What Is a Certificate of Analysis (COA)?

A certificate of analysis (COA) is a laboratory's signed report of the actual test results for one specific batch of a material, checked against that batch's written specification. It is not a general safety seal or a promise that every unit of a product is fine — it is a record of what one lab measured, in one sample, on one day.

The term shows up across pharmaceuticals, food, dietary supplements, chemicals and industrial materials, and the exact contents vary by industry. But the core idea — batch-specific, numeric, signed — holds everywhere the document is used.

What has to be on a real COA

There is no single global template. The closest thing to one for medicines is a model published by the World Health Organization's Expert Committee on Specifications for Pharmaceutical Preparations, which says plainly that its own format "is intended to serve as an example and not to be prescriptive." What it recommends a COA include is still a useful checklist for reading any batch report: the name and address of the lab that did the testing; an identification number for the certificate itself, with page numbers so pages can't be swapped; the sample's registration number and the date it was received; the product's name, batch number, and expiry or retest date; the name and address of the original manufacturer (and of any repacker or trader, if one is involved); the test methods and acceptance limits used; the actual results, in numeric form where possible; and a dated signature from the lab's authorized reviewer.

For pharmaceutical ingredients specifically, the U.S. FDA's Q7A guidance for active pharmaceutical ingredient manufacturing is more specific. Its Section 11.4 states that "authentic certificates of analysis should be issued for each batch of intermediate or API on request," and lists what belongs on one: the material's name and grade, its batch number and release date, the expiry or retest date, every test performed with its acceptance limits and numerical result, a date and signature from authorized quality-unit personnel, and the name, address and phone number of the original manufacturer. If a repacker, reprocessor or contract lab issues the certificate instead of the original manufacturer, Q7A says it should say so, name the original manufacturer, and attach a copy of that manufacturer's own certificate.

The common thread in both: a COA is tied to one batch, carries real numbers (not just a pass/fail stamp), and names who tested it and who is vouching for the result.

Who issues one, and for what

Most often, the manufacturer's own quality-control lab issues the COA for a batch it produced. But a contract testing laboratory can issue one on a manufacturer's behalf, and a repacker, relabeler or trader can issue a new certificate for material it redistributes — WHO's guidance and Q7A both say that in those cases the certificate has to disclose the relationship and point back to the lab that actually ran the tests. That distinction matters more than it sounds: a COA that names a repacker but not an underlying test lab is telling you less than one where the chain is spelled out.

Industries that lean on COAs most heavily are the ones where a batch failing spec is expensive or dangerous to miss: pharmaceutical ingredients, food (many countries require one for imported food shipments), industrial and specialty chemicals, and dietary supplements. The stringency varies a lot by industry and by country — a food COA and a pharmaceutical-grade API COA are built to very different standards.

COA vs. certificate of conformance

The two documents get confused because both are meant to reassure a buyer. A certificate of conformance (also called a certificate of compliance) is a broader statement that a batch meets its contractual or regulatory requirements; it typically does not show the underlying numbers. A certificate of analysis is the narrower, data-bearing document: it shows what was tested, by what method, against what limit, and what the result actually was. In practice this means a COA lets a reader check how close a result sat to its limit, or whether results are drifting across batches — information a conformance certificate alone doesn't give you.

What a COA proves, and what it doesn't

A COA is evidence about the sample the lab actually tested, not an ongoing guarantee. WHO's own guidance for quality-control laboratories is explicit that a certificate is not, by itself, proof that material still meets its specification once it has shipped, changed hands, or sat in storage — that's a separate question handled by receiving inspection and, where relevant, stability testing. A certificate is only as reliable as the lab that signed it, the chain of custody between the tested sample and the material in hand, and the honesty of whoever is presenting the document in the first place. Certificates get copied, mismatched to the wrong batch, or fabricated outright; a document with no verifiable lab behind it is not evidence of anything.

That is also where peptide-specific reading gets more technical than the general template above. A peptide COA typically needs to answer two separate questions that a simpler material's COA doesn't: is this actually the molecule it claims to be (identity, usually by mass spectrometry), and how much of the vial's net weight is that molecule versus water, salts and synthesis byproducts (purity by HPLC, and net content). Torrey Labs' guide to reading a peptide lab report walks through those checks in order, and the COA checker tool scores a given report against the same list. Public, per-batch reports can also be looked up directly by lot number rather than taken on a seller's word.

What's known versus unknown

What's well established: the WHO and FDA guidance above describes, in detail, what a complete, properly attributed COA should contain, and those requirements are decades old and widely cited across the industry. What's murkier, and not something any single certificate can settle on its own: whether the document in front of a particular buyer is genuine, whether the lab that signed it actually exists and is competent, and whether the batch described is the one that arrived. Spotting a certificate that's been altered, copied from a different batch, or produced by a lab that doesn't do the testing it claims is a separate skill from reading the numbers on a real one — and one with no universal technical fix, since a convincing fake can mimic the format of a real certificate closely.

What this means for researchers

A certificate of analysis is a useful document precisely because it is narrow: it tells you what one accredited or named lab found in one sample of one batch, against a stated method and a stated limit. That specificity is also its limit — it says nothing about batches it doesn't cover, and nothing about what happened to the material after the sample was pulled.

Reading one well means checking that it answers the basic questions above — which lab, which batch, which method, which numbers, whose signature — rather than treating the existence of a certificate, on its own, as the finding. A certificate that is vague about any of those points, or that can't be matched to a specific, lookup-able batch, is telling a reader less than it appears to.