Why a COA matters when supplement labels and contents don't match
FDA doesn't approve supplements before they go on sale, and the company selling a supplement is responsible for making sure it matches its label. Independent testing shows why that responsibility deserves checking. In the 2023 melatonin study (Cohen and colleagues, JAMA), researchers bought 25 brands of melatonin gummies sold in the US, and only 3 came within 10% of the melatonin on their labels. Among the products that contained melatonin, the amount ranged from 74% to 347% of the labeled quantity.
The authors tested one sample per brand and wrote that they couldn't say whether amounts vary from batch to batch. A COA for each lot is how a company answers that question about its own products.
The 4 tests on a typical supplement COA
A supplement COA usually reports four kinds of test.
Identity. Is this the right ingredient? A vitamin can be confirmed by chemistry. A botanical needs a test that confirms both the plant and the part used, such as a chemical fingerprint or a microscope exam, since one tree can supply two different herbs (cassia twig and cassia bark, for instance). FDA's manufacturing rule (21 CFR 111.75) requires at least one appropriate identity test on every dietary ingredient before it's used, unless FDA grants an exemption.
Potency. How much is there? Also called strength or assay, this result compares the measured amount with the label claim, often as a percentage. A potency of 98% means the lot held 98% of the labeled amount.
Heavy metals. A heavy metals panel usually covers lead, arsenic, cadmium and mercury, reported in parts per million (ppm) or in micrograms per serving.
Microbes. These results cover total bacteria (often called total aerobic count), yeast and mold, and specific organisms such as E. coli, Salmonella and Staphylococcus aureus, given in colony-forming units per gram (CFU/g) or simply as "absent."
Products made from plants often add a fifth test, a pesticide screen. NSF's supplement standard, for one, checks products that contain botanicals for pesticides.
6 checks before you trust a supplement COA
These are the six things I check on a supplement COA, roughly in the order I check them.
1. The lot number matches your bottle.
Every COA covers one lot: the batch made together and printed with one lot number, often near the expiration date. Match the number on the report to the number on your bottle, since a COA for a different lot describes a different batch. One "representative" COA shown for every lot tells you the product passed once. FDA's manufacturing rule lets a company check finished batches against their specifications through a sound statistical sampling plan instead of testing every batch. So "every batch tested" is a specific promise, and a fair thing to ask about.
2. The COA is for the finished product.
Suppliers send COAs with raw ingredients, and FDA's rule lets a manufacturer rely on a supplier's COA for some checks once it has confirmed that supplier's results with its own tests. A raw-ingredient COA shows the powder was right when it arrived. A finished-product COA shows what ended up in the capsule after blending, encapsulation and storage. Look for the product's name and lot number on the report, and be wary of one that shows only an ingredient name and a supplier's batch code.
3. You can see who ran the tests.
A supplement COA can come from the manufacturer's own quality lab, a contract lab the company hires, or a certification program's lab. In-house testing is normal, and it's also the least independent. "Third-party" usually means a lab the company doesn't own, which the company still chose and paid. A report should name the lab, give its address and carry an approval from someone there. A COA on a brand's letterhead with no lab named tells you less than it seems to.
4. The lab is ISO/IEC 17025 accredited for those tests.
ISO/IEC 17025 is the international standard for testing and calibration labs. ISO says it lets labs show they are "technically competent and able to produce valid and reliable results." An accreditation body, such as A2LA or ANAB in the US, grants accreditation for a defined scope, meaning a list of specific methods. A lab can be accredited for heavy metals and not for botanical identity, and the accreditor's public directory shows the scope in a way the word "accredited" on a report can't. A small tell I like: labs earn accreditation to ISO/IEC 17025, so a report boasting an "ISO certified lab" is using the term loosely.
5. Every result sits next to a limit and a unit.
A useful COA shows three things for every test: the method, the limit (the specification the lot had to meet) and the actual result. FDA's manufacturing rule asks for the same three when a manufacturer relies on a supplier's COA. A column of "Pass" or "Conforms" with no numbers is a nicely formatted shrug, the company's verdict without the evidence.
Units take a minute to learn. Heavy metals are often reported in parts per million, and 1 ppm equals 1 microgram per gram. A lead result of 0.05 ppm in a 2-gram serving works out to 0.1 microgram of lead per serving. "ND" means not detected, below the smallest amount the method can detect. That detection limit should be printed as well, because "not detected" by a blunt method and by a sensitive one are different results.
6. The tests fit the ingredients.
A COA can be accurate and still incomplete. Herbs need an identity test suited to the plant and the part. If the label says an extract is standardized to a percentage of some compound, the COA should measure that compound. A product with many ingredients may report potency for only a few of them, so ask which ones were measured. Then read the test list against the label, line by line.
What USP Verified and NSF certification add
Certification programs go further than a single COA. They audit the facility, review records, test the product and retest it over time. ODS names three organizations that offer this kind of quality testing: ConsumerLab.com, NSF International and U.S. Pharmacopeia (USP). Here's what two of them say their marks cover, in general terms:
- USP Verified. USP says the mark means the product contains the listed ingredients in the declared potency and amounts, has no harmful levels of specified contaminants, breaks down and releases into the body within a set time, and was made under FDA's and USP's good manufacturing practices. The process includes a facility audit, a records review, lab testing and testing of products bought off the shelf.
- NSF. NSF certifies supplements to NSF/ANSI 173, which covers a label claim review, a toxicology review of the ingredients and a contaminant review, for products made in facilities audited for good manufacturing practices. NSF Certified for Sport builds on that standard and adds screening for substances banned in sport.
ODS adds the limit I'd put in bold: these seals don't guarantee that a product is safe or effective. A mark is also only as good as its listing, so look the product up on the certifier's own website before you trust the logo on the bottle.
What "third-party tested" means on a supplement (5 questions to ask)
"Third-party tested" on a supplement usually means a lab the company doesn't own ran some tests. Like "lab tested" and "tested for purity," it's easy to print. Five questions turn it into something you can check:
- 1Tested for what? Identity, potency, metals, microbes, pesticides, or only some of those?
- 2Tested at what stage? Raw ingredients, the finished product, or both?
- 3Which lots? Every lot, a sample of lots, or the first one?
- 4Tested by whom? A named lab, accredited for those methods?
- 5Can I see the results? A COA for my lot number, or a summary?
To see what those results are measured against, How to Read a Supplement Label walks through the panel. If the answers aren't published, email the company and ask for the COA that matches the lot number on your bottle. The reply, or the silence, tells you plenty.
Questions about certificates of analysis
What is a certificate of analysis for supplements?
A certificate of analysis (COA) is a lab report for one lot of a supplement. For each test it lists the method, the limit the product had to meet and the actual result. Supplement COAs usually cover identity, potency, heavy metals and microbes.
How do I know a COA is for my bottle?
Match the lot number. Each COA covers a single lot, and the lot number is printed on the bottle, often near the expiration date. A COA with a different lot number, or none at all, describes a different batch. If a company shows one COA for every lot, ask how often it tests.
What does ND mean on a COA?
ND stands for "not detected." The amount was below the lowest level the test method can detect. A good COA prints that detection limit, since a sensitive method that finds nothing tells you more than a blunt one.
What is an ISO/IEC 17025 accredited lab?
ISO/IEC 17025 is the international standard for the competence of testing and calibration laboratories. An accredited lab has been assessed by an accreditation body, such as A2LA or ANAB, for a specific list of methods called its scope. Check that the tests on a COA fall inside that scope.
Does USP or NSF certification mean a supplement works?
No. The NIH Office of Dietary Supplements says quality seals indicate a product was properly manufactured, contains the ingredients on its label and has no harmful levels of contaminants. The same page says the seals don't guarantee that a product is safe or effective.
Which phase are you?
See what the Neijing makes of you. Your result comes before we ask for an email.
Find your phase