How to Read a Certificate of Analysis for a Supplement

A Certificate of Analysis is the one document that proves what is actually in the bottle. Not what the formula intended, not what the label claims: what a lab measured in the specific lot that ships to your customer. It is the difference between “we make a clean product” and “here is the lot, here is the test, here is the number.”

Most CoAs get a glance at the word “PASS” and a trip to a folder. That glance is where brands get burned. A CoA that says PASS and nothing else is not proof; it is a claim wearing a lab’s letterhead. The document is either finished-product evidence you can hand to a marketplace, a national retailer, or an FDA investigator. Or it is a badge on a PDF. The two look similar at arm’s length and behave nothing alike when someone asks a hard question.

Reading one properly takes a few minutes and a short list of things to look for. Here is the list, and what each line is really telling you.

Educational overview: not legal, regulatory, or medical advice. Requirements change and vary by jurisdiction and sales channel. Last reviewed July 2026.

Short answer. A Certificate of Analysis is a lab’s report on one specific lot: what was tested, by which method, against which specification, and the measured result. A strong CoA shows numbers with units, names the method (HPLC-UV, ICP-MS), ties to a lot number that matches your product, and comes from an ISO/IEC 17025-accredited lab operating within its accredited scope. A bare “PASS,” an asterisk pointing to raw-material data, and a lab badge with no verifiable number are the three things that turn a CoA back into a claim.

Best for: Brand owners and Amazon sellers vetting a manufacturer, or checking an incoming lot before they sell it.

Key decision: Whether the document in front of you is finished-product proof you can show a marketplace or regulator. Or decoration.

Apollo path: Apollo issues per-lot CoAs through vetted ISO/IEC 17025 third-party labs and will read a real document with you, line by line; a manufacturing quote itemizes testing and CoA as their own line.

What a CoA is, and what “PASS” doesn’t tell you

A Certificate of Analysis is a lab’s report on a single lot. A complete one answers five questions for every parameter it covers: what was tested, by what method, against what specification, what the measured result was, and whether that result met the spec. Five answers per line. Miss any of them and the line stops meaning anything.

That is why a bare “PASS” is the most common failure in the wild. “PASS” collapses four of those five answers into one word and throws them away. Look at what you lose:

• The value. A potency line that reads “PASS” could be a result at 101% of label claim or at 199%. You cannot tell. One is a well-made product; the other is a dosing problem you are about to sell.
• The specification. Without the spec printed next to the result, “pass” means only that the result cleared some bar the lab used. You do not know what bar.
• The method. A heavy-metals number produced by the wrong instrument is a guess with a decimal point. The method is what makes the number real.
• The margin. A result that meets spec by a hair behaves differently over shelf life than one that clears it comfortably. The number tells you the margin; “PASS” hides it.

The useful unit on a CoA is not a verdict; it is result plus units plus specification plus method. When all four are present, you can compare the lot to its own label, compare this lot to the last one, and defend the line to anyone who asks. When they are missing, you are trusting a word.

The fields every CoA must carry

Before you read a single result, confirm the document is anchored to reality. These are the header and identity fields, the part that ties the paperwork to the physical lot in your warehouse and to a lab you can actually check. The table below is how a strong entry reads against the weak version that should stop you.

Fields and formats are illustrative; real CoAs vary by lab and by test panel.

The quickest check on this whole page is the lot number. A CoA for lot L-2406-0142 stapled to a pallet of lot L-2405-0098 is worthless for that pallet, however clean the results. It has to match the units in your hand, or it is describing someone else’s batch.

The four sections to actually read

Once the header holds up, you read the results in a deliberate order: identity, potency, heavy metals, microbial. Each section proves a different thing, and each belongs to a specific kind of test. Matching the test to the method is most of the skill.

Identity comes first because it is the question everything else depends on. If the material is not what it claims to be, its potency and safety numbers describe the wrong substance. This is also where federal expectations are most concrete: under 21 CFR 111.75(a)(1)(i), a manufacturer must “conduct at least one appropriate test or examination to verify the identity of any component that is a dietary ingredient” (in practice, identity testing on incoming dietary ingredients, not a spot check). A CoA that skips identity and jumps straight to potency has skipped the foundation.

Potency is the label-claim line. You want a measured number, in units, sitting at or a little above the claim. Slightly above is normal and expected: it is overage, the deliberate cushion that keeps a product at label claim through its shelf life as actives degrade. That is a formulation-and-stability decision, not a mistake, and one that runs larger in liquids than in dry formats. (The reasoning is its own topic; see the companion pieces on formulation overage and stability testing and shelf life.) What you do not want is a broad, meaningless range like “90–150%,” or a bare “PASS” hiding where in the range the lot actually landed.

Heavy metals (lead, cadmium, arsenic, and mercury) are a contamination check, usually run by ICP-MS, which reads down to parts per billion. A clean result reads as a number against a stated limit, or “< LOQ” / “ND” (not detected) with the limit of quantification printed. What should make you pause is “0.00” with no LOQ stated, or the word “report” sitting where a limit belongs; nothing measures to a perfect zero, so a clean “< LOQ 0.01” is more credible than a suspiciously round “0.00.” Limits themselves come from standards such as USP and, for products sold into California, from Proposition 65 safe-harbor levels that run materially stricter than federal reference points; both are covered in the heavy-metals testing and Proposition 65 pieces.

Microbial testing is the other half of safety: enumeration counts (aerobic plate count, yeast and mold) under USP <61>, and absence of specified organisms such as Salmonella and E. coli under USP <62>. Pathogens should read “Not Detected”; counts should sit under their limits with a number, not a bare pass. Liquids earn extra attention here; water activity and preservation make microbial control a live formulation problem, which is exactly why a liquid CoA that shows only potency and skips micro is a gap, not a shortcut.

Finished-product results beat asterisks and footnotes

Here is the distinction that separates a real CoA from a convincing one, and it hides in the footnotes.

A finished-product result tests the lot that ships to you: the blended, filled, capped, bottled product in its final form. A raw-material result tests an ingredient before it became your product. Both have a place. The problem is when a footnote quietly swaps one for the other. An asterisk next to a result, resolving to “verified via raw material,” “per supplier CoA,” or “based on input specification,” means the finished lot in your customer’s hand was never tested for that parameter. The number describes an ingredient, or a supplier’s paperwork, not the thing you are selling.

Sometimes that is legitimate, but only inside a documented framework, and it is narrower than most footnoted CoAs pretend. The federal rule, 21 CFR 111.75, draws the line precisely (and, as of mid-2026, this is the operative text):

• Identity of each dietary ingredient must be verified by testing: that “at least one appropriate test” standard from (a)(1)(i). You do not get to footnote your way out of confirming the material is what it says it is.
• For other component specifications, you may “rely on a certificate of analysis from the supplier of the component” but only after you qualify the supplier, establish the reliability of that certificate by confirming it yourself, keep the documentation, periodically re-confirm, and have quality-control personnel approve the basis. That is 111.75(a)(2)(ii). A footnote pointing at a supplier’s CoA without that qualification behind it is not the exemption; it is a skipped test dressed up as one.
• Separately, the manufacturer must verify that “a subset of finished dietary supplement batches” (chosen through a sound statistical sampling plan, or every batch) “meets product specifications for identity, purity, strength, composition,” and contamination limits. That is 111.75(c), and it lives at the finished level. Raw-material data does not satisfy it.

So the practical read is simple. When you see an asterisk, chase it. If it resolves to a documented supplier-qualification program plus finished-batch verification, fine. Ask to see that the program exists. If it resolves to “we tested the powder we bought and assumed the rest,” you are holding raw-material data with a finished-product label on it. The discipline behind a trustworthy supplier CoA is its own subject; see the ingredient-supplier qualification piece on what “qualifying the supplier” actually involves.

How to tell a real accreditation from a badge on a PDF

Every guide tells you to look for “ISO 17025.” Almost none tells you how to check it, or what the badge actually covers, which is where the real information is.

Start with the word. Laboratories are accredited to ISO/IEC 17025 (the international standard for the competence of testing and calibration laboratories) by an accreditation body, such as A2LA, ANAB, PJLA, or IAS in the United States, each a signatory to the international ILAC arrangement. Labs are not “17025 certified,” and no lab or facility is “FDA-approved.” The precise words matter because the imprecise ones are what unqualified documents reach for. “Certified to ISO 17025 standards” with no accreditation body named is a phrase engineered to sound like accreditation without being it.

Then understand the trap that no ranking page explains: accreditation is granted to a defined scope. An accreditation body does not bless a lab in general; it accredits specific methods for specific materials, listed on a published scope document. A lab can be accredited for microbiology and not accredited for trace-metal analysis by ICP-MS. A lab can be accredited to test dry powders and not liquids. So a “17025 lab” logo at the top of a CoA does not, by itself, mean the heavy-metals result three lines down was produced under accreditation. The test on your CoA has to be inside that lab’s accredited scope, or the badge is doing no work.

Verifying it takes about two minutes:

1. Find the accreditation body and certificate number on the CoA. If there is no body named and no number, stop; there is nothing to verify.
2. Look the number up in that body’s public directory. A2LA, ANAB, PJLA, and IAS each publish a searchable list of accredited labs and their certificates.
3. Open the scope and confirm it covers the exact test and material: potency by HPLC, metals by ICP-MS, micro by USP methods, for the matrix you make. If the certificate is expired, or the scope doesn’t list your test, the accreditation isn’t backing that line.

This is the whole “document you can show” test. A national retailer’s quality team, a marketplace reviewer, and an FDA investigator all run a version of the same check: numeric results, named methods, a lot number that matches, and an accredited lab operating in scope. Marketplaces and retailers expect exactly that and can suppress a listing when the paperwork doesn’t hold up; the Amazon compliance piece covers the marketplace specifics, and the CoA is one artifact inside the wider vetting process in how to verify a manufacturer. A document that survives the check is an asset; a badge on a PDF is a liability you haven’t been billed for yet.

A CoA, read line by line

Put it together on an illustrative example. Say you receive a CoA for a liquid vitamin D3, lot L-2406-0142, 2 fl oz dropper bottle. Here is the results block and how to read each line.

Illustrative CoA, not a real Apollo lot; every value is an example.

Read it in order. Identity is confirmed by HPLC-UV; the material is cholecalciferol, so every number below describes the right substance. Potency reads 27.4 µg against a 25 µg claim: a real number, in units, per stated serving, landing about 10% above claim (visible overage, exactly where a liquid should sit fresh). Heavy metals each read “< LOQ” with the limit of quantification printed, run by ICP-MS: clean, and honestly clean, not a suspicious “0.00.” Microbial shows counts under 10 CFU/mL and both pathogens not detected, by the USP methods. Every line names its method, shows a number or a stated non-detect, and carries a specification. That is a document you can stand behind.

Now imagine the weak version of the same lot: identity absent, potency reading “PASS,” metals reading “report,” micro reading “conforms” with no method column, and a header that names “an ISO 17025 lab” with no certificate number. Same product, same lot, but nothing on the page is verifiable, comparable, or defensible. The difference between the two documents is not the product. It is whether anyone measured it and wrote down what they found.

The red-flag scan

Run this list against any CoA before you accept a lot or sign with a manufacturer. Any one of these is a reason to ask a hard question; several together is a reason to walk.

• A bare “PASS” or “conforms” with no number, unit, or specification beside it.
• Asterisks or footnotes resolving to “verified via raw material” or “per supplier CoA” on a line that should be finished-product testing, with no supplier-qualification program behind them.
• “Report” or “N/A” where a limit belongs on heavy metals: a result with no bar to clear is not a result.
• “Typical values” or a technical data sheet instead of lot-specific analysis; that describes the product in general, not the batch you received.
• A lot number that is missing, or doesn’t match the units in your hand.
• No accreditation body or certificate number, or a test that falls outside the lab’s accredited scope when you look it up.
• “0.00” with no LOQ, or results that match spec perfectly on every line: real measurement has margins and detection floors.
• A stale date, an undated report, or a report date that precedes the manufacture date.
• Potency only, no safety: a CoA that shows actives but skips heavy metals and microbial is showing you the easy half.
• No authorized signature or QA release, and no page count.

If a manufacturer answers these plainly and hands you a document that clears them, you are dealing with a real testing program. If the paperwork can’t be decomposed (if every question comes back as “it passed, trust us”), that is your signal.

What a strong CoA looks like from the floor

The reason this article can name every field is that Apollo produces them. Per-lot Certificates of Analysis, issued through vetted third-party labs accredited to ISO/IEC 17025, with numeric results, named methods, and a lot number that ties to the batch record. Identity testing on incoming dietary ingredients, per 21 CFR 111. Testing and CoA quoted and invoiced as a distinct line, spec’d by panel and by lot, rather than folded into a unit price where you cannot see it. And the plain facts a buyer can verify: an FDA-registered facility in Livermore, California, running cGMP-compliant operations.

Note the words: the labs are accredited, not “certified”; the facility is FDA-registered, not “FDA-approved.” The precision is the point. A manufacturer that reaches for the bigger-sounding word on a compliance claim is telling you how it will describe a test result later. The whole quality and documentation section is built on the same principle: teaching you to demand exactly what a real program produces, then producing it.

That is the standard worth holding every manufacturer to, Apollo included: not “we test everything,” but “here is the lot, here is the method, here is the number, and here is the accredited lab you can look up.” A CoA that survives the read is a document you can build a brand on.

References

• U.S. Code of Federal Regulations, 21 CFR 111.75: What must you do to determine whether specifications are met? (identity, supplier-CoA reliance, finished-batch verification), verified via the Cornell Legal Information Institute mirror of the current CFR, July 2026.
• ISO/IEC 17025: General requirements for the competence of testing and calibration laboratories (International Organization for Standardization).
• United States Pharmacopeia, general chapters <61> and <62>: microbiological enumeration and tests for specified microorganisms.
• Laboratory accreditation bodies (ILAC MRA signatories): A2LA, ANAB, PJLA, IAS (public accreditation directories and scopes).