Reading a Certificate of Analysis: a buyer's guide

A Certificate of Analysis (COA) is the compressed working document of botanical ingredient procurement. It carries the identity, the specification, the analytical results, and the per-batch documentation that the regulated buyer needs to clear the material into formulation. Reading a COA well — knowing what every line should say, what is missing if it is missing, and where the analytical gotchas sit — is a working skill that varies more across procurement teams than it should. This note sets out the working framework.

Identity and characterisation

The first block of any working COA is identity. The species name in full Latin binomial (genus and species, varietal where relevant), the plant part used (root, leaf, whole plant, fruit), the country of origin (specific to the cultivation or harvest region where possible), the harvest cycle or batch identifier, and the extraction route. A COA that names the ingredient as a trade or common name without the Latin binomial is incomplete; "Tongkat Ali" without "Eurycoma longifolia" is not the working identity line.

For ingredient buyers operating under regulatory frameworks that require species-level identity verification — pharmacopoeial monographs, novel-food authorisations, dietary-ingredient submissions — the identity line on the COA needs to be supported by a method. DNA authentication, HPLC chemotype fingerprint against a reference standard, organoleptic identification by a qualified herbalist — the supplier should be able to name the method on request.

The marker quantification line

The marker quantification line is the procurement headline of most botanical COAs. Eurycomanone for Tongkat Ali, bacosides for Bacopa, kavalactones for Kava, rosavins and salidroside for Rhodiola — these are the regulated-market working specifications. The COA line should name the marker, the quantification method, the result, and the specification band.

The gotchas here are method consistency and reference-standard chain. A bacoside result of 20% means different things depending on whether the method quantifies four lead bacosides, six, or the broader chromatographic profile against the reference. A specification line that names the result without naming the method behind it is incomplete. Buyers running multi-supplier programmes should expect method documentation alongside the result.

Contaminants

The contaminant block of the COA covers heavy metals, pesticide residues, microbial contamination, and aflatoxins. Each line should name the method, the detection limit, and the result for each measured component. The block as a whole should reference the relevant regulatory framework — USP, EP, JP, the specific FDA or EFSA guidance — that the result is being compared against.

Heavy metals deserves particular attention. The line should name ICP-MS or ICP-OES, list arsenic, cadmium, lead, and mercury individually, and report each against a defined regulatory limit. A line that summarises "heavy metals: pass" without per-element results is inadequate for any regulated framework. Where the regulatory limit is on inorganic arsenic specifically, the COA should include speciation analysis through hyphenated HPLC-ICP-MS.

Pesticide-residue testing should name the multi-residue method panel — typically a GC-MS/MS or LC-MS/MS screen covering two hundred or more pesticides — and report results against the relevant maximum residue limits. The MRL framework varies by jurisdiction and by intended product category; the COA should specify which framework is in use. Microbial contamination — total aerobic count, yeasts and molds, Escherichia coli, Salmonella, sometimes specific pathogens — should be reported with method and result against the relevant pharmacopoeial limit. The microbial block is where some COAs are most cursory; buyers should expect quantified results, not pass/fail-only reporting.

Identity authentication

Where the regulatory or commercial framework requires identity verification beyond the visible plant material, the COA should include a dedicated authentication line. DNA barcoding for the species, HPLC chemotype fingerprint against a reference standard, or organoleptic verification at intake — each is an acceptable working method depending on the ingredient and the buyer's framework.

For ingredients in supply chains where adulteration with related species or unrelated plant material is a documented problem — and many botanical ingredient supply chains carry that history — the identity authentication line is not optional. A COA without an authentication method is not a working clearance for ingredients where adulteration is the recognised risk.

Per-batch versus generic documentation

A working COA is per-batch. Each batch produced and shipped should carry a COA generated against that specific batch's analytical results, signed off by the responsible analyst and dated against the analysis date. A "typical analysis" or "specification COA" that is not batch-specific is a specification sheet rather than a COA, and the distinction matters under most regulatory frameworks.

Buyers should expect per-batch COAs for every shipment. Where a supplier offers only a generic specification document or a "representative batch" COA in lieu of the per-shipment document, the supplier's analytical infrastructure or documentation discipline is incomplete. The procurement workflow should flag this immediately.

What to ask for if it is missing

A few working questions that can be sent to any supplier on receipt of a COA: which laboratory ran each block of analyses, what is the method validation status for the marker quantification line, what is the chain-of-custody documentation between harvest and analysis, and what is the retained-sample window for re-analysis if downstream issues arise. Suppliers who can answer these questions cleanly are positioned to support a regulated-market programme; suppliers who cannot are not.