDA investigators have flagged in warning letters to supplement manufacturers.

The California Prop 65 Gap That Trips Up Midwest Brands

A common assumption among brands operating out of Illinois and the broader Midwest: because we’re not based in California, Prop 65 doesn’t apply to us. That assumption has generated legal exposure for brands across the country, and it will continue to.

California’s Safe Drinking Water and Toxic Enforcement Act (Prop 65) requires businesses to provide a warning before exposing any individual to a listed chemical above a safe harbor level. For lead — classified as a reproductive toxicant under Prop 65 — the Maximum Allowable Dose Level (MADL) is 0.5 µg/day. That’s a full 10 times stricter than USP <232>‘s 5 µg/day PDE.

If you sell products through any California retailer, Amazon, or your own DTC website with California customers, Prop 65 applies to your product. And the exposure calculation is dose-based — it depends on your serving size and daily serving count, not just the raw ppm concentration in your material.

Consider a concrete example: an herbal product with 1 ppm lead in a 2-gram serving delivers 2 µg of lead per dose. That’s comfortably within USP <232>‘s 5 µg/day limit. But it’s four times over the Prop 65 MADL. Without ICP-MS data on your raw materials and a documented dose-adjusted calculation in your quality records, you can’t know where you stand — and you certainly can’t defend yourself if a Prop 65 enforcement action lands on your desk.

At our Chicago receiving facility in Countryside, IL, we build Prop 65 dose calculations into every incoming heavy metals report for clients distributing to California. That calculation — not just the raw concentration — is what determines whether a given lot is truly compliant for the product’s distribution footprint.

Building an Incoming Verification Protocol That Holds Up to Scrutiny

If your operation is currently accepting botanical raw materials based solely on supplier-issued CoAs for heavy metals disposition, here’s a practical framework for closing that gap.

Step 1: Rewrite your raw material specifications. Replace “heavy metals NMT 10 ppm USP <231>” with individual element limits for Pb, Cd, As, and Hg expressed in µg/g and back-calculated from your formulation’s serving size and the applicable PDE. If you distribute to California, use Prop 65 MADLs as your tighter reference standard.

Step 2: Qualify your suppliers against method capability. Ask each botanical supplier what method they use for heavy metals testing and at what detection limit. If they cannot confirm ICP-MS or ICP-OES with quantitation limits below 0.1 µg/g, their CoA cannot verify compliance to USP <232>/<233>. Document that gap in your supplier qualification file.

Step 3: Establish periodic independent verification. For high-volume suppliers with a consistent clean testing history, skip-lot verification — every third or fifth shipment — is a defensible approach. For new suppliers, independent testing on three consecutive lots before accepting CoA-only release is a reasonable first-article minimum.

Step 4: Build CoA review into your incoming materials procedure. Under 21 CFR 111.75, you must verify that each component conforms to established specifications before it enters manufacturing. A documented review that records a pass/fail determination against element-specific limits — signed, dated, and tied to the lot number — is what “verification” means in a regulatory context.

Step 5: Retain your independent analytical testing laboratory reports. When an FDA investigator requests your raw material testing records, presenting a third-party ISO 17025 report alongside the supplier’s CoA places you in a materially different evidentiary position than presenting the supplier’s CoA alone. That distinction matters in an inspection.

The goal isn’t to distrust your suppliers. Most botanical raw material suppliers operating at scale are testing conscientiously and in good faith. The goal is to build a quality system where your organization — not your supplier — makes the final compliance determination. Because under 21 CFR Part 111, that’s exactly the system FDA holds you to.

---

Written by Nour Abochama, VP Operations, Qalitex | Quality Consultant, Ayah Labs. Learn more about our team

Ship your sample to our Chicago facility — get a Qalitex CoA in 5–7 days. Contact us

Related from our network

• ISO 17025 Accredited Supplement & Raw Material Testing — Qalitex Laboratories — Full-scope ICP-MS elemental impurities analysis under USP <232>/<233> for supplement manufacturers requiring California Prop 65 compliance documentation.