Certificate of Analysis and Certificate of Compliance: Reading, Issuing, and Verifying

The Certificate of Analysis (CoA) is the single document a QA professional handles more than any other. Every lot of raw material, excipient, primary packaging component, API, drug substance, and finished product carries one. It is the evidence that a specific quantity of material was tested against a specification and met it. Get CoA review right and you have a fast, defensible material release. Get it wrong and you have either a quality escape, where out-of-spec material reaches the floor, or a self-inflicted finding, where an inspector watches you accept a material whose certificate does not actually support release.

This article covers the CoA and its close relative, the Certificate of Compliance (CoC). It explains what each document is, the regulatory basis for requiring and reviewing them, what fields they must contain, how to read and verify one step by step, how to issue your own, how supplier reliance and reduced testing work, and the recurring mistakes that show up in audits and warning letters.

What a Certificate of Analysis is and why it exists

A Certificate of Analysis is a document issued by the party that performed testing on a defined lot of material, listing each test performed, the method or reference used, the specification limit (acceptance criterion), and the actual result obtained, together with a conclusion that the lot conforms or does not conform.

The CoA exists because GMP runs on documented evidence, not assertions. You cannot release material on the basis that a supplier says it is good. You release it because tests with defined acceptance criteria were run and the recorded results meet those criteria.

The regulatory basis

The core US requirements sit in 21 CFR Part 211 (Current Good Manufacturing Practice for Finished Pharmaceuticals):

21 CFR 211.84(a): “Each lot of components, drug product containers, and closures shall be withheld from use until the lot has been sampled, tested, or examined, as appropriate, and released for use by the quality control unit.”

21 CFR 211.84(d)(2): for components, a manufacturer may accept a supplier’s report of analysis “in lieu of” its own testing, provided that at least one specific identity test is conducted on the component and the reliability of the supplier’s analyses is established through appropriate validation of the supplier’s test results at appropriate intervals.

21 CFR 211.84(d)(3): for drug product containers and closures, a manufacturer may accept a supplier’s certificate of testing in lieu of its own testing, provided that at least a visual identification is conducted on the containers and closures and the reliability of the supplier’s results is established through appropriate validation at appropriate intervals.

So the regulation expressly permits CoA reliance, but with conditions that differ by material type. For components you still run your own specific identity test on each lot; for containers and closures you perform a visual identification of each lot. In both cases you periodically verify that the supplier’s results are real by testing against them.

For active pharmaceutical ingredients, ICH Q7 (Good Manufacturing Practice Guide for Active Pharmaceutical Ingredients, 2000) addresses the CoA directly in Section 11.4. Under that section, whenever a customer asks for one, the manufacturer is expected to provide a genuine, lot-specific certificate for each batch of intermediate or API, presenting the real values that testing produced and identifying the analytical procedures those values came from.

For finished product testing and release, 21 CFR 211.165 (testing and release for distribution) and 211.194 (laboratory records, which define what a complete analytical record looks like) govern the data behind the certificate. In the EU, EudraLex Volume 4 (the EU GMP Guide) Chapter 6 covers quality control and the data that must support release decisions.

ISO has a relevant general standard worth knowing by name: ISO/IEC 17025 (General requirements for the competence of testing and calibration laboratories, current edition 2017) governs how accredited laboratories report results, including content requirements for test reports. Contract labs that issue CoAs are often accredited to it.

Certificate of Analysis versus Certificate of Compliance

These two documents are routinely confused, and the difference matters at release.

A CoC tells you the supplier believes the material conforms. A CoA shows you the numbers so you can make your own conformance call. A common error is treating a CoC as if it were a CoA and “releasing on the data” when there is no data on the page. If a specification requires a numeric result (assay, water content, particle count), a CoC alone does not support release of that attribute.

What goes into a Certificate of Analysis

A complete CoA is identifiable by lot, traceable to a specification, and signed. The fields below are what a reviewer expects to find. Missing fields are not cosmetic; each one is a control.

For compendial materials, the method column should reference the actual chapter, for example USP general chapters such as <191> (identification tests, general), <197> (spectroscopic identification), <281> (residue on ignition), <731> (loss on drying), <921> (water determination, Karl Fischer), and the relevant monograph. The presence of correct compendial references is one of the fastest signals that a CoA is genuine and the testing was real.

CoA content by material type: biologics, cell and gene therapy, and combination products

Everything above assumes a small-molecule drug substance or excipient, where the CoA is a table of chemistry results: identification, assay, impurities, water content, microbial limits. That template does not transfer cleanly onto a biologic, a cell or gene therapy product, or the device constituent of a combination product, and reviewing one of those certificates as though it were a chemistry sheet is how the attribute that actually matters gets missed.

Biologics and cell and gene therapy

For a biological product, US regulation names four things a CoA, or the release testing behind it, has to address: identity (21 CFR 610.14), potency (610.10), purity (610.13), and sterility (610.12). Potency is the one most likely to be thin on a certificate built from a small-molecule template, and it is not optional. 21 CFR 600.3(s) defines potency as the specific ability of the product, shown by appropriate laboratory tests or by adequately controlled clinical data, to produce the result the product is intended to produce, and 610.10 requires an in vitro or in vivo test, or both, designed specifically for that product. A CoA for a monoclonal antibody, a recombinant protein, or a cell or gene therapy product should carry a relative potency result measured against a reference standard, not a bare “meets specification” line. That distinction matters at review: a generic pass/fail throws away exactly the information a potency assay was built to produce. See bioassay-and-elisa-validation for how those assays are validated and comparability-and-potency-assays for how the results get interpreted across a manufacturing change.

Cell and gene therapy certificates carry attributes with no small-molecule counterpart: vector genome titer or copy number, transgene expression, replication-competent virus or retrovirus testing for viral vector products, residual host cell DNA and host cell protein, viability and identity by flow cytometry, and, for an autologous product, the chain-of-identity linkage back to a specific donor-patient. Sterility is its own complication here. A product with a shelf life measured in hours cannot wait on the 14-day compendial sterility test, so many CGT products release on a rapid microbial method with the full compendial test running afterward as a confirmatory check. The certificate, or whatever record actually carries the release decision for a short-dated autologous product, needs to say plainly which result the disposition rested on. See sterility-testing-usp-71, bioburden-and-endotoxin-testing, and process-validation-for-biologics.

FDA’s expectations here are still in motion. The current final guidance is “Potency Tests for Cellular and Gene Therapy Products” (January 2011), which asks for a product-specific test without prescribing one, and the agency has more recently moved toward a potency assurance strategy, a set of complementary measures rather than one release assay, through draft guidance that has not yet finalized. A reviewer of a CGT certificate should expect the underlying assay panel to change as that strategy matures over a product’s life, and should confirm the certificate cites the assay version actually validated at the time of release rather than a superseded one.

Combination products

A prefilled syringe, an autoinjector, or an on-body delivery system pairs a tested drug or biologic constituent with a device constituent that has no chemistry-style acceptance criterion at all. Under 21 CFR Part 4, the device constituent still needs release evidence, but the results are functional and dimensional: break-loose and glide force on the plunger, dose accuracy and consistency, activation force on a needle shield or safety mechanism, container closure integrity, and, for an electromechanical on-body system, functional verification against its own spec. Folding all of that into a single document that looks like a chemistry table is a category error. Most sites instead reconcile a drug-constituent CoA against a separate device-constituent release record before writing one disposition. See combination-products-cgmp-part-4 for how the two constituent histories are built and the combination product constituent release reconciliation checklist for the reconciliation step itself.

The decision tree below routes a material to the right release logic before you go looking for the wrong kind of certificate.

A certificate across these modalities is fit for purpose when it names the specific assay version behind each result, reports potency as a quantitative outcome against a reference standard rather than a bare pass, and states plainly whenever a rapid method stood in for a slower confirmatory test at the moment of release. Ownership typically splits three ways: the analytical or bioassay group that generates the specialized result, the group that maintains the reference standard the result is measured against, and QA, which reconciles constituent-specific release records into a single lot disposition. Name that split explicitly in your review checklist, because a chemistry-only checklist has no line item for “which assay version” and will not catch its absence.

Certificates of analysis for reference and working standards

Every result on every certificate discussed so far was measured against something: a reference standard. Get that standard’s own value wrong, or let it drift unnoticed, and every certificate built on it is wrong in the same direction without any individual test ever failing on its own. Reviewing a reference standard’s own documentation is a different exercise from reviewing a routine material CoA, and it is easy to skip because the standard sits in the background of every other release decision rather than the foreground of any one of them.

A primary reference standard, ideally sourced from a pharmacopeial body such as USP or EP, or another internationally recognized source, comes with an assigned value, its uncertainty, and a defined storage and requalification regime. Treat its certificate or characterization record the way you would treat any controlled document, not as a routine supply item. Most labs cannot run every test against the primary standard directly, so they qualify an in-house working standard against it through a bridging study: run both standards through the method side by side, confirm the working standard’s assigned value and its agreement with the primary standard fall within a predefined range, and only then put the working standard into routine use.

Worked example. A QC lab qualifies a new lot of in-house working standard for a therapeutic monoclonal antibody’s potency assay by running it against the current working standard, itself bridged to the international reference standard for that molecule class two years earlier, across six independent assay runs. The new lot’s relative potency against the current standard falls within the predefined bridging acceptance range, a tight window around 100% set during method validation, so QA approves it, and the new lot enters use with an overlap period against the outgoing lot rather than a hard cutover.

The reference standard custodian, usually a QC or analytical development role, runs the bridging study and maintains the inventory and expiry tracking; the analytical or bioassay lead owns the acceptance range the bridge is judged against; QA approves the qualification record before the new lot is used for any release decision. The recurring mistake is using a standard past its requalification date because no one was tracking it against a calendar, or running a bridging study only after the old standard has already run out, leaving a gap during which no qualified standard covers ongoing testing. A quieter mistake: bridging each new working standard only against the outgoing working standard instead of periodically re-anchoring back to the primary standard, which lets a small assigned-value drift compound, lot after lot, until the working standard has walked meaningfully away from the value it is supposed to represent.

How to read and verify a CoA, step by step

This is the daily QA task. Do it in a fixed order so nothing is skipped. The goal is a yes/no release decision with a documented basis. The full path from a certificate in hand to a dispositioned lot:

Any failure along that path routes to quarantine and a deviation, not to a quiet acceptance. The step-by-step detail follows.

Step 1: Identify and match the lot

Compare the lot number, material name, and grade on the CoA against the physical labels on the received containers and against the purchase order and packing slip. They must all agree. A CoA that does not match the container in front of you is the most common single defect. If the lot on the certificate is not the lot in the warehouse, stop; you have either a wrong certificate or a mislabeled material, both of which are quarantine events.

Step 2: Confirm the issuer is a qualified source

The CoA must come from an approved supplier or manufacturer on your Approved Supplier List. Watch for the case where the CoA is issued by the manufacturer but the material was supplied through a distributor. The supply chain must be qualified end to end. A distributor’s own CoC stapled to a manufacturer’s CoA does not make an unqualified manufacturer acceptable. See supplier-vendor-qualification.

Step 3: Pull the controlled specification and compare it to the CoA spec reference

Open your internal, approved specification for this material at its current version. The CoA must test against acceptance criteria that meet or exceed your spec. Two failure modes here:

• The CoA lists fewer tests than your spec requires. The missing tests are gaps; the material is not fully certified.
• The CoA limits are wider than your spec. The supplier passed its own looser limit but your tighter limit might be failed by the same numeric result.

You judge the result against YOUR specification, not the supplier’s. This is the step most often shortcut, and it is exactly where escapes happen.

Step 4: Walk every test row, result against limit

For each test, confirm the result satisfies your acceptance criterion. Check units. Check direction (a “not more than” limit versus a “not less than” limit). For ranges, confirm the result falls inside. For descriptive tests (appearance, identification), confirm the recorded outcome matches (“conforms”, “passes”, “white crystalline powder”).

Worked example. Suppose your spec for a purified excipient reads:

And the supplier CoA reports:

The loss-on-drying result is the teaching point. The supplier’s certificate may declare the lot “conforms” because the supplier’s own internal limit is NMT 1.0 %. Against your tighter NMT 0.5 %, the same 0.7 % result is a failure. If you release on the supplier’s “conforms” stamp instead of comparing to your own spec, you have just accepted out-of-specification material. Reject the lot or open a deviation-management record and escalate, do not silently accept.

Step 5: Run required incoming testing

Even under full CoA reliance, the regulation requires a per-lot in-house check by you: for components, 21 CFR 211.84(d)(2) requires at least one specific identity test; for drug product containers and closures, 211.84(d)(3) requires at least a visual identification. Confirm that the required check was executed, sampled per a sampling plan appropriate to the lot, and that the in-house result matches the CoA identity claim. For materials not under reduced testing, run the full incoming test panel and judge those results the same way.

Step 6: Check dates and lifecycle attributes

Confirm the date of analysis is consistent with the manufacture date (testing should follow manufacture, not predate it). Assign material expiry/retest from the manufacture or retest date on the CoA. A CoA whose analysis date is years old, or which lacks a retest date for a material that needs one, is a flag.

Step 7: Record the disposition with traceable evidence

Document the review: certificate reviewed, spec version compared against, identity test result, and the release/reject decision with date and signature (electronic or wet). The CoA, your incoming test data, and the disposition record together form the release package and must be retrievable on inspection. See batch-disposition-decisions.

Acceptance criteria for a correctly reviewed CoA

You have done the review correctly when all of the following are true:

• Lot, material, and grade match the physical material and the order.
• The issuer is a qualified source on the approved list.
• Every test in your current spec is present on the CoA with a method reference.
• Every result meets YOUR acceptance criterion, with units and direction verified.
• Your own identity test was performed and matches.
• Dates are consistent and expiry/retest is assigned.
• The disposition decision is recorded, signed, and dated, with the CoA retained.

How to issue a Certificate of Analysis

If your site tests and ships material (API, drug substance, finished product, or as a contract lab), you issue CoAs. The certificate is a controlled GMP document and the data behind it must be complete and traceable.

Step by step

1. Complete all testing per validated or compendial methods, with full laboratory records meeting 21 CFR 211.194 (raw data, calculations, instrument printouts, analyst identity, review).
2. Verify each result against the approved specification. Any out-of-specification result must go through an oos-investigation-process and be resolved before a conforming CoA can issue. You never issue a “conforms” CoA over an unresolved OOS.
3. Transcribe or, far better, electronically transfer results from the source data (LIMS, chromatography data system) onto the certificate. Manual transcription is a known data integrity risk; minimize it.
4. Populate every required field (see the contents table above), including method references and the spec version.
5. Reconcile the CoA against the source records: every reported value must be traceable to a specific analytical record and must match it exactly.
6. Independent QA review and approval. A second qualified person checks the CoA against the underlying data before release. This four-eyes step is the control that catches transcription errors and selective reporting.
7. Issue the signed CoA tied to the released lot, and retain it for the required record retention period.

What “good” looks like for an issued CoA

Every value on the certificate ties to a controlled analytical record with no unexplained difference. The spec version on the CoA is the one in force at the time of test. Methods cited are the validated or compendial methods actually used. The certificate was approved by someone independent of the analyst who generated the data. There are no rounded, “tidied”, or back-calculated numbers that do not appear in the raw data.

Roles and responsibilities

Specification linkage: the heart of CoA control

A CoA is only as good as the specification it points to. The certificate without a controlled spec behind it is just numbers on a page.

Specification linkage means three things must agree: the test methods, the acceptance criteria, and the version of the specification used. For incoming materials, your internal material spec is the master. The supplier CoA is checked against it. When you change a spec (tighten a limit, add a test for a new impurity such as one driven by nitrosamines-impurities-q3-m7), the change must flow to incoming inspection through change-control-validated-systems, and the supplier must be informed if their CoA needs to cover the new attribute.

A frequent finding pattern: a site tightens an internal limit but never updates the incoming CoA review checklist, so QA keeps comparing supplier results to the old, looser limit. The spec changed; the practice did not. Build the spec version into the review record so this mismatch is visible.

For compendial materials, your spec should reference the monograph and the relevant general chapters, and you must verify the supplier is testing to the current compendial edition. See compendial-method-verification and stability-programs-ich for how shelf-life claims tie back to specification testing.

Transcription and data integrity risks on CoAs

The CoA sits at a dangerous seam: data is moved from analytical instruments and notebooks onto a summary document. Every move is a chance for error or, in the worst cases, manipulation.

The risks

• Transcription error. A number is mistyped from the chromatography data system onto the certificate. The CoA says 99.4 % but the raw data shows 94.9 %. If 94.9 % fails spec, you released failing material on a typo.
• Selective reporting. A passing replicate is reported and a failing one omitted. The CoA looks clean; the data set does not.
• Result not traceable to source. The CoA shows a value that cannot be found in any raw record, or that differs from the record with no documented reason.
• Copied-forward certificates. A certificate from a prior lot is reused with the lot number changed, so the results never reflect the lot actually shipped. ICH Q7 11.4 explicitly requires the CoA to reflect actual results obtained on that batch.
• Rounding and “tidying”. Values massaged toward the center of the range to look better. The reported number must follow the documented rounding convention applied to the real result, nothing more.

How CoA data integrity is judged

Apply ALCOA+ to every value on the certificate: Attributable, Legible, Contemporaneous, Original, Accurate, plus Complete, Consistent, Enduring, Available. A reported result must be attributable to the analyst and instrument that produced it, contemporaneously recorded, and accurate to the original data. See ALCOA+ in detail and data-integrity-foundations.

The strongest control is to remove human transcription. Generate the CoA directly from the LIMS or have the chromatography data system feed results electronically, with the audit trail preserved. Where the CoA is built from a chromatography-data-system-integrity source, the reviewer should be able to trace any value back to a specific injection, integration, and audit-trailed record. For electronic certificates, the system falls under 21-cfr-part-11-eu-annex-11 controls.

Verifying a supplier CoA for integrity, not just for pass/fail

When you periodically test against a supplier’s CoA (the 211.84(d)(2) validation), you are not only confirming the material; you are confirming the supplier’s certificates can be trusted. If your in-house result diverges materially from the CoA value for the same lot, that is a supplier data integrity signal, not a one-off. Escalate to supplier quality, widen testing, and consider an audit. A pattern of CoA values that are suspiciously consistent lot to lot, or always land mid-range, is a classic tell that the numbers may not be real.

Electronic and structured CoAs

Most CoAs still arrive as a PDF or a scanned paper document, and a human retypes the values into a receiving system. That transcription seam is exactly where the data integrity risks above live. The direction of travel is to remove it by exchanging the CoA as structured, machine-readable data rather than a flat image.

The practical forms this takes:

When you move to any electronic CoA, new controls apply. The system that receives, stores, or acts on the certificate falls under 21 CFR Part 11 and EU Annex 11: access control, audit trail, and the integrity of the record over its lifecycle. An automated CoA-to-spec comparison is itself a piece of GxP functionality and needs computerized system validation proportionate to its risk, because a wrong mapping between a supplier field and your acceptance criterion would silently release out-of-spec material at scale. The authenticity of a supplier’s electronic certificate (that it genuinely came from the qualified manufacturer and was not altered in transit) becomes part of supplier qualification and the quality agreement. Structured exchange does not remove the need to judge results against your own spec; it makes that judgment faster and less error-prone, and it moves the control point from manual review to a validated interface.

Certificate authenticity: detecting a fraudulent or altered CoA

Every control covered so far assumes the certificate is genuine, just possibly wrong. Sometimes it is not genuine at all, and that failure mode is older, and more consequential, than most of the transcription risks above. Two industry episodes make the point. Glycerin cut with the much cheaper and toxic diethylene glycol (DEG) has caused fatal poisonings in several countries over the years; FDA’s response was to require a specific identity test on every lot of glycerin and related high-risk components that includes a limit test for DEG and ethylene glycol, most recently restated and broadened in its 2023 guidance on testing glycerin, propylene glycol, and other high-risk drug components for diethylene glycol and ethylene glycol, because a generic “conforms to the compendial monograph” statement on a certificate does not catch an adulterated lot. Separately, in late 2007 and into 2008, heparin sourced through a supply chain in China was found contaminated with oversulfated chondroitin sulfate, a cheap adulterant that mimicked heparin on the compendial tests then in use; the resulting adverse reactions led to major recalls and pushed regulators and compendial bodies toward new identity and purity test methods able to detect that specific contaminant. Neither episode was primarily a forged-certificate problem in the strict sense, but both illustrate the risk this section is about: a certificate that looks complete and reads clean can still sit on top of material, or data, that is not what it claims to be.

A handful of patterns are worth training reviewers to notice. None is proof on its own; each is a reason to look closer.

• Results that are suspiciously uniform lot to lot, or that consistently land near the middle of the acceptance range rather than showing the ordinary scatter real analytical data has.
• A certificate missing method references or a specification version, leaving nothing to check the numbers against beyond the word “conforms.”
• Formatting, letterhead, or signature inconsistencies against certificates previously received from the same manufacturer.
• An analysis date that does not make sense against the manufacture date, or a turnaround faster than the cited method could plausibly run.
• A certificate that arrives through a distributor with no way to confirm it originated with the named manufacturer.
• A supplier that resists or delays a reasonable request for the underlying raw data behind a specific result.

Verification starts with the channel, not the content. Confirm a certificate’s origin by contacting the manufacturer through a phone number or portal already on file from supplier qualification records, never through contact information printed on the certificate itself, since a fabricated certificate can just as easily fabricate a fake confirmation line. Beyond that, the controls already described above carry most of the weight. The mandatory per-lot in-house identity or visual check is never waived regardless of how trusted the supplier is, and a persistent divergence between your in-house results and a supplier’s certificates, tracked over time rather than lot by lot, is exactly the kind of signal that should trigger an audit rather than a shrug. Where a result looks too good, ask for the raw analytical data behind it, not a restated number. A supplier confident in genuine testing can usually produce it; one that cannot is telling you something.

Ownership sits with supplier quality for the relationship and escalation, QC for the in-house verification testing, and QA for the decision to quarantine, investigate, or requalify a supplier. When a discrepancy or authenticity concern is confirmed rather than ruled out, it earns its own investigation record rather than getting folded into a routine OOS investigation built for in-house laboratory failures, because the root cause branches differently here: transcription error, genuine out-of-specification material, a specification-alignment gap with the supplier, or a certificate integrity concern each point to a different corrective action. See the CoA discrepancy and rejection investigation record. A completed CoA authenticity and fraud-indicator screening checklist gives a reviewer a structured place to record these observations instead of relying on a feeling that something looked off, which rarely survives contact with an inspector asking what, specifically, was checked.

Imported active substances: the EU written confirmation and CoA at the border

A CoA travels with the material. In the European Union, an imported active substance needs something else traveling alongside it: a written confirmation from the exporting country’s own regulatory authority. This is a separate document from the certificate of analysis, it addresses a separate question, and both are required.

Article 46b(2)(b) of Directive 2001/83/EC, inserted by the Falsified Medicines Directive (2011/62/EU) and in force for active substances imported into the EU from 2 July 2013, requires that the active substance be accompanied by a written confirmation from the competent authority of the exporting third country stating three things: that the manufacturing plant’s GMP standards are at least equivalent to those applied in the EU, that the plant is subject to regular, strict, and transparent controls, including unannounced inspections, sufficient to give an equivalent level of assurance, and that the exporting authority will promptly pass along any finding of non-compliance. The European Commission published a standard template for this confirmation in July 2012. A limited set of countries are excused from the requirement, either because the Commission has assessed their regulatory framework as providing equivalent assurance or because a mutual recognition agreement with the EU covers the same ground; confirm current status against the Commission’s own published list rather than assuming a country’s status has not changed, since that list is maintained and updated centrally.

For a CoA reviewer, the practical consequence is one more document to check at the same point in the process. Alongside confirming the certificate’s lot match, source qualification, and test results, confirm a current written confirmation is on file, that it names the specific manufacturing site the material actually came from rather than just the parent company, and that it has not lapsed. A written confirmation covering the wrong site, or one that has expired since the last shipment from that supplier, is a gap the CoA review alone will never surface, because the two documents answer different questions: one says the tested lot met its specification, the other says the site that made it operates under GMP standards the EU accepts as equivalent to its own. Import quality assurance or regulatory affairs typically owns tracking which suppliers and sites require a written confirmation and keeping the current version on file. Treating the two documents as interchangeable, or filing a stale confirmation without checking its site coverage or date, is the recurring gap in this area.

Supplier CoA reliance and reduced testing

Testing every attribute of every incoming lot in-house is slow and expensive. GMP allows you to lean on supplier CoAs, but only after you have earned the right through qualification.

The conditions for reliance

To accept a supplier’s report of analysis in lieu of full testing you must, under 21 CFR 211.84(d)(2) for components and 211.84(d)(3) for drug product containers and closures:

1. Establish the reliability of the supplier’s analyses through appropriate validation at appropriate intervals. In practice you test a defined number of lots fully in-house and confirm your results agree with the supplier’s CoAs.
2. Still perform a per-lot in-house check on every lot you receive, regardless of how qualified the supplier is. For components that means at least one specific identity test (211.84(d)(2)); for containers and closures it means at least a visual identification (211.84(d)(3)). That per-lot check never goes away.

This reliance is built on top of supplier qualification: an approved supplier, a quality agreement defining CoA content and notification of changes, and an audit history. See supplier-vendor-qualification, conducting-a-supplier-audit, and cdmo-oversight-quality-agreements.

Skip-lot and reduced testing

Once reliance is established, you can move to a reduced or skip-lot testing regime: instead of full testing on every lot, you fully test on a defined frequency (for example 1 in N lots, or periodically) while relying on the CoA plus identity for the lots in between.

How to design it:

• Define the rule explicitly in a procedure: what triggers reduced testing, the skip frequency, and what verification testing continues on skipped lots (identity always continues).
• Base the frequency on risk: material criticality, supplier history, and stability of past results. A high-risk API ingredient earns a tighter regime than a low-risk processing aid. See quality-risk-management and data-criticality-and-data-risk.
• Define exit conditions. Any OOS result, any CoA discrepancy, any supplier change, or any audit finding pulls the material back to full testing until confidence is re-established.
• Periodically reconfirm. Reduced testing is not permanent; re-validate the supplier’s CoA reliability at defined intervals.

Worked example of a skip-lot rule:

Material X (low-risk excipient, supplier with 24 months of agreement and zero OOS): full incoming test panel on every 5th lot; identity (IR per USP <197>) plus CoA review on all intervening lots. Any OOS, CoA discrepancy, or supplier-notified change reverts the material to full testing on the next 3 consecutive lots before reduced testing may resume. Reliability re-verified annually.

Acceptance criteria for a reliance program

A defensible reliance/skip-lot program has: documented supplier qualification, an active quality agreement, recorded validation that in-house results agreed with supplier CoAs over the qualifying lots, identity testing on every lot, a written skip rule with risk basis and exit conditions, and periodic re-verification. If any of these is missing, an inspector will read the reduced testing as untethered.

Trending CoA results across lots

A single certificate answers one question: did this lot pass. It cannot answer a second, equally important question: is this material quietly drifting toward a limit, lot after lot, even though every individual result still passes. That second question needs the results pulled out of certificates and tracked over time, and it is not optional analysis. 21 CFR 211.180(e) requires that records be reviewed at least annually to evaluate the quality standards of the drug product and determine whether changes are warranted, and a supplier or material trend is one of the standard inputs into that review, alongside the broader annual product review process. See annual-product-review-pqr for how this trend feeds the larger review, and quality-risk-management for the risk basis behind acting on a trend before it becomes a failure.

The mechanics are straightforward: capture the key numeric results from every incoming CoA for a given material and supplier into a running log rather than filing each certificate and moving on, then review that log at a defined frequency, not only once a year at the annual product review. A control chart, or even a simple table sorted by date, will show a slow walk toward a limit that no single passing certificate would ever flag, because each individual result is, by definition, inside spec.

Worked example. A supplier’s water content results for an excipient sit comfortably inside a not-more-than 0.5% limit for eighteen consecutive lots, averaging around 0.2%. Over the next six lots the average climbs to 0.38%, still passing every individual acceptance criterion. A lot-by-lot CoA review sees six consecutive passes and moves on. A trend log catches the climb, prompts a question to supplier quality about a possible process change before a lot actually fails, and avoids the deviation, investigation, and possible recall exposure a genuine miss would trigger later. This is exactly the kind of signal a reduced or skip-lot testing program depends on to stay defensible: a program that stops trending once testing drops to a skip schedule has removed the one control most likely to catch drift during the very period when fewer full tests are running.

QC typically owns capturing the data into the log, QA owns the periodic review and the decision to escalate a trend, and supplier quality owns the conversation back to the manufacturer when a trend needs an explanation. A supplier CoA trending log gives this a place to live outside of memory and outside a stack of individual certificates nobody is comparing to each other.

Common mistakes and inspection-finding patterns

These are the recurring issues, the kind that surface in 483 observations and warning letters around component testing, supplier reliance, and laboratory records.

• Releasing against the supplier’s spec instead of your own. The CoA says “conforms” to the supplier’s looser limit; the result fails your tighter limit; the material is accepted anyway.
• No in-house per-lot check. Relying fully on the supplier CoA without performing the per-lot in-house check the regulation requires: a specific identity test for components (211.84(d)(2)) or a visual identification for containers and closures (211.84(d)(3)). This is a direct regulatory violation, not a judgment call.
• Reliance without established reliability. Accepting supplier CoAs in lieu of testing with no documented validation that the supplier’s results are trustworthy.
• Lot mismatch. CoA lot number does not match the container; or one CoA used to release multiple lots; or a CoA copied forward from a previous lot.
• Missing tests. CoA covers fewer attributes than the current spec, and the gap is not noticed because the reviewer only checks that present rows pass.
• Spec version drift. Internal limit was tightened; incoming review still compares to the old limit.
• Unqualified supply chain. CoA from a qualified manufacturer but material routed through an unqualified distributor or repackager.
• CoC treated as CoA. A conformance statement with no numeric data used to release an attribute that requires a numeric result.
• Transcription and traceability failures. CoA values that do not match, or cannot be traced to, the underlying laboratory data; values reported with no raw record; selective reporting of passing results.
• OOS overwritten. A CoA issued as “conforms” while an out-of-specification result on that lot was never investigated or was invalidated without justification.
• No documented review. Material released with the CoA on file but no record of who reviewed it against spec, when, or on what basis.
• A biologic or cell and gene therapy certificate carrying only identity and a bare “meets specification” line, with no quantitative potency result against a reference standard, so the one test that shows the product actually works is invisible on the certificate.
• Device-constituent functional results, force, dose accuracy, container closure integrity, never reconciled against the drug or biologic CoA before a combination product ships, leaving one disposition resting on only half the release evidence.
• A reference or working standard used past its requalification date, or a new lot bridged into use before the bridging study is complete, so every result generated against it rests on an unverified assumption.
• A suspiciously clean run of passing results treated as good news rather than an authenticity signal worth a second look.
• An imported EU active substance received with no current written confirmation on file, or one naming the wrong manufacturing site, filed as though the CoA alone satisfied the import requirement.
• CoA results filed lot by lot with no running trend, so a material drifting toward a limit stays invisible until the lot that actually fails.
• Reduced or skip-lot testing continuing on a material with no ongoing trend review, removing the one control most likely to catch supplier drift during the very period when fewer full tests are running.

Interview-ready questions and strong answers

These come up for QA, QC, supplier quality, and incoming inspection roles, and inspectors ask the regulatory ones on the floor.

What is the difference between a Certificate of Analysis and a Certificate of Compliance? A CoA lists actual test results against acceptance criteria for a specific lot, so you can make your own conformance call. A CoC is a conformance statement, usually without numeric results. You can release an analytical attribute on a CoA; you cannot release a numeric attribute on a CoC alone because there is no data to judge.

Can you release incoming material purely on the supplier’s CoA? Not entirely. The regulation lets you accept the supplier’s report of analysis in lieu of your own testing only if you have established the reliability of the supplier’s analyses through validation at appropriate intervals, AND you still perform a per-lot in-house check yourself. For components, 21 CFR 211.84(d)(2) requires at least one specific identity test; for drug product containers and closures, 211.84(d)(3) requires at least a visual identification. That per-lot check is mandatory regardless of how trusted the supplier is.

A supplier CoA says the lot conforms, but the assay result is 97.5 % and your spec is 98.0 to 102.0 %. What do you do? Reject or quarantine. I judge results against my own approved specification, not the supplier’s. The supplier may have a looser internal limit, so “conforms” on their certificate does not mean it meets my spec. I would quarantine the lot, open a deviation, and notify supplier quality, because either the material is genuinely out of my spec or there is a spec-alignment problem with the supplier to resolve.

How do you ensure data integrity of a CoA you issue? Generate it directly from the source system where possible to eliminate transcription, reconcile every reported value back to a specific analytical record, apply ALCOA+, route any OOS through investigation before issuing a conforming certificate, and require independent QA review of the CoA against the raw data before release.

What is skip-lot testing and when is it justified? A reduced testing regime where I fully test on a defined frequency rather than every lot, relying on the supplier CoA plus per-lot identity in between. It is justified only after supplier qualification and documented validation of CoA reliability, is risk-based on material criticality and supplier history, has defined exit conditions (any OOS or discrepancy reverts to full testing), and is periodically re-verified.

Which regulation governs supplier CoA reliance in the US, and what does ICH Q7 say about CoAs? 21 CFR 211.84(d)(2) governs reliance for components, where you accept the supplier’s report of analysis but still run at least one specific identity test per lot; 211.84(d)(3) governs reliance for drug product containers and closures, where you accept the supplier’s certificate of testing but still perform at least a visual identification per lot. ICH Q7 Section 11.4 sets the expectation that every lot of intermediate or API is accompanied on request by a genuine, lot-specific certificate, that the certificate presents the actual figures produced during testing, and that it names the analytical procedures used to generate them.

What fields must a CoA contain? At minimum: issuer, material name and grade, lot number, manufacture and retest/expiry dates, spec reference and version, and for every test the method, the acceptance criterion, the result with units, an overall conform/non-conform conclusion, the date of analysis, and an authorized signature.

What does a Certificate of Analysis need to show for a biologic that a small-molecule CoA does not? A quantitative potency result measured against a reference standard, not just identity and purity. 21 CFR 610.10 requires a product-specific potency test, and 600.3(s) makes potency part of the statutory definition of the product, so a certificate that skips straight from identity to a “meets specification” conclusion is missing the one result that shows the molecule actually works.

How do you handle CoA review for a combination product like a prefilled syringe? By reconciling two separate release records rather than forcing everything into one chemistry-style table: a CoA for the drug or biologic constituent, and a functional and dimensional release record for the device constituent, for example break-loose and glide force, dose accuracy, and container closure integrity under 21 CFR Part 4. Neither record alone supports shipping the finished combination product.

Why does a reference standard need its own qualification record separate from a routine CoA? Because every result measured against that standard inherits its error. A reference standard’s certificate or characterization record needs an assigned value with uncertainty, traceability back to a primary or compendial standard, and a requalification schedule, and a new working-standard lot needs a bridging study against the current standard before it goes into routine use, not after.

How would you know if a supplier’s Certificate of Analysis might be fraudulent rather than just wrong? By pattern rather than a single number: results that are suspiciously uniform or always land mid-range, missing method references or spec version, formatting inconsistent with past certificates from the same source, or an analysis date and turnaround that do not make physical sense for the cited method. I would verify the certificate’s origin through a contact already on file, not one printed on the certificate, and request the underlying raw data behind any result that looks too good.

What is the difference between a Certificate of Analysis and the EU written confirmation for an imported active substance? The CoA states that a specific lot was tested and met its specification. The written confirmation, required under Article 46b(2)(b) of Directive 2001/83/EC for active substances imported into the EU since 2 July 2013, is issued by the exporting country’s competent authority and states that the manufacturing site operates under GMP standards the EU accepts as equivalent to its own, with regular unannounced inspections. They answer different questions and both are required.

Why trend CoA results across lots instead of just reviewing each certificate individually? Because a lot can pass its individual acceptance criterion every time while the underlying result quietly walks toward the limit, and no single passing certificate will ever show that. Trending the numeric results over time, which 21 CFR 211.180(e) supports as part of the annual quality review, catches supplier drift while there is still time to ask a question, rather than after a lot actually fails.

Practical tips

• Always compare to your own current spec, with the version recorded in the review. Print the spec next to the CoA so the comparison is visible.
• Check units and limit direction on every row. Most “passing” results that should have failed were a units mismatch or a not-more-than read as not-less-than.
• Treat any unexplained difference between your in-house result and the CoA value as a supplier signal, not noise.
• Keep an incoming-inspection checklist that forces lot match, issuer check, spec-version capture, test-completeness check, identity test, and disposition. Checklists prevent the silent-skip failure mode.
• Eliminate manual transcription on CoAs you issue. Electronic generation from LIMS or the CDS is the strongest data integrity control you can apply.
• Re-verify reduced testing on schedule. Skip-lot programs decay quietly if no one re-validates the supplier’s CoA reliability.
• Never issue or accept a “conforms” certificate over an unresolved OOS.
• For a biologic or CGT certificate, confirm the potency result names the reference standard lot it was measured against; a result with no stated reference standard cannot be interpreted.
• Keep a reference standard’s expiry and bridging calendar separate from general material expiry tracking; it is easy to lose inside a system built around routine materials.
• For an imported EU active substance, check the written confirmation’s site and date at the same time as the CoA, not as an afterthought.
• Feed CoA results into a running trend log as they are reviewed, not only when someone remembers to pull data for the annual product review.

Related reading

• supplier-vendor-qualification
• conducting-a-supplier-audit
• oos-investigation-process
• batch-disposition-decisions
• compendial-method-verification
• data-integrity-foundations
• ALCOA+ in detail
• good-documentation-practices
• deviation-management
• qualified-person-batch-release-annex-16
• bioassay-and-elisa-validation
• comparability-and-potency-assays
• process-validation-for-biologics
• combination-products-cgmp-part-4
• annual-product-review-pqr
• quality-risk-management