Certificate of Analysis (CoA): What It Proves, What It Doesn't, and How to Read One

The short answer: A Certificate of Analysis (CoA) is a document issued by a manufacturer's or testing laboratory's quality unit that reports the results of the tests performed on one specific batch of a material against its agreed specification, and states whether the batch conforms. It proves that the batch, as sampled and tested by the issuer, met those results on that date. It does not prove that the site operates under GMP, that the sample was representative of the whole batch, that the test methods were validated, or that the next batch will match. That is why both the FDA and EU GMP let a buyer rely on a supplier's CoA only after the supplier has been qualified and the certificate's reliability has been established by the buyer's own testing.

In pharmaceutical sourcing "CoA" almost always means Certificate of Analysis. The same letters are used elsewhere for a Certificate of Authenticity (collectibles, art) and a Certificate of Origin (customs); neither has anything to do with a batch test report.

What a pharmaceutical CoA must contain

For active pharmaceutical ingredients, ICH Q7 (section 11.4) sets the expectation, and most excipient and drug-product certificates follow the same pattern:

Element	Why it is there
Material name and grade (and pharmacopoeial reference, e.g. Ph. Eur., USP)	Ties the certificate to one specification
Batch or lot number	Ties it to one batch; must match the container labels and shipping documents
Name and address of the original manufacturer	ICH Q7 requires that a CoA issued by an agent, broker, trader or repackager still names the manufacturer that performed the analysis
Date of manufacture and retest or expiry date	Defines how long the result stands
Each test, its specification (acceptance criterion), the method reference, and the result	The substance of the certificate; a result column that only says "complies" or "passes" is weaker than a numeric value
Statement of conformance	The issuer's conclusion against the specification
Signature, name and role of the authorised quality person, and the date	Accountability; unsigned or undated certificates are a classic finding
References to the test records or batch number of the analytical run	Allows the result to be traced to raw data in an audit

A Certificate of Conformance (CoC) is different: it states that a batch meets its specification without reporting the results. It is common for packaging and components, and generally insufficient on its own for an API or a critical excipient.

A Certificate of Suitability (CEP) is different again: it is issued by the EDQM to an API manufacturer to confirm that the substance made by their process can be controlled by the European Pharmacopoeia monograph. It says nothing about any individual batch. See the DMF glossary entry for how CEPs and Drug Master Files fit together.

How far may a buyer rely on a CoA?

Both major GMP frameworks answer the same way: rely on it only once you have earned the right to.

• United States. 21 CFR 211.84(d) requires at least one specific identity test on each component on receipt, and allows the manufacturer to accept the supplier's CoA for the remaining tests only where the reliability of the supplier's analyses has been established through appropriate validation of the supplier's test results at appropriate intervals.
• European Union. EU GMP Part I Chapter 5 requires suppliers of starting materials to be qualified and approved, allows reduced testing based on the supplier's CoA once that qualification and a documented assessment of the certificate's reliability exist, and still expects identity testing of the material received (with sampling per Annex 8).
• APIs under ICH Q7. Section 7.3 expects a full analysis on at least three batches before reducing in-house testing to rely on the supplier's CoA, and a full analysis at appropriate intervals thereafter, comparing results to the supplier's certificate.

The practical reading: a CoA is a claim by the supplier. Your own identity test, your periodic full testing, and your supplier audit are what turn it into evidence you can release against.

How to read a CoA in ten checks

1. Batch number matches the labels, the packing list and the purchase order; one certificate per batch, not one for the shipment.
2. Manufacturer named and the same as the DMF or CEP holder you qualified; if a trader issued the certificate, the original manufacturer still appears.
3. Specification version is the one in your quality agreement; an older specification can be narrower or wider than the one you agreed.
4. Every test listed in the specification is reported, with no silent omissions (a missing residual-solvent or microbial test is a question, not an oversight).
5. Results are numeric where the method is quantitative. "Complies" for assay or impurities tells you nothing about trend.
6. Results sit plausibly within the range. A series of batches all reporting the exact midpoint, or identical impurity values to the decimal, is a data-integrity signal, not reassurance.
7. Method references are present and are the pharmacopoeial or validated in-house methods you expect.
8. Dates are coherent: manufacture before testing, testing before release, release before shipment; retest or expiry date consistent with the stability data in the supplier's file.
9. Signed and dated by a named person in the quality unit, not by sales.
10. Compare with your own incoming results for the same batch; a persistent offset between the supplier's assay and yours is a method or sampling issue worth resolving before it becomes an out-of-specification investigation.

Red flags that should stop a release

A certificate with no manufacturer name; a trader's letterhead with no reference to the analysing laboratory; typed-over or inconsistent batch numbers; results reported before the manufacturing date; "passes" in place of values for impurities; a template that never changes from batch to batch; a missing or illegible signature; a specification that does not match the one agreed; or a certificate that cannot be reconciled with the Drug Master File or CEP you relied on when you qualified the supplier. Any one of these is reason to hold the material and ask for the raw data.

The CoA inside supplier qualification

The certificate is the last document in a chain, not the first. A supplier is qualified by its regulatory standing (an active Drug Master File or CEP for the substance), its inspection record (Form 483s, Warning Letters, recalls), its GMP certificate, an audit or a recent third-party audit report, a signed quality agreement, and then by the correlation between its certificates and your own testing over several batches. The API supplier qualification checklist lays that sequence out. PharmaTek's API directory shows, for each substance, which suppliers hold an active DMF or CEP and whether a GMP certificate is on record, so the standing check that precedes any CoA takes minutes.

Frequently asked questions

What is a Certificate of Analysis in pharma? A document from a manufacturer's or testing laboratory's quality unit that reports the test results for one specific batch of a material against its specification and states whether the batch conforms. It must identify the material, the batch, the original manufacturer, each test with its acceptance criterion and result, the retest or expiry date, and be signed and dated by an authorised quality person.

Is a Certificate of Analysis proof of GMP compliance? No. It shows that a batch tested as reported. GMP compliance is shown by the site's inspection history and a current GMP certificate from an authority such as the FDA, EMA member states or the MHRA. A buyer should check both, and should establish the reliability of the supplier's certificates through its own testing before relying on them.

Can we accept material on the supplier's CoA without testing? Not entirely. US rules (21 CFR 211.84) require at least one specific identity test on each component and allow reliance on the supplier's CoA for other tests only after the supplier's results have been validated at appropriate intervals. EU GMP Chapter 5 and ICH Q7 take the same position: qualify the supplier, demonstrate the certificate is reliable through full testing on several batches, then reduce testing with periodic full analysis.

What is the difference between a CoA, a CoC and a CEP? A Certificate of Analysis reports test results for one batch. A Certificate of Conformance states conformance without reporting results and is common for components and packaging. A Certificate of Suitability is issued by the EDQM to an API manufacturer to confirm its substance is controlled by the European Pharmacopoeia monograph; it covers the process, not any batch.

Who issues the CoA when we buy through a distributor? The analysis belongs to the laboratory that performed it. Under ICH Q7 a certificate issued by an agent, broker, trader or distributor must show the name and address of the original manufacturer and reference its results. A distributor's own letterhead with no manufacturer named is a reason to ask for the original.

---

Qualifying a supplier? Check its DMF, CEP and GMP standing in the API directory before you read a single certificate, or hand the search to the Sourcing Desk.