You are weighing up a supplement, the label says "third-party tested", and somewhere behind that phrase sits a certificate of analysis. The question you actually want answered is plainer than the document looks: can you trust what this product says is in the bottle? A COA is the closest thing to a straight answer, once you know which questions it settles and which it quietly leaves open.
A COA records test results for one identified lot of material against a written specification. Read well, it is real evidence. Read carelessly, it is a logo doing the work of a lab report. The difference is a handful of specific checks, and none of them need a chemistry degree.
What does a COA actually tell you?
Strip away the formatting and a COA answers three questions about a batch. Is the material what it claims to be (identity)? How much of the active ingredient is present (assay, or potency)? Do the contaminants that matter for this kind of product sit under a defined limit? Each result is only meaningful next to the specification it was judged against and the method used to measure it.
That is the useful core. Identity, potency and contaminants, tied to one lot and one specification, are what a good COA delivers.
It is worth being clear about the edges too. A COA covers the tests printed on it, for the sample tested, on the date shown. It does not prove that every possible contaminant was screened, that the next batch will match this one, or that the product will do anything for your health. Treat it as a test record for a batch, not a verdict on the product.
Does the certificate even cover the bottle in your hand?
This is the check most people skip, and it is the one that decides whether the rest matters. A COA describes a specific lot. If the lot code on the certificate does not match the lot printed on your bottle, the document is describing a different batch of product.
Two kinds of document get called a COA. A lot-specific certificate reports the actual batch you are holding. A generic or representative certificate shows the manufacturer's testing format using an older or example lot. The generic version tells you how they test, not what came out of the batch on your shelf.
So before reading a single result, find the lot or batch code and confirm it matches. Then confirm the sample is properly identified: exact product name, form, and an item or SKU code, not just a brand and a nice PDF. A result you cannot tie to your batch is background reading, not proof.
How do you read the identity and potency lines?
Identity and potency answer different questions and often need different methods. Identity asks whether the material is genuinely what the label says. Potency, or assay, asks how much of a named constituent is actually present. A certificate can pass one and say nothing useful about the other.
There is no universal "90% to 110%" band that every supplement should hit. The acceptable range depends on the ingredient, the applicable monograph, whether the number is a minimum or a label claim, and the manufacturer's justified specification. A vitamin tablet, a botanical extract and a probiotic cannot all be measured against one default percentage.
Units are where confident readers still trip. A result of "507 mg" means little until you know whether that is per capsule, per serving or per gram, and whether the spec is a floor, a ceiling or a target. For a botanical, look for the scientific name, the plant part, and the extract ratio or marker compound.
One more line reads differently than people expect. A bare "Pass" can be perfectly appropriate for a qualitative identity test when the method and acceptance criterion are stated. A "Pass" with no method and no specification simply leaves too much unsaid.
What about heavy metals and other contaminants?
Lead, cadmium, arsenic and mercury are the contaminants most dietary-supplement risk assessments start with. The limit that applies depends on the product type, the daily intake and the compendial or regulatory basis, so one microgram-per-gram table does not belong on every certificate.
USP General Chapter <2232> is the standard most often cited here. It sets limits for elemental contaminants in finished dietary-supplement dosage forms labelled as conforming to USP or NF standards, and it is written for finished products rather than individual dietary ingredients 3. A concentration result also needs the serving size and daily amount before you can judge it against a daily-exposure limit.
Two small checks make the contaminant lines trustworthy. Read the unit carefully, because `µg/g`, `mg/kg` and `µg/day` only convert once you know the serving mass. And for any "not detected" or "less than" result, check the reporting limit is low enough to actually decide compliance. "Not detected" only ever means below the method's stated detection capability, so a high reporting limit can hide a result that would have mattered.
The tests that belong on a COA also follow the product. A fixed three-panel checklist can miss the risk that matters most for a given material.
| Product type | Questions a COA should be answering |
|---|---|
| Fish or algal oil | EPA/DHA identity and content, oxidation, environmental contaminants |
| Botanical extract | Species and plant-part identity, marker assay, pesticides or solvent residues where risk-assessed |
| Mineral product | Elemental identity, assay and relevant elemental contaminants |
| Probiotic | Organism identity, viable count under stated conditions, and objectionable-organism tests |
| Finished tablet or capsule | Active-ingredient assay, plus uniformity or performance tests where the spec requires them |
So treat the table as prompts and expect the certificate to test what the material's own risks call for. A potency-only result, for instance, cannot answer a contaminant question.
Does "third-party tested" or "ISO 17025" mean what you hope?
"Third-party tested" is a strong phrase that sometimes covers a soft claim. Read literally, it should name the external laboratory and identify which tests that lab actually performed. A logo, or a general statement, can sit next to results that came from the manufacturer's own bench. A manufacturer-issued COA and an external laboratory report are both legitimate, and they are not automatically the same document.
ISO/IEC 17025 is the international standard for the competence, impartiality and consistent operation of testing laboratories 1. A lab referring to the standard is not the same as an accreditation body having accredited that lab for the specific test on your certificate. Accreditation is also scoped. International Accreditation New Zealand defines a laboratory's scope by sample classes, specific tests and methods, so a lab accredited for water microbiology is not automatically accredited for elemental analysis of capsules 2.
If an accreditation claim matters to your decision, it takes about two minutes to verify:
- Find the accreditation body's directory and the lab's current certificate. For a New Zealand lab, the IANZ directory publishes both.
- Open the scope attached to that accreditation.
- Check the relevant matrix, analyte and method are all covered, and that the accredited site matches the site that reported your result.
The red flags worth scanning for
Once you have read a few certificates, a short scan tells you whether a document is worth trusting:
- The lot does not match. The certificate is describing a different batch.
- The sample is vaguely identified. A product name with no form, item code or lot is ambiguous.
- The specification is missing. A number cannot pass or fail without its acceptance criterion.
- Methods or units are absent. Results from an unknown method or unit are hard to interpret.
- Accreditation is asserted but not traceable. Check the body, certificate and scope, not the ISO logo.
- The testing does not match the product. A potency-only certificate says nothing about contaminants or oxidation.
- Reporting limits are too high. "Not detected" against a loose limit can still hide a real result.
What a COA can settle, and where trust comes from
A well-made, lot-specific COA shows that the listed sample was tested by the stated methods and met the stated specifications. That is genuine, bounded evidence, and it is worth asking for. It does not establish that a product works, prove the whole supply chain, replace GMP records, or rule out substances nobody tested for.
That bounded quality is why a certificate is one input to a trust decision rather than the whole of it. In New Zealand, Medsafe notes that dietary supplements have no pre-approval process and the sponsor remains responsible for acceptable quality, safety and legal compliance 4. That responsibility does not turn any single standard into one mandatory template, so a good certificate names the specification actually applied to that product.
At Biohacker we assess the testing information available for each product and supplier, and documentation varies, so we do not treat one "third-party tested" line as proof that every lot receives the same panel. If a current, lot-specific document matters to your decision, ask the retailer for that exact record and read it against the label you were sent.
Our Daily Foundation Guide and Recovery and Immune Guide cover why form, dose and delivery format need product-specific reading, and Omega-3 Dosing: What the Research Says goes deeper on the label and oxidation questions specific to fish oils.
This article is for general educational purposes only. It is not medical advice, and nothing here is intended to diagnose, treat, cure, or prevent any disease.
References
- International Organization for Standardization. ISO/IEC 17025:2017: General requirements for the competence of testing and calibration laboratories. Confirmed current in 2023. https://www.iso.org/standard/66912.html
- International Accreditation New Zealand. Biological Testing Laboratory: Scopes of Accreditation. https://www.ianz.govt.nz/programmes/biological-testing-laboratory/
- United States Pharmacopeia. General Chapter <2232>, Elemental Contaminants in Dietary Supplements. USP-NF. 2022. doi:10.31003/USPNF_M5291_01_01
- Medsafe. Regulation of Dietary Supplements. Revised 15 October 2024. https://www.medsafe.govt.nz/regulatory/DietarySupplements/Regulation.asp