A Supplier's CoA Is Where Verification Starts, Not Where It Ends

Every lot of raw material that arrives at a supplement plant comes with a certificate of analysis. It lists the tests the supplier ran, the limits, and the results. For a busy receiving dock, it is tempting to file the CoA, check the box, and release the lot to production.

That shortcut is one of the most common reasons manufacturers end up in an FDA warning letter. The rule is not that CoAs are untrustworthy. It is that a CoA is only as good as the work you did to earn the right to rely on it.

What the rule actually says

For dietary supplements, component verification lives in 21 CFR 111.75(a). It splits components into two groups and treats them differently.

Dietary ingredients (the botanicals, vitamins, minerals and other actives on the label) must get at least one appropriate test or examination to verify identity before use. A supplier's CoA cannot replace that test. The only way out is a citizen petition to FDA under 21 CFR 10.30, backed by data showing your alternative gives the same assurance as testing every lot.

Other components (excipients, capsules, flow agents and the like) must be checked for identity and against your specifications. Here you may rely on the supplier's CoA, but only if you have qualified that supplier first. Qualification means:

1. Confirming the supplier's results with your own tests or examinations.
2. Requiring the CoA to show the tests performed, the limits and the actual results.
3. Keeping records that document how you qualified the supplier.
4. Re-confirming the supplier's results at regular intervals.
5. Having quality control review and approve that documentation.

In short: identity testing on actives is not optional, and trusting a CoA for anything else is a privilege you earn and keep earning.

What a working qualification program looks like

The regulation sets the outcome, not the procedure. Most well-run plants land on a program with these pieces:

• Written specifications for every component. You cannot confirm a CoA against limits you never wrote down. Identity, purity, strength, composition and contaminant limits belong in a spec before the first lot arrives.
• An initial qualification. Test the first several lots yourself, ideally at an independent lab, and compare your results to the supplier's CoA. Agreement across multiple lots is the evidence that the supplier's lab can be trusted.
• A supplier file. Questionnaires, audit reports, certifications and the comparison data from your qualification, kept together and approved by QC.
• A re-confirmation schedule. Pick an interval (every lot for a new supplier, then every Nth lot or annually) and stick to it. Write down why you chose it.
• A trigger for requalification. A failed confirmation test, a change in the supplier's site or process, or a complaint should send the supplier back to full testing until they earn trust again.
• Identity testing on every dietary ingredient lot, regardless of how good the supplier is.

Where programs break down

FDA warning letters cite 111.75 year after year (see, for example, letters to Nutritional Engineering and Ceba Tek). The same gaps show up again and again:

• No identity test on a dietary ingredient because the CoA "already covers it."
• Qualification on paper only. A supplier file exists, but nobody ever ran a confirmation test against it.
• CoAs that don't match the spec. The supplier tested different attributes, used a different method, or reported "conforms" instead of a result.
• Re-confirmation that quietly stopped. The schedule was written in year one and never followed after.
• Records nobody can find. The CoA is in an email, the confirmation result is in a lab portal, and the approval is in a binder. During an inspection, that is the same as not having it.

Why this is a network problem, not a paperwork problem

Most of these failures have the same root cause: the manufacturer and the supplier keep separate records and talk through email attachments. Every lot means another PDF to chase, read, compare against a spec and file. Every re-confirmation depends on someone remembering it is due.

When suppliers and manufacturers work in a shared network, the picture changes. The supplier posts the CoA once, attached to the lot it describes. The manufacturer sees it against its own specification the moment the lot is received. Qualification history, confirmation results and approvals sit next to the supplier's profile instead of in four different places.

That is the idea behind AMNI: a quality network that connects manufacturers and their suppliers, with AI-powered intelligence that reads incoming documents and flags what needs a human decision. It does not replace your QC unit's judgment or your identity testing. It removes the chasing, so the people responsible for quality spend their time on the decisions the regulation actually asks them to make.

The takeaway

A CoA is the start of verification, not the end of it. Test the identity of every dietary ingredient. Qualify a supplier before you rely on its CoA for anything else, and keep re-confirming. Keep the evidence where you can show it in minutes, not days.

If you want to see how AMNI connects your suppliers and keeps that evidence in one place, get in touch.