COA Red Flags: How to Verify Your Overseas Supplier's Testing Data Before Raw Materials Ship

A batch of ashwagandha root extract arrives with a pristine Certificate of Analysis: heavy metals below detection limits, withanolide content exactly at the specification midpoint, total plate count at zero. Every box ticked. But when an independent re-test is run at a third-party laboratory, the potency comes in 38% below label claim — and total aerobic plate count is 2,800 CFU/g, well above the 1,000 CFU/g acceptance limit for powdered extracts.

This kind of discrepancy is more common than most manufacturers want to acknowledge. COA verification failures cluster heavily around overseas sourcing — particularly for botanical extracts, concentrated ingredients, and materials moving through multi-tier supply chains where a trading company, not the actual manufacturer, issues the documentation.

Under 21 CFR Part 111.75, U.S. dietary supplement manufacturers are legally required to conduct at least one identity test on each incoming ingredient lot before using it in manufacturing. That’s the regulatory floor, not a complete verification strategy. Identity testing confirms what the material is. It doesn’t confirm that the supplier’s potency, microbiological, or heavy metals data are accurate. For that, you need a structured COA verification program built around independent re-testing.

Why Overseas Supplier COAs Deserve Extra Scrutiny

The regulatory environment for testing documentation varies significantly between markets. A manufacturer operating under WHO GMP guidelines in Southeast Asia faces a different enforcement landscape than one regulated by the U.S. FDA or the EU’s EMA. GMP-certified facilities can still have weak internal lab controls. Trading companies that don’t manufacture anything can generate COAs for materials they’ve never directly tested. And in some markets, a COA is understood primarily as a commercial document — something that facilitates a transaction — rather than a quality record with legal weight.

There are also structural issues. A legitimate COA from a real, accredited lab can still misrepresent the shipment if the tested sample was cherry-picked, if the COA covers a different lot than the material being shipped, or if the document is genuine but simply recycled from a previous production run. These aren’t fringe scenarios — they come up regularly in incoming material reviews at companies that dig into the paper trail.

To be clear: the majority of overseas suppliers are operating in good faith. But “good faith” and “well-controlled analytical data” aren’t the same thing. A supplier can be fully committed to delivering a quality product and still have internal testing practices that don’t meet ISO 17025:2017 standards for method validation, equipment calibration, or data integrity. Good intentions don’t catch adulteration.

Five COA Red Flags That Signal Unreliable Testing Data

Not every COA problem requires a lab test to identify. Several of the most reliable warning signs are structural — patterns you can catch during document review before the material ever reaches your facility.

1. Suspiciously round or perfectly centered results across multiple lots. Genuine analytical data has natural variation. Heavy metals return at 0.042 µg/g, not 0.04. Potency results land at 34.7%, not 35.0%. When consecutive lot COAs from a supplier all report results at clean round numbers or exactly at the specification midpoint, that’s a strong signal the data is being entered to specification rather than measured. Request raw instrument output — chromatograms, ICP-MS spectra, or plate count images — to verify.

2. No compendial method reference. A defensible COA names the specific method used: USP <232>/<233> for elemental impurities via ICP-MS, USP <2021> for microbial enumeration, or a validated HPLC procedure with a USP or AOAC citation for active markers. “Heavy metals: pass” with no method cited is analytically meaningless — it tells you nothing about the test’s sensitivity, specificity, or relevance to your acceptance limits.

3. Turnaround times that are physically impossible. A comprehensive analytical panel — identity, potency, four-element heavy metals, microbiological enumeration, and yeast and mold count — requires a minimum of 5–7 business days at a qualified laboratory. A COA dated the same day as batch release, or showing a complete microbiological panel completed in under 24 hours, suggests the testing was either abbreviated or not performed.

4. No ISO 17025 accreditation for the testing laboratory. ISO 17025:2017 is the internationally recognized standard for testing laboratory competence. Accredited labs are audited by independent accreditation bodies for method validation, equipment traceability, and data integrity controls. When a supplier’s COA comes from an in-house lab with no external accreditation, you’re relying entirely on the supplier to police its own data. That’s not verification — it’s trust.

5. Zero inter-lot variance across years of production. Real botanical raw materials vary. Agricultural sourcing, growing conditions, harvest timing, and extraction processing all introduce variability from lot to lot. If 30+ consecutive lot COAs from a turmeric supplier all report exactly 95.0% curcuminoids with no deviation, that uniformity almost certainly reflects reporting-to-specification rather than actual measurement. Ask for the standard deviation across the last 20 lots. If it’s zero, you have your answer.

How an Analytical Testing Laboratory Validates Supplier Claims

The most direct corrective action for COA uncertainty is third-party re-testing at an ISO 17025-accredited analytical testing laboratory, using the same compendial method the supplier used. This isn’t duplication — it’s the verification step that converts a supplier’s claim into a confirmed material specification you can rely on.

A few practical points:

Specify the method in your purchase order. If you re-test a botanical extract’s active markers using a different HPLC procedure than the supplier used, discrepancies may reflect method differences rather than data fraud. Getting aligned on methodology upfront — by referencing the relevant USP, Ph.Eur., or BP monograph in your purchase specifications — gives you a clean comparison point when results come back.

Start with identity, every time. For botanicals, HPTLC fingerprinting, DNA barcoding, or near-infrared spectroscopy should be the gate test before anything else. The American Botanical Council’s Botanical Adulterants Prevention Program has documented adulteration concerns in over 100 commercially traded botanical species. If the material isn’t what the label says, additional potency and purity testing is irrelevant.

Tier your testing intensity by risk. A simple excipient with a well-established USP monograph and a clean three-year supplier history might warrant identity-only testing on routine incoming lots. A concentrated extract from a first-time overseas supplier, or any ingredient with a documented market history of adulteration, warrants a full panel — identity, potency, heavy metals, microbiological, and pesticide residues where applicable. Documenting this logic in a supplier risk matrix is what makes the program defensible to an auditor.

Hold reserve samples. 21 CFR Part 111.83 requires U.S. manufacturers to retain reserve samples from each lot for at least one year past the product’s shelf life. Regardless of your regulatory jurisdiction, retaining 50–100 g per incoming lot gives you re-testing capability if quality issues surface downstream — or if a COA is disputed months after release.

Building a COA Verification Protocol That Survives an Audit

Regulatory agencies reviewing your incoming material program — whether FDA under 21 CFR Part 111, Health Canada under the Natural Health Products Regulations, or the MHRA under UK GMP — don’t just want to see that you tested incoming materials. They want to see that your decision-making was structured, documented, and risk-appropriate.

A defensible COA verification protocol includes:

• Written material specifications for each raw material, with acceptance limits and designated compendial methods
• Supplier risk tiers (high, medium, low) with documented rationale based on ingredient sensitivity, supply chain complexity, and prior testing history
• A testing frequency matrix specifying full panel, reduced panel, or identity-only testing by supplier tier and lot sequence (e.g., full panel for the first three lots from a new supplier; reduced panel every fifth lot once consistent compliance is established)
• Clear disposition procedures: pass, hold for re-test, or reject — with escalation requirements for borderline or discrepant results
• Corrective action requirements for any supplier whose COA data is contradicted by independent re-testing, including documentation of the discrepancy and updated review requirements going forward

One oversight we see frequently: manufacturers invest in third-party re-testing but don’t document the verification step adequately. An analytical testing laboratory will provide a test report — but you also need to retain the original supplier COA, your incoming specification sheet, and a disposition record that cross-references all three documents against a specific lot number. If the supplier COA claims ≤0.5 µg/g arsenic per USP <232> and your re-test returns 0.47 µg/g, both documents need to be in your lot file with a disposition record confirming the material passed your acceptance criteria. That traceability chain is what turns a COA into a quality record that survives regulatory scrutiny.

The cost of third-party testing runs roughly $150–$400 per sample for a targeted panel. The cost of releasing a non-conforming raw material into finished product — recall, remediation, regulatory response — is typically measured in six figures or more. Systematizing the decision point of when to test, what to test, and what to do with the result is what converts an incoming inspection step into a genuine quality control function. That’s worth the 15 minutes per lot it takes to get the documentation right.

---

Written by Nour Abochama, VP Operations, Qalitex | Quality Consultant, Ayah Labs. Learn more about our team

Talk to our team about raw material testing Contact us

Related from our network

• ISO 17025-accredited supplement and raw material testing for U.S. brands — Qalitex Laboratories provides identity, potency, elemental impurities, and microbiological testing for dietary supplement manufacturers, with documented chain-of-custody and audit-ready reports.