Short answer: A supplement certificate of analysis (COA) is the lab record for one lot. Under FDA's supplement GMP rule (21 CFR 111), a supplier COA a manufacturer relies on must describe the test methods, the limits and the actual results. A useful finished-product COA also names your lot, covers identity, strength, purity and contaminants, and shows quality control approval. [1]
What is a certificate of analysis, and why does a private label brand need one?
Definition: A certificate of analysis is a lot-specific document that lists each test run on a product or ingredient, the method used, the acceptance limit and the actual result. For a private label supplement, it is the brand's evidence that the batch it is selling matches its specifications.
When a contract manufacturer makes your supplement, you are selling a product you didn't make yourself. The COA is how you see what was tested on your lot and what the numbers were.
FDA has been direct about who carries the risk. In a 2017 warning letter to a brand that outsourced production, FDA said that a firm releasing supplements under its own name "has an obligation to know what and how manufacturing activities are performed" and "cannot contract out its ultimate responsibility" for making sure those products aren't adulterated. [4] The COA is your main window into that, so it pays to know how to read one.
If you're still choosing a partner, asking for a sample COA is a good early test. See our 10 questions for choosing a private label manufacturing partner.
Key stats
- 3 items: a supplier COA must include the test method, the limits and the actual results before a manufacturer can rely on it (21 CFR 111.75). [1]
- At least 1 identity test: must be run on each dietary ingredient before it's used; a supplier COA can't replace it unless FDA grants an exemption. [1]
- 5 areas: Part 111 specifications must cover identity, purity, strength, composition and limits on contamination. [2]
- 0.5 µg per day: California's Proposition 65 safe harbor level (MADL) for lead as a reproductive toxicant. [6]
- 2.2 and 8.8 µg per day: FDA's interim reference levels for lead for children and for females of childbearing age. [5]
- 1 year past the shelf life date: how long Part 111 records must be kept (or 2 years after the last batch is distributed, if there's no shelf life date). [3]
What does FDA's supplement GMP rule say about COAs?
Part 111 doesn't use the COA as a stand-alone requirement. It sits inside a system of specifications and testing:
- Specifications come first. For each component and for the finished batch, the manufacturer must set specifications for identity, purity, strength and composition, plus limits on contamination that could adulterate the product. [2]
- Supplier COAs are allowed, with conditions. For components other than the identity of a dietary ingredient, a manufacturer may rely on the supplier's COA only if it first qualifies the supplier by confirming the supplier's results, the COA describes the methods, limits and actual results, the qualification is documented, the COA is periodically re-confirmed, and quality control reviews and approves the qualification records. [1]
- Dietary ingredient identity can't be outsourced to a COA. The manufacturer must run at least one appropriate test or examination to verify the identity of every dietary ingredient before use, unless FDA grants an exemption by petition. [1]
- Finished batches are verified against the specification. The rule allows testing a subset of finished batches chosen through a sound statistical sampling plan, or every batch, for selected specifications, with quality control review and approval. [1] So "Is every batch tested?" is a fair question to ask your manufacturer.
- The paperwork has to line up. The batch record must include the batch, lot or control number and the test results (or a cross-reference to them). [7] Records must be kept for 1 year past the shelf life date, or 2 years beyond distribution of the last batch if there's no shelf life date. [3]
What should a finished-product COA show, line by line?
Use this as a reading guide. The first column is what you'll see on most supplement COAs; the last column is what should make you ask questions.
| COA line | What good looks like | Red flag |
|---|---|---|
| Product name and lot number | Matches your label and the lot number in the batch record | No lot number, or a “typical” or “representative” result |
| Manufacture and expiration (or retest) date | Dates that fit your production run | Missing or mismatched dates |
| Test list | One row for each item in your specification: identity, strength (potency), purity, contaminants | Tests on your spec sheet are missing |
| Method | Each test names the method used | No method listed |
| Limit (specification) | The same limit as your written specification | No limit, or a looser limit than you agreed |
| Result | An actual number with units | Only “Pass” or “Conforms” with no number |
| Approval | Lab name, test date and quality control sign-off | Unsigned or undated |
The "actual number" point matters most. Part 111 requires supplier COAs to show actual results, not just a pass, before a manufacturer can rely on them. [1] Ask for the same on your finished-product COA.
Have a product in mind? Ask us directly.
How do you read the heavy-metals line?
Metals are often reported in parts per million (ppm). One ppm is one microgram (µg) per gram, so the useful number is the dose per day:
Example: a powder with 0.5 ppm lead and a 2-gram daily serving delivers 1.0 µg of lead per day. That's double California's Proposition 65 safe harbor of 0.5 µg per day for lead's reproductive toxicity. [6] A business has safe harbor from Proposition 65 warnings only when exposure is at or below those levels, so that product may need a California warning. [13]
FDA's interim reference levels for lead (2.2 µg per day for children, 8.8 µg per day for females of childbearing age) are benchmarks FDA may use to judge whether exposure is a health concern; they are not legal limits. [5] Write your metal limits into your specification both in ppm and in µg per daily serving, so the COA can be checked against both.
Supplier COA, finished-product COA or independent lab report: what's the difference?
| Supplier (raw material) COA | Finished-product COA | Independent lab report | |
|---|---|---|---|
| Covers | One lot of one ingredient | Your finished lot | A sample you send in |
| Issued by | The ingredient supplier | The manufacturer or its lab | An outside lab you choose |
| Rules that apply | Can be relied on only after the supplier is qualified; never for dietary ingredient identity [1] | Based on the manufacturer’s specification and sampling plan [1] | Your choice of lab; look for ISO/IEC 17025 accreditation, the standard that lets labs show they “operate competently and generate valid results” [8] |
| What it tells you | The ingredient met its spec | Your batch met its spec | Whether the manufacturer’s numbers hold up |
The COA Read-Through: 6 checks before you release a lot
SAMPLE — Example Greens Powder, Lot EX-0001, for illustration only
- Product
- Example Greens Powder
- Lot
- EX-0001
- Mfg date
- 2026-01-15
- Exp date
- 2028-01-15
| 2Test | 4Method | Limit | 3Result |
|---|---|---|---|
| Identity – spinach powder | HPTLC | Conforms to reference | Conforms |
| Vitamin C | HPLC | ≥ 60 mg/serving | 64 mg/serving |
| Lead5 | ICP-MS | ≤ 0.25 ppm | 0.12 ppm |
| Total aerobic count | USP <2021> | ≤ 10,000 CFU/g | 1,200 CFU/g |
- 1.Match. Product name and lot number match your label and batch record.
- 2.Spec. Every test in your specification appears, with the same limits.
- 3.Numbers. Each result is an actual value with units, not just "Pass".
- 4.Method. Each test names its method.
- 5.Dose math. Convert metals to µg per daily serving and compare with your limits.
- 6.Sign-off. Dated and approved by quality control; filed with the batch record and kept for the Part 111 retention period. [3]
How often should you test independently?
Part 111 doesn't give a brand a single number. One industry author's guideline for own-label brands is to compare the manufacturer's COA data with independent parallel testing for three lots at first, then at least one lot of each formulation every year, more often at higher volumes. [9] Treat that as a starting point and adjust for your product's risk and volume.
What does PMG provide on testing?
On supplements, PMG tests for heavy metals (lead, cadmium, arsenic, mercury), microbial contamination and potency as standard. [10] Testing is coordinated with accredited laboratory partners, and all testing data and reports are delivered to you as part of your product's regulatory file. [11] Private label supplements start at 1,000 units on select stock formulas and usually launch in 60–90 days; capsules, tablets and stickpacks run 5,000–10,000 units. [10] See our supplement manufacturing page, our product testing services, and what goes on the bottle in our private label supplement label guide.
Supplement COA Checklist (printable)
Download the fillable checklist (PDF)
Before you release a lot
- Written specification on file for identity, purity, strength, composition and contaminant limits
- Lot number on the COA matches the label and batch record
- Manufacture and expiration (or retest) dates present
- Identity result for each dietary ingredient
- Potency result for each label claim, with units
- Lead, cadmium, arsenic and mercury results, converted to µg per daily serving
- Microbial results against your limits
- Method named for every test
- Quality control approval and date
- Asked how finished batches are sampled (every batch or a statistical plan)
- Independent lab check scheduled (ISO/IEC 17025-accredited lab)
- COA filed with the batch record for the retention period
Frequently asked questions
Can I rely only on my contract manufacturer’s COA?
It’s a key document, but FDA has said a brand that outsources “cannot contract out its ultimate responsibility” for its products. Pair the COA with a written specification, documented review and periodic independent testing. [4][9]
Does a cosmetic need a COA?
There’s no cosmetic version of Part 111’s COA rules. MoCRA requires FDA to set GMP regulations for cosmetic facilities; FDA’s MoCRA page lists a 2023 listening session and a draft guidance, not a final rule. [12]
How long should I keep COAs?
Part 111 records must be kept for 1 year past the shelf life date, or 2 years beyond distribution of the last batch if there’s no shelf life date. [3]
Does “Pass” on a COA mean the product is safe?
It means the result met the limit written in that specification. Check the limit itself, especially for metals, using the dose math above.
What does PMG test on supplements?
Heavy metals (lead, cadmium, arsenic, mercury), microbial contamination and potency as standard, with the data delivered to you. [10][11]
Glossary
- Certificate of analysis (COA): a lot-specific record of tests, methods, limits and results.
- Specification: the written limits a component or finished batch must meet.
- Identity test: a test confirming an ingredient is what it claims to be.
- Strength (potency): how much of a labeled ingredient is present.
- Purity: freedom from unwanted substances.
- ppm (parts per million): for solids, micrograms per gram.
- µg (microgram): one-millionth of a gram.
- Statistical sampling plan: a documented method for choosing which batches or units to test.
- ISO/IEC 17025: the international standard for the competence of testing and calibration laboratories.
- Own-label distributor: a brand that sells supplements made by a contract manufacturer under its own name.
Have a product in mind? Ask us directly.
How Long Does Stability Testing Take for a Private Label Skincare Product? Accelerated vs Real-Time, Challenge Tests and Shelf Life
Accelerated stability testing typically runs about 3 months at PMG, with real-time testing to confirm shelf life. What cosmetics and OTC drugs need.
Read the article →Which Certifications Should a Supplement or Skincare Manufacturer Have? cGMP, NSF, USP, Organic, Kosher and Halal Explained
Certifications a supplement or skincare maker needs: what FDA requires, what NSF, USP and ISO 22716 audits prove, and organic, kosher, halal rules.
Read the article →What Has to Be on a Private Label Supplement Label? Supplement Facts, Claims, Disclaimer and Allergens
What a private label supplement label must include: 5 required statements, Supplement Facts rules, the claims disclaimer, allergens and adverse event contact.
Read the article →Who Is the Responsible Person Under MoCRA When You Private Label a Cosmetic?
Under MoCRA, the company named on a private label cosmetic's label is the responsible person. See who registers, lists and reports adverse events.
Read the article →Is Your Massage Oil or Muscle Rub a Cosmetic or an OTC Drug?
When a massage oil becomes an OTC drug: claims, FDA M017 menthol and camphor levels, child-resistant packaging, Drug Facts, minimums and timelines.
Read the article →Can You Private Label Hotel Amenities? Body Wash, Shampoo and Lotion for Boutique Hotels and Spas
How boutique hotels and spas private label body wash, shampoo and lotion: minimums, timelines, state small-bottle laws and what the label must include.
Read the article →What Is a Pilot Batch, and Can Your First Production Run Be Under 1,000 Units?
Lab sample vs pilot batch vs first production run, why tiny runs cost more per unit, six realistic options below 1,000 units, and a downloadable readiness checklist.
Read the article →Can You Private Label Essential Oils and Aromatherapy Kits for Amazon?
How claims set the FDA category, what Amazon hazmat review needs, when caps must be child-resistant, and PMG's minimums.
Read the article →Can You Make Sugar-Free Pectin Gummies with Allulose?
How the gel changes without sugar, allulose vs sugar alcohols vs monk fruit and stevia, what a sugar-free label needs, and realistic minimums.
Read the article →How to Choose a Private Label Manufacturing Partner
10 questions to ask before you sign, plus a free evaluation checklist.
Read the article →MOQ and Manufacturing Volume: What Actually Matters
Why minimums exist, what they cost below volume, and how to plan a first run you can sell through.
Read the article →How Much Does It Cost to Manufacture Supplements?
A phase-by-phase breakdown of R&D, ingredients, production, packaging, and compliance costs.
Read the article →What Does It Take to Manufacture an OTC Acne Product?
Allowed actives and strengths, Drug Facts labeling, NDCs and registration, and realistic OTC minimums and timelines.
Read the article →Sources and references
- 1.21 CFR 111.75, What must you do to determine whether specifications are met? (eCFR) https://www.ecfr.gov/current/title-21/chapter-I/subchapter-B/part-111/subpart-E/section-111.75
- 2.21 CFR 111.70, What specifications must you establish? (eCFR) https://www.ecfr.gov/current/title-21/chapter-I/subchapter-B/part-111/subpart-E/section-111.70
- 3.21 CFR 111.605, What requirements apply to the records that you make and keep? (eCFR) https://www.ecfr.gov/current/title-21/chapter-I/subchapter-B/part-111/subpart-P/section-111.605
- 4.FDA, Warning Letter to ProSupps USA LLC (Feb. 3, 2017) https://www.fda.gov/inspections-compliance-enforcement-and-criminal-investigations/warning-letters/prosupps-usa-llc-505396-02032017
- 5.FDA, Lead in Food and Foodwares https://www.fda.gov/food/environmental-contaminants-food/lead-food-and-foodwares
- 6.OEHHA, Proposition 65: Lead https://oehha.ca.gov/chemicals/lead
- 7.21 CFR 111.260, What must the batch record include? (eCFR) https://www.ecfr.gov/current/title-21/chapter-I/subchapter-B/part-111/subpart-I/section-111.260
- 8.ISO, ISO/IEC 17025 Testing and calibration laboratories https://www.iso.org/ISO-IEC-17025-testing-and-calibration-laboratories.html
- 9.Bruce Elsner, Own-Label Distributors and Contract Manufacturers: A Complex Relationship Requiring Mutual Support, SupplySide Supplement Journal (June 21, 2016) https://www.supplysidesj.com/manufacturing/own-label-distributors-and-contract-manufacturers-a-complex-relationship-requiring-mutual-support
- 10.PMG, Nutraceuticals and Supplements https://productmgmtgroup.com/industries/nutraceuticals-and-supplements
- 11.PMG, Product Testing and Stability https://productmgmtgroup.com/services/product-testing
- 12.FDA, Modernization of Cosmetics Regulation Act of 2022 (MoCRA) https://www.fda.gov/cosmetics/cosmetics-laws-regulations/modernization-cosmetics-regulation-act-2022-mocra
- 13.OEHHA, Proposition 65 in Plain Language https://oehha.ca.gov/proposition-65/general-info/proposition-65-plain-language
Fact-checked: 27 claims verified against sources; 4 adjusted.
Supplement COA Checklist
A fillable 1-page checklist with The COA Read-Through and all 12 checks to run before you release a lot.
PDF · 1 page
About Product Management Group
PMG is a full-service private label manufacturing partner for skincare, nutraceuticals, supplements, personal care, and wellness brands. We handle everything from R&D and formulation through manufacturing, packaging, regulatory compliance, and fulfillment, working with FDA-registered, GMP-compliant partner facilities in Florida, North Carolina, Texas, Minnesota, and Arizona. We work with everyone from first-time founders to established retail brands, with minimums starting at 1,000 units.