Certificate of Analysis (COA): What It Is and How Food Manufacturers Manage Them

A certificate of analysis (COA) is a document issued by a supplier or testing laboratory that reports the test results for a specific lot of material against agreed specifications. For a food manufacturer, a COA is evidence about an ingredient lot: it typically lists the product, lot number, test parameters, methods, results, specification limits, and who authorized the report. It is useful, but it is one input to supplier control, not a substitute for it.

What Is on a Certificate of Analysis?

• Identification: product name, lot or batch number, and often quantity, manufacture date, and expiry or retest date.
• Tests and methods: the parameters tested (for example moisture, pH, microbiological counts, allergen or contaminant results) and the method used for each.
• Results against specification: the measured value next to the acceptance limit.
• Authorization: the lab or quality representative who issued and signed off the report, and the issue date.

What should be on the COA for your ingredient depends on your specification, not on a universal template. If your spec doesn't say which parameters must be reported, you can't judge whether the COA is complete.

COA vs. Certificate of Conformance

A COA reports actual measured results for a lot. A certificate of conformance (COC) states that the lot meets the specification without necessarily reporting the data. Many food manufacturers require a COA for ingredients where the measured values matter (for example a critical specification) and accept a COC where a pass/fail statement is enough. Whichever you require should be written into the supplier specification.

Is a COA Required by FDA?

FDA's preventive controls rule for human food does not mention certificates of analysis by name. What it does require, where a hazard needs to be controlled by a supplier, is a supply-chain program. Under 21 CFR 117.410, that program includes using approved suppliers and determining, conducting, and documenting appropriate supplier verification activities. For raw materials and other ingredients, the rule lists onsite audits, sampling and testing, review of the supplier's relevant food safety records, and other activities based on supplier performance and risk. 21 CFR 117.475 sets out what has to be documented, including the material tested, tests conducted, dates, results, corrective actions, and the laboratory involved when sampling and testing is the verification activity.

In our reading, that means a COA is a record you collect and evaluate, not an automatic verification activity. Whether it counts toward verification depends on how your supply-chain program is written and the hazard involved. Customers and GFSI audit schemes also commonly ask for COAs, so many plants collect them regardless. Our guide to the SQF supplier approval program minimum requirements covers how an auditor looks at that evidence.

How to Review a COA at Receiving

1. Match it to the delivery. Product name, lot number, and quantity should agree with the pallet labels and the bill of lading. A COA for the wrong lot is worse than no COA.
2. Check completeness. Every parameter in your specification should appear, with a method, a result, and a limit.
3. Compare results to your limits. Use your acceptance limits, not only the supplier's. A result inside the supplier's range but outside yours is a rejection.
4. Check dates and sign-off. The test date should be plausible for the lot, and the report should show who authorized it.
5. Decide and record. Accept, hold, or reject, and note why. Out-of-spec or incomplete COAs should trigger a hold and a supplier follow-up, not a quiet acceptance.
6. File it against the lot. A COA you can't find during a recall or audit may as well not exist.

This sits alongside the physical checks at the dock; our receiving inspection checklist covers those.

What a COA Can and Cannot Tell You

The limits matter. A COA reports what the supplier tested on the sample they took. It doesn't show that the sample represented the whole lot, that the supplier's food safety system works, or anything about hazards nobody tested for. That is why COAs usually sit inside a broader program that includes supplier approval, periodic audits or questionnaires, and your own testing where the risk justifies it. The best supplier quality management software for FSQA teams roundup looks at how teams manage that evidence at scale.

Common COA Problems

• The COA arrives days after the material, so the lot is already in production.
• Lot numbers on the COA and the pallet use different formats.
• Parameters are missing or reported as "pass" with no value.
• Specifications change but the COA review checklist doesn't.
• COAs are saved as PDFs in email threads, so nobody can pull them by lot.

Most of these come down to the same fix: capture the COA at receiving, check it against the specification, and link it to the lot record. IONI’s Ingredients Intelligence is built around keeping ingredient specs and supplier documents tied to the lots they belong to.

FAQ

What is a certificate of analysis (COA)?

A COA is a supplier or laboratory document that reports the test results for a specific lot of a product against agreed specifications, typically including lot number, parameters, methods, results, limits, and authorization.

How do you read a certificate of analysis?

Confirm the product and lot match the delivery, check that every specified parameter is reported with a method and result, compare each result to your acceptance limits, and check the test date and who signed off.

Is a COA the same as a certificate of conformance?

No. A COA reports measured results for a lot. A certificate of conformance states that the lot meets the specification without necessarily showing the data.

Does FDA require certificates of analysis for food ingredients?

The preventive controls rule does not name COAs. It requires supply-chain programs, with documented supplier verification activities, where a hazard is controlled by a supplier. A COA can be part of the records you collect, but how it is used depends on your program.

How long should I keep a COA?

Keep COAs at least as long as the related records must be retained under your applicable rules and customer requirements. Under 21 CFR Part 117 Subpart F, records generally must be kept for at least two years, and many sites keep COAs through product shelf life plus a buffer.