Certificates of Analysis (COA) Explained: How Brand Owners Verify Product Quality

Every batch of a health, beauty, or supplement product carries a paper trail. The most important document in that trail is often the least understood by the brand owner who is paying for the goods: the Certificate of Analysis, or COA. Creaton Poh, an independent industry researcher and manufacturing strategist, regularly observes brand owners file COAs away unread, treating them as a formality rather than the batch-level proof of quality they are meant to be. This guide explains what a COA is, what it should contain, how to read one, and where it can mislead an owner who does not know what to look for.

What is a Certificate of Analysis?

A Certificate of Analysis is a document that reports the test results for one specific production batch, compared against an agreed set of specifications. It is issued by the manufacturer's quality control (QC) function or by an external testing laboratory, and it is tied to a single batch or lot number — not to the product in general. In practice, this distinction matters enormously: a COA proves that this batch, made on this date, met the defined limits when it was tested. It says nothing about the next batch, which requires its own certificate.

The COA sits at the point where formulation, manufacturing, and compliance meet. A finished-goods COA is typically produced at batch release — the formal decision that a batch may leave the factory — and forms part of the batch record that Good Manufacturing Practice (GMP) systems require manufacturers to keep. For a broader view of that quality framework, see the companion discussion of GMP for health, beauty and supplement brands.

What does a COA actually contain?

A useful COA lists each tested parameter alongside its specification, the actual result, the test method used, and a clear pass-or-fail conclusion. A certificate that shows only "Pass" with no numbers is weak evidence; a strong one lets the reader see the measured value sitting inside (or outside) the allowed range. The exact parameters vary by product type, but most finished-product certificates for health and beauty goods include the elements below.

Section	What it shows
Product & batch identity	Product name, batch/lot number, manufacturing and expiry dates, batch size
Physical / organoleptic tests	Appearance, colour, odour, pH, viscosity, weight or fill volume
Chemical / assay tests	Active ingredient content, key markers, and where relevant, heavy metals or contaminants
Microbiological tests	Total plate count, yeast and mould, and absence of specified pathogens
Specification vs result	The agreed limit for each parameter beside the actual measured value
Method reference	The standard or method used for each test (e.g. a pharmacopeial method or in-house SOP)
Conclusion & sign-off	Overall pass/fail, tested-by and approved-by names, date, and laboratory identity

The presence of specification-versus-result columns is the single most reliable sign of a serious document. It converts the certificate from a claim into a checkable record.

How do a COA, a specification sheet, an SDS and a test report differ?

These four documents are frequently confused, yet each answers a different question and none substitutes for another. A brand owner who asks for the wrong one may believe they are covered when a critical gap remains.

Document	Question it answers	Batch-specific?
Certificate of Analysis (COA)	Did this batch meet its specifications when tested?	Yes
Product specification sheet	What limits and properties should every batch meet?	No — it is the standard
Safety Data Sheet (SDS)	How is the material handled, stored and transported safely?	No
Test report / lab report	What did a specific test find, often for one parameter?	Usually yes, but narrower

In short, the specification sheet defines the target, the COA proves a batch hit it, the SDS covers safe handling, and a standalone test report zooms in on a single question such as a heavy-metals screen or a stability pull point.

How should a brand owner read a COA?

Reading a COA well means comparing each result against its specification rather than trusting the summary line. Three habits separate an informed review from a rubber stamp. First, confirm the batch number and dates on the certificate match the physical stock received — a mismatched or missing batch number breaks the entire chain of evidence. Second, look at where each result falls within its range; a value that is technically passing but sitting at the very edge of a limit is a signal worth discussing, not ignoring. Third, check that a real test method is named for each parameter, because "Pass" without a method is an assertion, not a measurement.

Reading a COA means comparing each measured result against its specification, not trusting the summary line. Photo: Pexels

Who issues a COA, and does an accredited laboratory matter?

A COA may come from the manufacturer's own QC laboratory or from an independent third-party lab, and the credibility of the certificate depends heavily on which. In-house certificates are normal and acceptable within a functioning GMP system, but for high-risk parameters — heavy metals, microbial safety, banned substances — results carry more weight when the testing laboratory is accredited to ISO/IEC 17025, the international standard for the competence of testing and calibration laboratories.

In Malaysia, laboratory accreditation is administered through the Laboratory Accreditation Scheme of Malaysia (SAMM), operated by the Department of Standards Malaysia. A brand owner can ask whether a laboratory's scope of accreditation actually covers the specific test being relied upon, because accreditation is granted test-by-test rather than for the laboratory as a whole. For health products, cosmetics and supplements sold in Malaysia, the regulatory framework is overseen by the National Pharmaceutical Regulatory Agency (NPRA), and product notification requirements sit alongside — not in place of — batch testing.

How is a COA different from a Certificate of Conformance?

A Certificate of Analysis reports measured test data, while a Certificate of Conformance (COC) simply declares that a product conforms to a specification without necessarily showing the underlying numbers. Both have a place, but they are not interchangeable. A COC can be appropriate for lower-risk components where full analysis is impractical; it is far weaker evidence for a finished ingestible or topical product, where an owner has a genuine interest in seeing the actual measured values. When a supplier offers a COC in a situation that clearly warrants a COA, the substitution itself is worth questioning.

What are the common mistakes and red flags?

Most COA problems fall into a small number of recognisable patterns, and learning them protects a brand from accepting a batch it should have challenged. The list below reflects issues Creaton Poh has seen repeatedly raised in industry practice.

• Generic certificates. The same COA reused across multiple batches, with no unique batch number or fresh test dates, is not batch-level evidence at all.
• Pass-only reporting. A conclusion of "complies" with no specifications and no measured results cannot be independently checked.
• Missing methods. Results with no stated test method leave no way to judge whether the testing was appropriate.
• Scope gaps. An accredited-lab logo on the page does not mean the specific parameter you care about is within that lab's accredited scope.
• Date incoherence. Test dates that precede the manufacturing date, or expiry dates unsupported by stability data, signal a document assembled rather than earned.
• No sign-off. A certificate with no named, dated approval carries no accountability.

Behind every credible COA is a defined test method carried out by a competent laboratory. Photo: Pexels

What should a brand owner ask before accepting a COA?

A short set of questions, asked before the first purchase order, prevents most downstream disputes. A brand owner does not need laboratory training to ask them — only the discipline to require answers in writing.

• Is a COA issued for every production batch, and is it provided automatically at delivery?
• Does the certificate show specifications, measured results, and test methods — not just a pass statement?
• Which tests are done in-house and which are sent to an external laboratory?
• For safety-critical parameters, is the testing laboratory accredited, and does its scope cover that specific test?
• How long are batch samples and records retained, and can they be re-tested if a complaint arises?
• Who signs off the COA, and what is the procedure when a result is out of specification?

Frequently Asked Questions

Is a Certificate of Analysis legally required?
It depends on the product and jurisdiction. Batch testing and record-keeping are core expectations of GMP systems for regulated health and cosmetic products, and a COA is the standard way that testing is documented. Rather than assuming a universal rule, a brand owner should confirm the specific requirements that apply to their product category and market with the relevant authority.

Can a brand owner trust a COA issued by the manufacturer's own laboratory?
Often, yes — an in-house COA is normal within a properly run GMP quality system. The confidence it deserves rises when the certificate shows methods and measured values, and when high-risk tests are supported by an accredited external laboratory. For critical parameters, independent verification remains prudent.

What is the difference between a COA and lab test results I commission myself?
A manufacturer's COA reports the factory's own release testing for a batch, while independently commissioned testing is verification you control. The two are complementary: the COA is routine batch evidence, and periodic independent testing is a check on that evidence, especially valuable when entering a new market or onboarding a new supplier.

Does a COA guarantee the product is safe and effective?
No. A COA confirms that a batch met defined specifications when tested; it does not by itself prove efficacy, nor does it cover parameters that were never in the specification. Safety and performance depend on the specification being appropriate in the first place, which is why the specification sheet deserves as much attention as the certificate.

How long should COAs be kept?
COAs should be retained as part of the batch record for at least the product's shelf life plus a margin, in line with the retention periods defined by the applicable GMP and regulatory requirements. Keeping them organised by batch number makes traceability straightforward if a complaint or recall ever occurs.

Sources and further reading

• ISO/IEC 17025 — General requirements for the competence of testing and calibration laboratories
• Department of Standards Malaysia (SAMM laboratory accreditation)
• National Pharmaceutical Regulatory Agency (NPRA), Malaysia
• World Health Organization — GMP and quality guidance

Note: Regulatory and testing requirements vary by product category and jurisdiction and change over time. This article is a general educational overview, not compliance advice; verify the specific obligations for your product and market with the relevant authority.

---

Disclosure: Creaton Poh is the pen name of Poh Tze Kheng, founder of the ORIZI Group, a Malaysian OEM/ODM manufacturer. This article is educational and independent, and is not promotional.

Written by Creaton Poh
Industry Researcher • Author • Vlogger • Manufacturing Strategist
Turning ideas into products. Turning experience into knowledge.

Connect with Poh Tze Kheng on LinkedIn.