Supplement COAs: The ‘Not Tested’ Trap and How to Build a Defensible Test Plan
While vetting a North American contract manufacturer with a client, we requested a sample Certificate of Analysis (COA). It looked tidy—until we spotted the fine print: the key active wasn’t tested on the finished product. The manufacturer leaned on regulatory language to skip testing and “save money.” Here’s how to spot that, what the rules actually allow, and how to negotiate a defensible test plan for your brand.
I’ve spent 15+ years in Regulatory Affairs & Quality Assurance across dietary supplements, foods, and natural health products for Fortune 500s and high-growth brands. This is the checklist I use.
Key Takeaway
A legitimate COA should report numeric results, units, methods, and who did the testing—for the finished lot you’re releasing. Many manufacturers try to skip finished-product potency by citing parts of 21 CFR 111.75. That exemption is narrow and conditional. If you rely on it without the required controls and documentation, you’re taking the regulatory hit and the brand-reputation risk.
1) What a Real COA Should Contain
Before you trust (or advertise) “third-party tested,” verify that your COA includes:
Product & lot identity: exact product name/SKU, lot/batch number, mfg date, expiry/best-before (if printed).
Specifications: identity, strength/composition, purity/contaminants (micro, heavy metals), physicals (e.g., tablet weight, disintegration).
Results with units: numeric values (e.g., 1,050 mg/serving), not just “Pass/Conforms.”
Methods: compendial or validated (e.g., USP <2040>, HPLC/UPLC, HPTLC for botanicals, ICP-MS for metals).
Laboratory: in-house or third-party; ideally ISO/IEC 17025 accredited.
Sign-off & dates: QA release signature, test dates, and any detection limits/LOQs.
If the method column shows vague acronyms (or none), or the results say only “Meets,” push back.
2) The “Component-Only” Testing Loophole—What 21 CFR 111.75 Actually Says
Manufacturers sometimes cite 21 CFR 111.75(c) or (d) to avoid finished-product potency testing. The regulations allow alternatives only when:
Scientifically valid methods for the finished matrix aren’t available or appropriate, and
You ensure specs via component testing, in-process controls, and a validated production/process control system, and
The program is documented with a sound rationale—why finished testing isn’t appropriate—and periodically verified.
Separately, reliance on a supplier’s COA for components requires supplier qualification, method equivalency, and periodic verification testing—not blind acceptance.
Reality: many COAs cite the section but don’t show the required rationale, controls, or verification. That’s where your risk lives.
3) Red Flags on COAs (Learn to Spot These Fast)
“Exempt from testing per 21 CFR 111.75…” with no documented rationale or verification plan.
Non-methods (e.g., invented acronyms), or methods that don’t match the analyte/matrix.
Pass/Conforms in place of numeric results for actives.
No lab named, no analyst sign-off, no dates.
Results = spec on every item (statistically suspect), or units missing/mismatched.
“Visual examination” used to “verify” potency or identity where an analytical method is expected.
Any one of these is a cue to request the underlying data—or to reconsider the supplier.
4) Why Finished-Product Testing Still Matters (Even If the Rule Allows Alternatives)
Label claim compliance: actives can degrade during blending, compression, or filling; you need data on the final matrix.
Homogeneity: components may pass, but the batch can still be non-uniform (dose variation).
Interactions: flavors, acids/bases, or excipients can affect recovery.
Stability: if you print a date, you need a rationale or data for your exact formula & packaging.
A practical posture: test finished potency (at least initially and periodically), and use component/in-process controls to tighten routine costs—not replace potency data entirely.
5) Negotiate a Defensible Test Plan (Without Blowing the Budget)
Here’s a pattern that works for startups and scale-ups:
Qualification lot(s): For each SKU, run full finished-product testing (potency, micro, metals as applicable) at launch.
Routine cadence: Move to skip-lot potency (e.g., 1 in every 3–5 lots) once process capability is proven; keep micro/contaminants at a risk-based cadence.
Supplier COA verification: Periodically verify critical raw materials (e.g., botanicals, amino acids, vitamins).
Hold & release: Contractually define release criteria, turnaround times, and who pays for tests.
OOS/Deviations: Pre-agree on investigations, re-test rules, and batch disposition to avoid last-minute disputes.
Lab choice: Prefer ISO 17025 labs; list acceptable methods up front (e.g., HPLC for vitamin C, HPTLC for botanical ID, ICP-MS for metals).
Put this into your Quality Agreement so it’s enforceable, not aspirational.
6) Build Finished-Product Specifications You Can Defend
Write specs that match your label and your risk profile:
Strength/composition: target + acceptance ranges for each active (e.g., 95–110% of label claim).
Identity: appropriate tests for each dietary ingredient (e.g., HPTLC for herbs, IR for simple actives).
Purity/contaminants: micro (pathogens/indicators), heavy metals (especially for plant-derived inputs), residual solvents where relevant.
Physicals: weight variation, disintegration (tablets/capsules), moisture/aw (powders), foreign matter/metal detection.
Methods: cite compendial where possible; if non-compendial, keep validation/verification on file.
Stability: if dating, maintain a written rationale or study plan (conditions, timepoints, acceptance criteria).
Specs without methods are suggestions; methods without results are marketing.
7) Marketing vs. Reality: Don’t Claim What You Don’t Do
If your site says “third-party tested”, you need third-party reports (or at minimum, defensible internal testing plus periodic third-party verification). If you say “every batch tested,” make sure your COA trail proves it. FTC truth-in-advertising applies here.
Frequently Asked Questions
Do I have to test every finished batch for potency?
Not always—if you meet the conditions for component/in-process control and document a solid scientific rationale. Practically, I recommend full finished-batch potency at launch and periodic verification thereafter.
Can I rely on supplier COAs for raw materials?
Only with supplier qualification, initial method equivalency checks, and ongoing verification. Relying blindly is a common FDA citation.
Our manufacturer gave us a one-page COA with ‘Pass’ everywhere. Acceptable?
No. Ask for numeric results, units, methods, and the lab. If they can’t provide them, reassess the relationship.
What if no validated method exists for our herbal blend?
Use marker compounds or appropriate identity techniques (e.g., HPTLC), and document why a direct finished-matrix assay isn’t feasible. Pair that with robust in-process controls and periodic verification.
Next Steps
Use this mini-checklist on your current manufacturer:
Request sample COAs with numeric results, units, methods, and lab identity.
Ask for the rationale if they cite 21 CFR 111.75(c)/(d) to skip finished potency—and the verification plan.
Put a written test plan and finished-product specs in your Quality Agreement (potency, micro, metals, stability approach).
Choose/qualify an independent lab and run one verification on your next lot.
If you want hands-on support, I can partner with you as your advisor / compliance partner to:
Review your current COAs/specs and design a cost-effective, defensible test plan.
Draft/renegotiate your Quality Agreement (release testing, skip-lot rules, OOS/CAPA, lab requirements).
Set up stability rationales and truth-in-advertising guardrails for “tested” claims.
Action steps:
Book a Signature Consultation to get a tailored 30-day plan for your brand and current supplier model. (Link: Book a Signature Consultation)
Or enroll in Supplement Startup Essentials Training (SSET) for step-by-step modules, exercises, and a full breakdown of the supplement industry that you can implement immediately. (Link: Join SSET)
Protect your label, your customers, and your margins—by making your COA mean what it says.