How to Read a Certificate of Analysis: What the Numbers Actually Mean

Subtitle: Because staring at a lab report shouldn't feel like reading ancient Greek.

---

You just got a COA back from the lab. It's a PDF with 14 pages of numbers, abbreviations, and columns you don't recognize. Your manufacturer says "everything passed." Cool. But what does passed actually mean? And more importantly — how do you know they're not feeding you a polished turd wrapped in ISO accreditation?

Here's the thing: a COA isn't just paperwork. It's the only proof you have that what's in your bottle matches what's on your label. If you can't read it, you're flying blind. And flying blind in the supplement game is how you end up with an FDA warning letter, an Amazon listing takedown, or worse — a customer who actually gets sick.

I'm going to walk you through a real COA section by section. By the time you finish this, you'll know exactly where to look and what should make your spidey sense tingle.

---

The Top of the Page: Who, What, When

Every legit COA starts with the boring stuff. But this boring stuff is where scammers get lazy.

What you should see:

• Lab name, address, and accreditation number. If it says "Accredited to ISO/IEC 17025" with a certificate number, that's table stakes. No accreditation? You don't have a COA — you have a nicely formatted opinion.
• Customer name. That should be YOU or YOUR manufacturer. If the customer field says "Generic Supplement Co." and you don't know who that is, ask questions.
• Sample description. Should match your product name and SKU exactly. If your product is called "Mega Man Greens Powder" but the COA says "Green Blend Sample A," that's sloppy at best and fake at worst.
• Date received, date tested, date reported. A COA from 2022 isn't a COA. Look at these dates. If a manufacturer sends you the same COA for every batch for two years straight, they're recycling docs.
• Batch/Lot number. This is non-negotiable. Every COA should tie to a specific batch. No lot number = no traceability = no way to verify anything.

Quick red flag check: Flip through a few COAs from the same manufacturer. Do the dates change? Do the lot numbers change? Do the actual numbers change? If every COA looks identical except for the date in the corner, someone's probably copy-pasting in Canva.

---

The Meat: Specs, Methods, and Results

Here's where most people's eyes glaze over. Let's make it stupid simple.

A COA for a supplement usually tests for a few core things:

Identity (Is this actually what we say it is?)

This confirms the raw material is what your supplier claims. Common methods: HPTLC, FTIR, or DNA barcoding. Look for the word "Conforms" in the result column. If it says "Not Tested" — uh, how do they even know it's elderberry and not dyed sawdust?

Potency/Assay (How strong is it?)

This is the active ingredient measurement. Suppose you're selling a turmeric supplement claiming 500mg of curcuminoids per capsule. The assay should show something like 505mg or 498mg — close to your label claim. A result of 312mg when you're claiming 500mg is a big problem. That's not a rounding error, that's a lie.

Critical: Check the method. HPLC is the gold standard for most botanicals and vitamins. If you see "UV-Vis" instead of HPLC for something that should be HPLC, ask why. UV-Vis is cheaper and less accurate.

Microbial Limits (Is there nasty stuff growing in it?)

You'll see rows for Total Aerobic Plate Count, Yeast & Mold, E. coli, Salmonella, Staph aureus. These should all say things like "<10 CFU/g" or "Absent" for pathogens.

⚠️ The Absent vs. <10 Game

Some labs write "Absent" when they actually found nothing. Some write "<10 CFU/g" because their detection limit is 10. Both can be fine, but if you see "Absent" for everything including TPC — where it should realistically be something like <1,000 or <10,000 CFU/g — that's weird. Real raw materials aren't sterile. A completely clean TPC is suspicious, not impressive.

Heavy Metals (Lead, arsenic, cadmium, mercury)

These should be listed with limits in parts per million (ppm) or parts per billion (ppb), and our heavy metal testing guide explains what those numbers should look like. Prop 65 in California has some of the strictest limits in the US. If your results say "Pass" but don't show the actual numbers, you're getting half a story. Always ask for the raw data.

---

The Bottom: Signatures, Stamps, and Reviewers

Scroll to the last page. There should be:

• A signature from a lab analyst or quality reviewer (actual human name, not "Lab User")
• Date of review
• Possibly a QA stamp or digital approval

A COA without a signature isn't a COA. It's a draft. I've seen manufacturers send "COAs" that were clearly just the raw data export from an instrument with no review at all. If nobody at the lab put their name on it, it hasn't been verified.

Also: check that the lab's contact info matches their actual website. I once saw a COA where the lab address was a residential home in Ohio. The "lab" was a guy with a pH meter in his basement. Great price though.

---

Red Flags I've Actually Seen

Over the years I've collected a greatest hits list of COA nonsense:

1. The COA that's literally a Word document. No headers, no accreditation logos, no signatures — just "Certificate of Analysis" typed in bold Comic Sans at the top. I wish I was kidding.
2. The "everything passed" with no numbers. If the only thing in the results column is "Pass" for all 47 rows, they're hiding something. Real COAs show actual values.
3. Out-of-spec results marked as "Pass." Yes, this happens. I've seen a lead result of 2.5 ppm when the spec was <0.5 ppm, and the result column still said "Pass." Read the numbers, not just the Pass/Fail column.
4. The expired accreditation. ISO 17025 certificates expire. Check the lab's accreditation on the accrediting body's website. Takes 30 seconds.
5. A COA dated BEFORE the batch was manufactured. If the COA date is March 1 but the batch wasn't produced until March 15, congratulations — you've caught a time traveler. Or more likely, a fake COA.

---

FAQ

Q: Do I need a COA for every batch? Yes. Every. Single. Batch. If your manufacturer says "we test once a year and it's always the same," run. Raw material quality shifts constantly. That's the entire point of testing.

Q: What's the difference between a COA from the raw material supplier and a COA from an independent lab? The supplier's COA is their own in-house testing. Independent lab = no conflict of interest. You want both. Trust but verify the supplier's COA.

Q: Can I use the manufacturer's COA as my own? Legally, it depends on what you're doing with it. For Amazon compliance, they accept third-party COAs from accredited labs. For your own records, the manufacturer's COA is fine — but you should still independently test at least the first batch and spot-check periodically.

Q: What if my manufacturer won't share the full COA? Red flag the size of Texas. There are legit reasons to redact supplier info on a COA, but the test results themselves shouldn't be secret. If they won't show you the numbers, they're hiding something.

Q: Do COAs expire? The COA doesn't expire, but the testing represents that specific batch at that moment. Shelf-life stability is a separate thing. A COA tells you what was in it at time of manufacture — not what's in it 18 months later on a shelf in Arizona in July.

---

The Bottom Line

Reading a COA isn't rocket science. You just need to know where to look: dates, lot numbers, methods, actual values (not just Pass/Fail), and a real human signature. Once you've seen a few real ones and a few fake ones, you'll develop a gut instinct for what smells off.

And if you're getting COAs that make your gut say hmm — that's exactly the moment you should get a second opinion. At LabQuotes, we connect supplement brands with accredited labs that do real testing and generate real COAs — not Word docs in Comic Sans. Get quotes from vetted labs, compare pricing, and stop guessing whether your paperwork is legit.

Get your product tested →