How to Read a Certificate of Analysis (COA)

What a certificate is actually for

A certificate of analysis is a record, not a marketing document, and it is not a guarantee of quality. It states that a specific lot of material was tested, by a named laboratory, on a stated date, using a stated method, with stated results. Everything that makes it useful follows from those five facts.

Its value is commercial rather than scientific. In this market every supplier claims purity, and none of those claims can be checked by looking at a website. A batch-linked certificate is the only claim that can be checked after the fact — by you, before you use the vial, rather than by trusting whoever sold it to you.

The four things a certificate cannot fake

A supplier can copy a format, borrow a logo and invent a percentage. What they cannot cheaply fake is a coherent chain of identifiers that resolves on a lab's own record.

The batch number should match the number printed on the vial, not just the number on the PDF. The laboratory should be a real, findable entity that you could contact without going through the supplier. The report number should be unique per test run — a supplier reusing one report number across products is publishing one certificate and pretending it covers everything. And the analysis date should fall inside the period the lot was actually produced.

Any one of those can be faked in isolation. All four, consistently, across a catalogue, is expensive to fake and pointless to fake if you are already testing.

Reading the number that matters: purity vs identity

Purity is the figure everyone quotes and the one that tells you least on its own. A sample can be 99% pure and still be the wrong compound — 99% pure table salt is 99% pure.

Identity is the question of whether the material is what the label says. In practice that is established by retention time against a reference standard on HPLC, and by mass accuracy from a mass spectrometer. A certificate that reports only a percentage has answered the purity question and skipped the identity question entirely.

Reference standards for that comparison are traceable materials, and NIST publishes what traceability means in practice if you want the definition rather than the sales claim.

"HPLC tested" on a product page therefore means almost nothing. It tells you a machine was involved. It does not tell you which machine, what it looked at, or what it found.

What the other panels tell you

For injectables, endotoxin load (measured by LAL assay) and sterility are the results that separate a usable product from a dangerous one. Neither can be detected by inspecting a vial, which is precisely why they have to be tested rather than trusted.

Heavy metals matter more for oral products than most buyers assume, because binders, dyes and pressing lubricants are an additional contamination route that an injectable never has. The element-by-element limits usually quoted come from the ICH Q3D guidance on elemental impurities.

Residual solvents show up when a synthesis was not cleaned up properly. Their presence is not automatically disqualifying, but a certificate that omits the panel altogether is telling you the panel was not run. The classification of which solvents are restricted, and at what level, is set out in ICH Q3C.

How to check a certificate in about ten seconds

Take the batch code off the label and put it into the supplier's public lookup. If the code resolves to a certificate without you having to email anyone, the chain exists. If it does not resolve, or resolving requires a support conversation, then what you are holding is a PDF, not a certificate.

Then compare four things between the PDF and the vial: the batch code, the compound name, the strength, and the date. Mismatches here are the most common failure and the easiest to spot.