Contract Manufacturer Testing: Why 'They Handle It' Is the Most Dangerous Phrase in Supplements

Subtitle: Your CM said they "test everything." They don't. Here's how to not get burned by a BS Certificate of Analysis.

---

You found a contract manufacturer. They've got the shiny facility photos, ISO certs on the wall, and a sales guy saying "we test everything" with a straight face. You sign. You launch. You're cruising.

Then a retailer asks for your heavy metals data. You forward the COA your CM gave you. The retailer's lab runs a split. Their results don't match. Now you're in a meeting with a lawyer who keeps saying "negligence" while you sweat through your shirt.

Here's the thing nobody tells you: your CM's testing program is not your testing program. And when the FDA comes knocking, they're not going after your CM. They're going after YOU.

Let's talk about how to actually protect yourself — over coffee, no filter.

---

The Legal Reality: YOU Are the Responsible Party

Your CM can have the fanciest lab in the world. It does not matter.

Under 21 CFR Part 111 (supplements) and 21 CFR Part 117 (food), the brand owner is the responsible party. Not the co-packer. You. The name on the label.

If your CM's lab faked a result, skipped a stability test, or "rounded down" that lead number — the FDA holds YOU accountable. "But my manufacturer said it was fine" won't fly.

I've seen the FDA cite brands for "failure to verify" CM testing. The CM? Zero consequences. The brand? Warning letters, lawsuits, recalls, and an awkward conversation with their Series A investors.

You need your own verification, not just their COAs filed in a folder.

---

What CMs Actually Test (vs. What You Think They Test)

Let's be real: most CMs test the bare minimum.

What Most CMs Test

What You Actually Need

• Full identity testing on every ingredient, every lot
• Per-lot microbial (not quarterly, not "first and last of the run")
• Full heavy metals panel (lead, arsenic, cadmium, mercury) — Prop 65 exists, people
• Potency verified by a third party at release AND at end-of-shelf-life
• Stability (accelerated AND real-time) — without it, your expiration date is fiction
• Disintegration/Dissolution for any tablet or capsule — otherwise that pill is an expensive pebble
• Allergen testing if your product claims "gluten-free," "dairy-free," or any free-from claim

Real story: CM's COA showed 500mg per capsule. Independent lab got 380mg — 24% under label. The CM's defense? "Our HPLC column was due for replacement." Cool. The FDA's perspective? You shipped misbranded product for six months.

---

How to Verify Your CM's COA

Your CM handed you a COA with checkmarks and a signature. Congrats, you have paper. Here's how to find out if it's fiction.

Step 1: Send Split Samples to an Independent Lab

Have your CM pull extra retain samples and send them directly to YOUR lab — not theirs, not their sister company's, YOURS.

Blind the samples. If your lab's results are within 5-10% of the CM's COA, you're fine. Wildly different? You've got a problem.

Step 2: Demand Raw Data, Not Just Pass/Fail

A COA that says "PASS" for heavy metals tells you nothing. Was it 0.001 ppm or 0.099 ppm with a spec limit of 0.1? One's fine. The other means your next lot could fail.

Demand actual numbers, the method used (USP? AOAC?), LOD/LOQ, and the analyst's name. If they won't give you raw data — what are they hiding?

Step 3: Trend the Data

One COA is a snapshot. Twenty is a trend. If potency is slowly drifting down over six months, your stability data is probably garbage and your product won't make label claim by month 18. Build a spreadsheet. Chart it. Flag problems now, not after you fail.

---

Questions to Ask a CM About Testing BEFORE You Sign

Most founders ask "do you test?" The CM says yes. Everyone moves on. Mistake.

The "Never Been Inspected" Red Flag

If a CM's never had an FDA inspection, either they're brand new (fine, but you're taking on risk) or the FDA hasn't found them yet — and when they do, you don't want your product in the building. Either way, you're the test pilot.

---

The Responsibility Matrix: Who Tests What?

Golden rule: If a result matters to YOUR brand — your label claims, your liability, your customer safety — YOU verify it independently. Period.

---

Building Testing Requirements Into Your Contract

Most CM contracts have one line: "Manufacturer shall test per its SOPs." Worthless. Here's what you need. Give it to your lawyer — don't sign without it.

Clause 1: Testing Standards

Testing Standards. Manufacturer shall test each production lot in accordance
with the Testing Schedule attached as Exhibit [X]. At minimum, each lot shall
be tested for: (a) identity of each dietary ingredient; (b) potency of each
ingredient claimed on the label; (c) microbiological contamination (TAPC,
yeast & mold, Salmonella, E. coli, Staph. aureus, Pseudomonas aeruginosa);
(d) heavy metals (lead, arsenic, cadmium, mercury), with LOD no greater than
[0.01 ppm] for lead; (e) disintegration/dissolution where applicable; and
(f) any testing required to substantiate label claims including allergen and
gluten-free claims. All testing shall use USP, AOAC, or equivalent validated
methods. Manufacturer shall provide raw numerical data, not pass/fail only,
within [5] business days of lot completion.

Clause 2: Right to Audit

Right to Audit. Brand Owner and/or its designated third-party auditor shall
have the right to audit Manufacturer's testing laboratory, quality systems,
and production records upon [14] days' notice, and immediately in the event
of a quality failure, recall, or regulatory inquiry. Manufacturer shall
provide access to all testing data, SOPs, calibration records, analyst
training records, and OOS investigation files. Manufacturer shall not
restrict or limit the scope of such audits.

Clause 3: Independent Verification

Independent Verification. Upon Brand Owner's request, Manufacturer shall
provide split retain samples from any production lot to Brand Owner's
designated independent laboratory at Manufacturer's expense (shipping only).
Brand Owner reserves the right to reject any lot where independent test
results differ from Manufacturer's COA by more than [10%] for potency
markers, or where independent testing identifies a failure not captured
by Manufacturer's testing.

Clause 4: Third-Party Audit

Third-Party Audit. Manufacturer shall, upon Brand Owner's request, undergo
a third-party GMP audit (e.g., NSF, UL, SGS, Eurofins) at Brand Owner's
expense. Manufacturer shall address critical or major findings within [30]
days. Failure to resolve critical findings within [60] days shall constitute
a material breach.

Clause 5: Quality Events and Recall

Quality Event Notification. Manufacturer shall notify Brand Owner within
[24] hours of any: out-of-specification result, confirmed consumer complaint
related to product quality/safety, FDA inspection or inquiry, or any event
that may trigger a recall. Manufacturer shall maintain traceability records
identifying all raw material lots used and all distribution points. In the
event of a recall, Manufacturer shall bear the cost if the recall arises
from Manufacturer's failure to follow specifications or GMPs.

Clause 6: Expiration Dating

Expiration Dating. Manufacturer shall not assign an expiration date without
documented real-time and accelerated stability data supporting the claimed
shelf life. Stability protocols must be pre-approved by Brand Owner.
Manufacturer shall provide all stability data, including degradation curves,
within [30] days of study completion. Products manufactured without valid
supporting stability data may be rejected at Manufacturer's expense.

Save these. Adapt them. Do not sign a CM agreement that skips this stuff.

---

When Your Independent Lab Gets Different Results

Your lab says lead is at 0.05 ppm. Your CM's COA says <0.01. Now what?

First: Check the Basics

• Same method? (USP <233> vs. random in-house?)
• Same LOD/LOQ?
• Same lot? (Check the number three times.)
• Same sample handling? (Did your retain sit in a hot truck for three days?)

Then: Send a Blind Split to a Third Lab

This is your referee. ISO 17025 accredited. Don't tell them what you expect. If the third lab agrees with your lab, your CM has a problem. If it agrees with your CM, you may need a new independent lab.

The Conversation Script

"Hey [CM], our independent lab ran splits from lot [XYZ] and got [result] — [X%] different from your COA. A referee lab confirmed our findings. Can we set up a call with your QC manager to walk through your method, calibration records, and how we resolve this?"

Document everything. If they get defensive or refuse to share raw data, that tells you everything.

Your Options

---

How to Audit Your CM's Testing Program

You don't need to be a chemist. You need to know what to look for.

Before You Arrive

Request these at least two weeks out: lab SOPs, equipment calibration/maintenance logs (12 months), analyst training records, OOS investigation files (12 months), COAs for the last 10 lots of YOUR product, method validation reports, proficiency testing results.

What to Look For On Site

• Equipment: Are balances calibrated daily? Check the logbook, not the sticker. HPLC maintenance up to date? Reference standards in date? (Expired standard = invalid results.)
• Samples: Retains stored correctly — not next to the break room microwave? Proper labels? Pull a random retain and verify it matches the COA. Try it.
• People: Ask an analyst to walk through their process. Do they understand WHY they're doing each step? Ask the QC manager: "What's your most common OOS?" If they say "none," they're lying.
• Paper trail: Pick a random COA. Ask to see raw data — lab notebook, instrument printout. If they can't produce it in 10 minutes, their doc system is broken.

If the CM Won't Let You Audit

Walk away. No legitimate CM blocks audits. If they're making excuses — "our lab partner doesn't allow it," "we'd need to schedule next quarter" — they're hiding something. Manufacturers proud of their quality systems want you to see them.

---

The "Dual Release" Approach

Here's how smart brands do it: dual release.

1. CM finishes a lot, runs in-house testing.
2. CM issues internal release — product is physically done, in quarantine.
3. Your independent lab runs verification on split retains.
4. Only after YOUR lab confirms do you authorize distribution.

The product never leaves quarantine until both parties say go. You catch problems before product hits shelves. No recall needed. No furious retailer.

Your CM will say dual release "slows things down." It adds 7-10 business days. Tradeoff: launch a week later, or launch on time with untested product that gets recalled a month later. Take the week.

---

Cost Allocation: What's In Your Price vs. What You Pay Separately

Already in Your CM's Per-Unit Price (GMP Requirements)

Per-lot identity, potency, microbial, heavy metals, disintegration/dissolution (solid dose), basic retain program, equipment calibration. If they're charging you separately for these, they're double-dipping.

What You Pay Separately (Brand-Level Responsibility)

At $2M revenue with one SKU, expect $30,000-80,000/year in testing. That's 1.5-4% of revenue. If that number scares you, you're not ready for this business.

The "testing included" trap: When CMs say testing is included, it usually means the bare minimum. Get a line-item breakdown of what they include, at what frequency, using what methods. No breakdown = marketing line, not a quality program.

---

How to Fire a CM Cutting Corners

You caught them fudging data or skip-lot testing. Time to go.

Step 1: Gather Receipts

Document every quality failure, missing COA, refused audit. Pull communications where they promised testing they didn't deliver. Confirm your contract lets you exit for quality failures (you added that clause, right?).

Step 2: Secure Supply First

DO NOT fire until your next CM is lined up. Panic-firing causes 6-month gaps that kill brands. Qualify the new CM quietly. Build 3-6 months safety stock. Get ALL your documentation out first — once you notify, cooperation may evaporate.

Step 3: Transfer IP

Your contract must assign you ownership of: the master manufacturing record, raw material specs with approved suppliers, finished product specs, analytical methods developed for your product, and all stability data. Without these, you're starting from scratch.

Step 4: The Conversation

"After reviewing our quality program, we've decided to consolidate production with a different partner. This is based on [specific quality issues — factual, not emotional]. We'd like to discuss a transition timeline to move our inventory, documentation, and IP smoothly. We're aiming to complete by [date]."

Don't threaten. Don't negotiate. If you've reached this point, they already had chances.

Step 5: Post-Transition Sweep

Confirm all your IP is out. Get written confirmation they've destroyed/returned retain samples, raw materials, and packaging specific to your product. Get exact SKUs, lots, quantities, and a timeline for any money they owe you.

---

FAQ

Q: My CM says they're "FDA registered" — are they GMP compliant? No. Registration is signing up on a website. GMP compliance means passing inspections with a functioning quality system. Ask for the inspection report, not the registration number.

Q: What's the minimum testing for a bootstrapped brand? Identity of every ingredient every lot, microbial every lot, heavy metals every lot. Potency is #4. Skip anything else before those three.

Q: My CM sends me their supplier's COA instead of testing themselves. Ok? No. The FDA explicitly says you can't rely on supplier COAs without periodic verification. Your CM (or you) must verify.

Q: Can I test less frequently if my CM has a "perfect track record"? No. Perfect track record = they're good, or they're not catching their own failures. You won't know which until YOUR lab runs splits.

Q: Real COA vs. BS COA? Real COA: product name, lot number, manufacture date, each test with spec and actual numerical result, pass/fail, method, analyst signature, date. BS COA: table full of "PASS" with no numbers and a stamp saying "QC Approved."

Q: How do I find a good independent lab? ISO 17025 accreditation. Ask: "Do you do supplement testing under USP methods specifically?" A general environmental lab that also does supplements is not the same. Labs to know: Eurofins, Alkemist, Covance, SGS, NSF, UL.

Q: What if my CM uses contract labs instead of in-house? Fine — IF you know who they are and can audit them too. Get the name, accreditation, scope. Send splits.

Q: "Testing" vs. "verification"? Testing is running the assay. Verification is YOU confirming the result through independent means. Testing without verification is just paperwork. Verification is the entire point.

---

Do This This Week

1. Monday: Request your last 10 COAs with raw numerical data.
2. Monday: Check your contract for testing clauses. Specific or generic?
3. Tuesday: Call an ISO 17025 lab for a split-sample verification quote.
4. Wednesday: Email your CM requesting their last two OOS investigation files. If they stall, you know.
5. Thursday: Start the conversation about auditing their facility.
6. Friday: Review your stability data. No real-time data supporting your expiration date? Start that study NOW.

---

Your CM is not your quality department. They're your vendor. Act accordingly.

---

Have a CM horror story? Questions about your specific setup? Drop a comment or reach out. I'm always here for a quality rant over coffee.