Third-Party Testing & COAs: What Every Supplement Buyer Should Ask

A certificate of analysis (COA) is the document buyers most often ask for — and the one they least often read carefully. It is easy to mistake a COA for proof of quality. In practice, a COA is only as useful as three things: what was actually tested, who ran the test, and whether the certificate really belongs to the batch you are buying. This guide walks supplement brands through those three questions so the next COA you receive tells you something instead of just filling a file.

1. A COA records a result; it does not guarantee one

A COA is a record of test results for a defined sample, not a promise about every unit in a shipment. The same document can be batch-specific (tested from the actual production lot you are buying), specification-based (values copied from a master template), or even generic (one certificate reused for many lots). Before the numbers matter, confirm which of these you are holding.

Under the FDA's current good manufacturing practice (cGMP) rules for dietary supplements — 21 CFR Part 111 — manufacturers must establish specifications for the identity, purity, strength and composition of finished products, as well as limits for potential contaminants, and must verify finished products against those specifications before release. That verification can be performed in-house or by a contract laboratory, and the manufacturer remains responsible for the result. For the buyer, the practical consequence is simple: a supplier that ships product without documented finished-product verification is out of step with the basic rulebook of the largest supplement market.

2. What a complete COA contains

Whether the certificate comes from the factory's own QC lab or an independent laboratory, a usable COA includes:

1. Product identity — exact product name, declared strength/form, and the specification sheet it refers to.
2. Batch/lot number and dates — production date, test date and, where relevant, expiry date. The batch must match the goods you are buying.
3. Laboratory identity — who performed the test, with contact information. For third-party work, an ISO/IEC 17025 accreditation reference that you can verify with the accrediting body.
4. Parameters tested — identity, active markers/assay, physical parameters, microbial counts, and heavy metals where applicable.
5. Specification and result for every parameter — the limit or range, the measured value, and the units. A COA that lists results without specifications tells you nothing about pass/fail.
6. Method references — named analytical methods (for example AOAC, USP or pharmacopoeia chapters) or a description of the method used.
7. Signature/authorization — a dated review by a responsible person.

NSF's guidance on certificates of analysis used for retailer compliance lists the same core elements: laboratory contact information, reference to ISO/IEC 17025 accreditation, parameters tested, results, units, specifications and method references.

3. "Third-party" has a specific meaning

The phrase "third-party testing" is used loosely. In the most useful sense, it means a laboratory that is independent of both the supplier and the buyer, operates under ISO/IEC 17025:2017 — the international standard for the competence of testing and calibration laboratories — and is accredited for the specific test methods it runs.

Two questions sharpen any claim:

• Who commissioned the test? A test ordered by the supplier is still useful; a test you commission yourself on a retained sample is stronger evidence.
• Is the accreditation verifiable? A laboratory should name its accrediting body and number. If the number cannot be checked — or the accreditation scope does not cover the method on the certificate — treat the certificate with caution.

Independent certification programs play a different role. NSF and USP certification marks are paid-for, audited programs covering testing and, in many cases, GMP audit; ConsumerLab is a subscription publication that buys retail product and publishes pass/fail results. Each answers a different question, and none replaces a batch-level COA from your supplier.

4. Know the numbers your market cares about

The same raw material can pass one market's limits and miss another's, so "the COA is clean" only means something against a defined benchmark.

In the United States, finished-product testing under 21 CFR Part 111 is the floor. Beyond federal rules, California's Proposition 65 safe-harbor exposure levels are far tighter than many conventional limits — commonly cited values for dietary supplements include lead at 0.5 µg/day, cadmium at 4.1 µg/day, mercury at 0.3 µg/day and inorganic arsenic at 10 µg/day (Eurofins summary, 2026). A product sold nationally often has to meet California's numbers, because a Prop 65 warning on the label is something most brands prefer to avoid.

In the EU, contaminants in supplements are regulated under food law (Regulation (EC) No 1881/2006 as amended), and limits can differ from US values. Microbial specifications commonly cited in the industry include total plate count, yeast and mould, E. coli and Salmonella — but the applicable limits depend on the product, the format and the target market, so ask for the benchmark rather than assuming one universal number.

Retail platforms have their own expectations. Amazon's dietary supplement policy, for example, asks sellers to demonstrate compliance with a COA from an ISO/IEC 17025-accredited laboratory verifying identity, potency and purity. A certificate that satisfies a factory's internal system may not satisfy the platform where your brand sells. Platform requirements also change over time — when you define your target platform and market, the testing panel and specifications should be aligned to the requirements in force at the time of sampling and production, not to a report designed for a different channel.

5. Red flags in a certificate

Review a COA the way you would review an invoice — quickly, but with a checklist:

1. No verifiable laboratory, accreditation number or contact details.
2. No batch/lot number, or a batch that does not match the shipment.
3. Results without specifications, or specifications without results.
4. Vague method references ("HPLC" without a method identifier) or methods not in the laboratory's accreditation scope.
5. The same certificate issued for many batches (look at dates and lot numbers).
6. Sample description that does not match the product (e.g., raw ingredient COA presented for a finished blend).
7. An "all pass" sheet with no negatives, no signatures and no dates.
8. A supplier who cannot produce the underlying full test report when asked.

None of these alone proves fraud. Together they are a good reason to ask for more — or to test a sample yourself. In practice, template COAs without a batch-bound serial number are not rare, so check the batch link every time: a certificate that is not tied to your lot should not be treated as listing evidence.

6. Raw material COA vs finished product COA

Buyers often receive an ingredient COA and assume it covers the finished product. It does not. A raw-material certificate says something about the ingredient as received; the finished-product COA must cover what is actually in the bottle or sachet after blending, encapsulation and packaging — including marker levels in the final matrix and contamination introduced downstream.

When you evaluate a supplier, ask to see both layers:

• Incoming material testing (identity, heavy metals, microbials) at intake;
• Finished-product testing against your agreed specification before release.

If a factory can only show you raw-material certificates, the finished-product quality system is not yet demonstrated.

7. Questions to ask before you commit

1. Is this COA batch-specific for the lot I am buying, and can you share the underlying full test report?
2. Was the finished product tested, or only the raw material/ingredient?
3. Which laboratory ran the test — in-house or third-party — and can I verify its ISO/IEC 17025 accreditation and scope?
4. What specification does the product pass, and who defined it (you, the factory, or a market requirement)?
5. Which heavy metals and microbial parameters are covered, and against which limits (FDA, Prop 65, EU or retailer)?
6. What method was used for the key active marker, and is that method within the lab's accreditation scope?
7. Do you retain samples for every batch, and can I commission my own test on a retained or shipped sample?
8. What happens if an independent test on my sample fails your COA — what is the investigation and remedy process?

The Huake Take

Most sourcing problems in supplements are not dramatic failures; they are quiet gaps between what a certificate claims and what a product delivers. Brands that survive in this category treat documentation as a spec item: batch-level COA, named test methods, a laboratory you could call, and a finished formula you can verify independently.

At Huake Biotechnology, every batch order ships with a batch-level certificate of analysis, and third-party laboratory reports are shared during the evaluation stage on request — before you commit, not after a problem appears. Tell us your target market and platform, and we will align the COA specification and testing panel to the requirements in force at the time of sampling and production, so you do not have to rework a generic report before listing. Sampling starts at USD 30 per formula, and if a supplier cannot answer the eight questions above in writing, the price difference is not worth the risk: a COA you can defend is cheaper than a recall, a delisting or a retailer rejection.