CoA Fraud in the Supplement Industry — How to Detect It Before It Costs You

It Happens More Than the Industry Acknowledges

CoA fraud — the falsification of certificate of analysis documents to misrepresent the quality of raw materials — is not a theoretical risk. It is a documented problem in the supplement supply chain, and it takes several forms: altered results, fabricated documents created without any actual testing, reused CoAs from previous lots applied to new shipments, and CoAs issued by laboratories that do not exist or are not accredited for the tests listed.

The consequences for manufacturers who accept fraudulent CoAs range from product quality failures and customer complaints to regulatory action and, in serious cases, product recalls. Under 21 CFR Part 111, a manufacturer’s obligation to ensure raw material quality is not discharged by accepting a supplier’s CoA — it requires verification.

This post covers the most common CoA fraud patterns, the red flags that should trigger scrutiny, and the verification steps that give quality teams confidence in the documents they receive.

---

Common CoA Fraud Patterns

Pattern 1: Altered Results

The simplest form of CoA fraud involves taking a legitimate CoA and changing one or more result values — typically to bring a failing result into the passing range, or to inflate an assay value that is below specification.

Red flags:

• Inconsistent fonts or font sizes within the results table
• Misaligned columns or irregular spacing in the results section
• Results that are suspiciously round numbers (e.g., exactly 100.0% assay, exactly 0.0 ppm for every heavy metal)
• Results that are implausibly consistent across multiple lots (real analytical data shows natural variation)

Pattern 2: Fabricated Documents

In more serious cases, a supplier creates a CoA without performing any testing. The document may look professionally formatted but contains invented data.

Red flags:

• Laboratory name that cannot be verified (no website, no accreditation listing, no contact information)
• Accreditation numbers that do not match any accreditation body’s registry
• Test methods cited that do not exist or are not applicable to the material
• Analyst signatures that are illegible or identical across multiple documents
• Issue dates that precede the lot manufacture date

Pattern 3: Lot Reuse

A CoA from a previously tested lot is reapplied to a new shipment. The document is genuine — it reflects real testing — but the testing was performed on a different lot than the one you received.

Red flags:

• Lot number on the CoA does not match the lot number on the container label
• CoA date is significantly older than the shipment date
• The CoA lot number appears on multiple shipments over an extended period

Pattern 4: Non-Accredited or Fictitious Laboratories

Some fraudulent CoAs reference laboratories that are not accredited for the tests listed, or that do not exist. Accreditation is test-specific — a laboratory may be ISO 17025 accredited for microbiology but not for pesticide residue testing. A CoA that claims accredited results for a test outside the lab’s scope is misrepresenting its status.

Red flags:

• Laboratory accreditation number not verifiable in the accreditation body’s public registry
• Accreditation scope does not include the specific tests listed on the CoA
• Laboratory address or contact information does not match any verifiable business

---

Verification Methods

Step 1: Verify the Laboratory

For any CoA from a new supplier or a laboratory you have not previously used, verify the laboratory’s accreditation independently:

• A2LA (American Association for Laboratory Accreditation): Search the public directory at a2la.org
• NVLAP (National Voluntary Laboratory Accreditation Program): Search at nist.gov/nvlap
• ISO 17025 accreditation bodies: Most national accreditation bodies maintain searchable public registries

Confirm that the laboratory’s accreditation scope includes the specific tests listed on the CoA, and that the accreditation was current at the time of testing.

Step 2: Contact the Laboratory Directly

For high-value or high-risk materials, contact the testing laboratory directly to verify that the CoA is authentic. Most legitimate ISO 17025 accredited laboratories have a process for verifying CoA authenticity upon request. Provide the lot number and CoA issue date and ask them to confirm the document is genuine.

This step takes five minutes and is one of the most effective fraud detection tools available. A fraudulent CoA referencing a real laboratory will typically be identified at this step.

Step 3: Cross-Reference Results Against In-House Testing

The most definitive verification is independent testing. Test the received material against your specification and compare your results to the supplier’s CoA. Significant discrepancies — particularly for identity, assay, or heavy metals — should trigger a formal investigation before the lot is released.

In our laboratory work, we see the most meaningful discrepancies in:

• Assay/potency (supplier CoA shows higher values than independent testing)
• Heavy metals (supplier CoA shows lower values, sometimes by an order of magnitude)
• Identity (supplier CoA passes, independent testing fails or is inconclusive)

Step 4: Trend Analysis

Maintain a database of CoA results by supplier and lot over time. Real analytical data shows natural variation — results that are implausibly consistent (e.g., every lot showing exactly the same assay value to three decimal places) are a red flag for fabricated data.

---

Internal Controls That Reduce Fraud Risk

Approved Supplier List with verification requirements: Define the verification steps required for each supplier tier. New or unaudited suppliers should face more rigorous CoA verification than long-term qualified suppliers.

Blind sample submissions: Periodically submit samples to your contract testing lab under a different identity to verify that the results you receive match what an independent submission would show.

Split sample testing: For high-value lots, split the sample and send portions to two different laboratories. Significant discrepancies between the two results warrant investigation.

CoA retention and comparison: Retain all CoAs and compare new documents against historical ones for the same supplier. Changes in format, laboratory, or result patterns should be noted and investigated.

Supplier audit: On-site audits of supplier facilities and laboratories are the most effective long-term fraud deterrent. A supplier who knows they will be audited has less incentive to falsify documentation.

---

Practical Checklist: CoA Fraud Detection

• Laboratory name and accreditation number verified in the relevant accreditation body’s public registry
• Accreditation scope confirmed to include the specific tests listed on the CoA
• Lot number on CoA matches lot number on container label and purchase order
• CoA issue date is consistent with lot manufacture and shipment dates
• Results show plausible natural variation (not suspiciously round or identical across lots)
• Document formatting is consistent throughout (no font changes, misalignment, or irregular spacing)
• For new suppliers or high-risk materials: laboratory contacted directly to verify CoA authenticity
• Independent in-house testing performed and results compared against CoA
• Any significant discrepancy between CoA and in-house results documented and investigated
• CoA retained in supplier file for trend analysis