CoA

A Certificate of Analysis is the formal statement that a specific batch was tested against its specification and met it. It must identify the material and batch unambiguously, list each test with its method reference, the acceptance criterion, and the actual result obtained, and carry the date and signature of the authorised person releasing it. Results reported only as "complies" or "conforms", with no numerical value, are weak evidence and a frequent audit observation.

For incoming materials, the CoA is a supplier-quality instrument, not a substitute for your own judgement. GMP requires the receiving manufacturer to verify the supplier’s results — periodically by full re-testing, and always by identity testing on each received lot. Accepting a CoA without identity confirmation is one of the more consequential shortcuts in the supply chain.

A CoA is only as good as the supplier qualification behind it. A CoA from an unaudited supplier, or a transcribed copy from a distributor rather than the original manufacturer, tells you little. Data-integrity expectations apply to it fully: the values on the certificate must be traceable to the original raw data and audit trail in the testing laboratory.

• —Must state actual results against the acceptance criteria — not just "complies".
• —Identify material, batch/lot, specification, test methods, date, and the authorised signatory.
• —Receiving sites must confirm identity on every lot and periodically re-test to validate the supplier’s results.
• —A CoA is only as trustworthy as the supplier qualification and audit behind it.
• —ALCOA+ applies — the certificate must be traceable to original raw data and audit trails.

US: 21 CFR 211.84 (testing and approval of components), 211.165 (testing and release), 211.194 (laboratory records); ICH Q7 §11.4 (Certificates of Analysis) for APIs; EU GMP Part I Chapter 6 (Quality Control) and Chapter 5 for supplier control.