Since 2007, the FDA has flagged more than 1,000 dietary supplements found to contain undisclosed pharmaceutical ingredients — prescription drugs, controlled substances, and synthetic analogs that never appeared on any label. That database lives on FDA.gov and grows every year. In the vast majority of those cases, there was a “third-party tested” badge somewhere on the packaging.
The phrase has become so overused that it’s nearly lost all meaning. What you actually need to look at is the document behind the badge: the certificate of analysis, or COA.
Knowing how to read one — and more importantly, how to spot an incomplete or manipulated one — is the single most useful skill a supplement shopper can develop. It’s not complicated, but nobody teaches it. Here’s exactly what I look for, and what should make you stop and ask harder questions.
What a Certificate of Analysis Actually Is
A COA is a formal document issued by a laboratory recording the results of testing performed on a specific batch of a product. It’s tied to a lot number, a test date, specific analytical methods, and specific pass/fail specifications. It’s not a summary. It’s not a marketing page. It’s a traceable record.
The key word is traceable. A legitimate COA should allow you — or an FDA auditor — to look up the laboratory, verify its accreditation, match the lot number to the product in your hand, and confirm that the tests performed actually measured what matters.
Under 21 CFR Part 111, the FDA’s Good Manufacturing Practice rules for dietary supplements, manufacturers are required to test every batch of finished product before it ships. But the regulations don’t specify which lab performs that testing, and they don’t require brands to share COAs with consumers at all. That gap is where a lot of confusion — and some outright fraud — lives.
What Every Legitimate COA Must Include
Not all COAs are created equal. I’ve reviewed hundreds of these documents, and the ones that actually tell you something share the same core elements. If any of these are missing, treat the document with real skepticism.
1. Product identification and lot number
The COA must clearly state the product name, the lot or batch number, and the quantity tested. That lot number must match what’s printed on the bottle you’re holding. A COA for “Lot 2021-A” tells you nothing about the product you bought in 2026. This sounds obvious. You’d be surprised how often brands share a single generic COA dated three years ago and call it compliance.
2. Testing laboratory name and accreditation
This is the most important field on the document. The lab should be ISO/IEC 17025 accredited — the international standard that proves a laboratory is technically competent to perform specific tests. You can verify any lab’s accreditation status for free through A2LA.org (the American Association for Laboratory Accreditation) or NVLAP.nist.gov. Look the lab up. If it doesn’t appear in either database, or if the accreditation scope doesn’t cover the tests listed on the COA, that document is not what it claims to be.
3. Test methods
Each result should reference a recognized method: USP (United States Pharmacopeia), AOAC International, EPA, or equivalent. “Tested by proprietary method” is not a standard, and it prevents independent verification. Methods matter because they define how the test was conducted and what its detection limits are. A heavy metals screen using ICP-MS is fundamentally different from a colorimetric spot test, even if both return a “PASS” on a certificate.
4. Numerical results with units and specifications
Here’s what separates a real COA from a marketing document: it shows the actual number. Not just a checkmark. You want to see something like — Lead: 0.08 ppm — Specification: ≤ 0.5 ppm — PASS. That figure tells you how close the product came to its limit. It gives you context a checkbox never can. Specifications should reference established limits: FDA action levels, California Prop 65 thresholds, or USP monograph criteria.
5. Sample acquisition method
This one almost never appears on the COA itself, but it’s worth asking about. Who submitted the sample to the lab? If the brand shipped its own product to a third-party lab, that’s better than internal testing — but it’s still not the gold standard. The cleanest scenario is an independent organization purchasing the product off the shelf and submitting it blind. That’s how ConsumerLab.com operates, and it’s how NSF International’s Certified for Sport program works. Removing the brand from the chain of custody removes a layer of potential manipulation.
The Red Flags That Tell You Something Is Off
A few patterns come up repeatedly when a COA doesn’t hold up to scrutiny. Some of them are subtle.
The lab is “internal.” Some brands list their own in-house facility as the testing entity. Internal testing is actually required under cGMP — but it should never be presented as independent third-party verification. It’s like grading your own homework and calling it a peer review.
The COA covers identity only. An identity test confirms that an ingredient is present. It doesn’t tell you how much is there, whether it’s contaminated with heavy metals, whether it’s microbiologically safe, or whether pesticide residues are within acceptable limits. For anything you’re taking daily, you want to see potency testing, heavy metals (at minimum lead, arsenic, cadmium, and mercury — the “big four”), microbiology (total aerobic count, yeast, mold), and pesticide residues if the product contains botanical ingredients.
The test date is years old. A brand may legitimately test one early batch and never retest. Lot-specific testing means a COA for Lot 001 from 2022 says nothing about Lot 089 from this year. If a brand can’t produce a recent COA for the current production lot, that silence is informative.
The document looks like a brochure. Legitimate lab reports look like lab reports — dense, formatted, maybe a little ugly. A COA that’s been redesigned with brand colors, marketing language, and a prominent logo has almost certainly been edited. Edited lab reports are a cGMP violation. Ask the brand for the raw document directly from the lab. If they say they don’t have it, ask why not.
How to Verify a COA Is Real
You don’t have to take anyone’s word for it. Here’s the process I recommend before committing to any high-dose supplement you plan to take long-term.
Step 1: Search the lab name independently. Don’t click the link the brand provides. Open a new tab, search the lab name yourself, and confirm you’re looking at the same company. Fake COAs sometimes reference real lab names while providing fraudulent contact information.
Step 2: Check accreditation at A2LA.org or NVLAP.nist.gov. Search by lab name or, if it’s listed on the COA, by certificate number. Confirm the scope of accreditation actually covers the tests shown. A lab can be ISO 17025 accredited for microbiological testing but completely unaccredited for heavy metals analysis. Scope matters.
Step 3: Match the lot number on the COA to your product. The lot number is usually printed on the bottom of the bottle or on a seam of the packaging. This one step catches a surprising number of discrepancies.
Step 4: Audit what’s missing. A COA that covers label claim verification but skips contaminants isn’t a safety document. If a brand is genuinely invested in quality, the breadth of testing shows it.
Third-Party Tested vs. Third-Party Certified: A Distinction That Matters
These two phrases appear interchangeably in marketing. They mean very different things.
Third-party tested means a lab ran some tests at some point. That’s it. The brand may have selected which tests to run, which lots to submit, and whether to publish results at all. The entire program runs on their honesty.
Third-party certified means an independent organization — NSF International, USP Verified, Informed Sport, or similar — has established a structured, ongoing program. They regularly pull products from production or from retail shelves, test against predefined standards, and have the authority to revoke certification when products fail. The brand has real skin in the game.
NSF’s Certified for Sport program, for example, requires lot-by-lot testing against more than 200 substances on the World Anti-Doping Agency’s prohibited list. That’s a categorically different commitment than one COA from a one-time lab submission. According to NSF International, fewer than 2% of all supplement brands operating in the US hold any form of third-party certification. That means the remaining 98% are asking you to trust a marketing claim, not a verifiable standard.
What to Actually Ask a Brand Before You Buy
Three questions. Short ones. Brands with nothing to hide answer them quickly.
Can you provide the COA for the specific lot number I’d receive — not a general COA, the current lot?
Is your testing lab ISO/IEC 17025 accredited, and can I verify that accreditation directly at A2LA.org?
Does your COA include contaminant testing — specifically heavy metals and microbiology — or only identity and potency?
How a brand responds to these questions is itself useful data. A deflection toward their website’s “Quality” page, or a vague reassurance about how seriously they take testing, tells you something. A brand that emails you the lot-specific COA within 24 hours — with a verifiable lab name — tells you something very different.
The supplement industry in the US operates under DSHEA, the Dietary Supplement Health and Education Act, a framework that places the burden of safety on manufacturers and limits FDA’s role to post-market enforcement. That structure isn’t changing soon. Which means the practical skill of reading a COA — really reading one, not just confirming that a badge exists — isn’t a niche hobby for nutrition obsessives. It’s consumer self-defense.
If a brand won’t share the document, or the document doesn’t hold up when you look closely, that’s your answer.
Written by Nour Abochama, Host & Quality Control Expert, Nourify & Beautify. Learn more about our team
Have questions about product safety? Talk to our experts. Contact us
Related from our network
- Inside an ISO 17025 Accredited Supplement Lab: What the Testing Process Actually Looks Like — Qalitex Laboratories details the accredited methods behind the COA numbers you’re now reading
- Raw Material Testing and COA Verification: Why Finished-Product Testing Alone Isn’t Enough — Ayah Labs explains why independent verification of incoming ingredients matters before a supplement is ever made
