Quality Agreements with Your Contract Analytical Testing Laboratory: 10 Clauses Most Manufacturers Miss

The scenario is familiar to anyone who’s been in raw material QA long enough. A manufacturer submits a batch of ashwagandha root extract to an outside lab for identity and potency verification. Six weeks later — after the lot has already been incorporated into a finished product — results come back showing withanolide content at 4.1%, well below the 5.0% minimum on the specification. A follow-up call reveals the lab used HPLC with a different mobile phase gradient than the validated method referenced on the purchase order. No quality agreement existed that specified the method. No recourse. No clear path forward except an expensive raw material rejection and a delayed launch.

That’s not a testing problem. It’s a documentation problem.

Quality agreements between supplement and cosmetic manufacturers and their contract analytical testing laboratories sit in a strange middle ground: everyone acknowledges they’re required, most companies have something on file, and far too few have a document that actually protects them when results are disputed, timelines slip, or a lab quietly updates its procedure without notice.

Why a Quality Agreement Is a GMP Requirement, Not a Formality

Under 21 CFR Part 111, Subpart F, dietary supplement manufacturers must establish specifications for each component (§111.70), test or examine incoming components against those specifications (§111.75), and document the results (§111.255). When testing is outsourced to a contract analytical testing laboratory, none of those obligations transfer with the samples. The manufacturer retains full regulatory responsibility for the outcome.

FDA investigators know this, and they look for it. In FY2023, inadequate component testing documentation was among the most frequently observed issues in dietary supplement 483s. The language varies — “failed to establish written specifications,” “no evidence of identity testing,” “unable to provide testing records for components” — but a significant proportion of those observations trace back to manufacturers who relied on a contract lab without a binding, specific agreement governing what that lab was supposed to do and how it was supposed to document it.

ICH Q10 (Pharmaceutical Quality System) and ICH Q7 (GMP for Active Pharmaceutical Ingredients) both explicitly require quality agreements between a company and its contract service providers. ISO/IEC 17025:2017 — the current edition of the laboratory accreditation standard — requires that labs communicate clearly with customers about test methods, equipment, and measurement uncertainty. A quality agreement is the mechanism that makes that communication enforceable and auditable.

The document you sign before your first sample ships determines what leverage you have every time something goes wrong afterward.

The 10 Clauses Your Quality Agreement Must Actually Contain

Most quality agreements fail not because they’re badly written, but because they’re incomplete. Here’s what genuinely protective language looks like across the clauses that matter most.

1. Scope of Testing and Method References

Don’t write “identity and potency testing.” Write “botanical identity by HPTLC per USP <563>, potency as withanolides by HPLC per customer method AY-ASHW-003, Revision 2.” Specify the exact method, version, and pharmacopeial reference. If a compendial method applies, name the specific chapter and edition — USP, Ph.Eur., or BP — so there’s no ambiguity about which procedure governs.

2. Acceptance Criteria and Specification Limits

Reference — or physically attach — the complete specification for each material the lab will test. Never rely on the lab to pull acceptance criteria from a previous submission or an informal email thread. Limits should be stated in the same units the lab will report, with precision and significant figures defined.

3. Sample Handling, Storage, and Retention Requirements

Define how samples are logged on receipt, stored (temperature, humidity, light exposure requirements), and retained after testing is complete. A standard retention window is one year past the lot’s expiration date or one year after final disposition, whichever comes later. This protects you if a regulatory inquiry arises 18 months after the material was released.

4. Turnaround Time Commitments

“As soon as possible” is not a turnaround time. Specify standard TAT — typically 7 to 10 business days for routine chemical and microbial testing — and rush TAT when the option exists (commonly 2 to 3 business days). Include what constitutes a missed deadline, what notification is required, and whether missed TATs affect pricing.

5. COA Format and Reporting Standards

Define the Certificate of Analysis format explicitly: what it must contain (lot number, date of analysis, method references, numerical results, measurement uncertainty where applicable, pass/fail statement, signatory), what units are used, and how many decimal places are reported. This prevents the lab from issuing a COA that meets their internal template but omits a parameter your customer or regulatory submission requires.

6. Out-of-Specification Investigation Protocol

When a result falls outside the agreed specification, who calls whom, within how many hours, and what happens next? FDA’s 2006 guidance on OOS investigations remains the foundational reference here. Your quality agreement should establish a maximum notification window — 24 to 48 hours from result confirmation is standard — define Phase I investigation steps (analyst error review, calculation check, instrument performance verification), and state whether Phase II confirmatory retesting requires mutual written approval. Without this clause, the lab’s OOS procedure may differ entirely from what your QA team expects.

7. Data Integrity and Records Access

The COA is a summary document. Raw data is everything behind it: instrument printouts, integration reports, weighing records, reagent lot numbers, analyst identifiers. Your quality agreement must define what raw data the lab retains, for how long, and whether your quality team has the right to audit those records — either on-site or remotely. A lab that won’t commit to audit rights in the quality agreement is worth asking hard questions about.

8. Accreditation Scope and Change Notification

Require the lab to maintain ISO/IEC 17025:2017 accreditation specifically covering the tests they perform for you, and attach a copy of their current scope to the agreement. More importantly, require written notification — with at least 30 calendar days’ advance notice — of any change to their accreditation status, relevant testing personnel, critical equipment, or test methods. A lab that replaces its ICP-MS system without telling you has changed the measurement platform your specification was validated against, and you may have no idea.

9. Subcontracting Restrictions

This is the clause most manufacturers never include and most regret. Many contract analytical testing laboratories subcontract specific tests — especially specialized ones like DNA barcoding, dioxin and PCB analysis, or certain trace element panels — to facilities they have their own relationships with. Your quality agreement should either prohibit subcontracting outright or require written pre-approval, including the name, address, ISO 17025 accreditation number, and specific scope of any proposed subcontractor. More on why this matters in the next section.

10. Confidentiality, Data Ownership, and IP Protection

Formulations are proprietary. Method parameters shared with a lab may constitute trade secrets. Clearly state that test data, formulation details, and any customer-provided methods belong to your company, cannot be used for other customers or internal purposes, and must be returned or securely destroyed if the relationship ends.

The Subcontracting Problem Nobody Talks About

The subcontracting issue deserves more than a line item in a checklist. In a competitive contract testing market, labs frequently win business on price and turnaround time and then outsource the tests they lack the capacity or equipment to run efficiently in-house. Botanical DNA barcoding is a common example — the infrastructure is specialized enough that many mid-sized analytical testing laboratories partner with dedicated genomics facilities. Heavy metal analysis by ICP-MS, dioxin testing, and pesticide residue panels by GC-MS/MS are others.

There’s nothing inherently wrong with subcontracting. But it creates a secondary quality system you haven’t vetted, can’t directly audit, and may not know exists. If the subcontractor isn’t ISO 17025-accredited for the specific test, or if their method diverges from the one referenced in your specification, the COA you receive has an invisible traceability gap. And in an FDA inspection, “I didn’t know my lab was outsourcing that test” is not a defensible position — because you should have known, in writing, before you submitted the first sample.

Our team at Ayah Labs maintains a standard subcontracting clause in all customer quality agreements, and it has surfaced outsourcing arrangements that manufacturers were completely unaware of more than once. In one case, a customer’s “contract lab” was sending botanical microscopy samples to a facility with no formal accreditation whatsoever.

Before Your Next Sample Ships

Pull out the quality agreements you have on file with each contract analytical testing laboratory you currently use. Ask three questions: Does it specify test methods by name and version? Does it restrict or require pre-approval of subcontracting? Does it grant your QA team access to raw instrument data?

If the answer to any of those is no — or if you don’t have a signed agreement at all — you are operating with less protection than GMP requires and less leverage than you need.

The right time to negotiate these terms is before the first sample arrives at the lab’s dock. A lab that resists method specificity, subcontracting transparency, or audit access is communicating something about how they work. That information is worth having before you’ve built your release process around their turnaround times.

Quality agreements are not bureaucratic overhead. They are documented proof that your testing program — even when executed by a third-party laboratory — is genuinely under your control. In a GMP audit, that distinction is the difference between a compliant program and a 483 observation.

---

Written by Nour Abochama, VP Operations, Qalitex | Quality Consultant, Ayah Labs. Learn more about our team

Talk to our team about raw material testing. Contact us

Related from our network

• ISO 17025-accredited supplement and raw material testing services — Qalitex Laboratories offers accredited identity, purity, potency, and microbiology testing with documented chain of custody for every sample.