How to Read a Certificate of Analysis

Every supplement brand talks about quality. Fewer can show you the paperwork. A Certificate of Analysis (COA) is the document that turns quality claims into verifiable data: a formal report from a testing laboratory documenting what is actually in a specific batch of a product and whether it meets safety standards.

If you have never looked at a COA, that is normal. Most supplement buyers have not, because most brands do not make them easy to find. But if you want to evaluate a supplement the way you would evaluate any other serious purchase (on evidence rather than marketing), understanding what a COA says is one of the highest-leverage skills you can develop.

This guide walks through the document section by section. What does each testing panel measure? What do the numbers mean? What red flags should concern you, and what does good look like?

What a COA is, and why it matters

A COA is a quality report issued by a laboratory after testing a specific batch of a product. The batch is identified by a lot number, a unique code that ties the test results to a particular production run. This specificity is what makes a COA meaningful. It is a set of measured results for the actual product that was manufactured and packaged, not a general statement about a product line.

A COA typically covers three domains:

1. Potency and identity: is the right ingredient present, and is it at the claimed dose?
2. Heavy metals: are contaminant levels below safety thresholds?
3. Microbiological safety: is the product free from harmful bacteria, yeast, and mould?

The distinction between "tested" and "third-party tested" is worth understanding. A brand can test its own products in-house and truthfully say the products are tested. Third-party testing means an independent laboratory with no financial interest in the outcome performed the analysis. The independence removes the conflict of interest, and it is the standard that the supplement industry's most rigorous brands hold themselves to.

The gold standard for the testing laboratory itself is ISO/IEC 17025 accreditation, an international standard that certifies the lab's technical competence, the validity of its methods, and the reliability of its results ¹.

The three panels: what each one tells you

Potency and identity testing

This is the panel that answers the most basic question: does this product contain what the label says it contains, at the dose the label claims?

Potency testing measures the actual amount of each active ingredient per serving. A well-constructed COA will show the measured value alongside the label claim, typically expressed as a percentage of the label claim or as an absolute amount. The specification range for most supplements is 90% to 110% of the stated dose, meaning a product labelled as 500 mg per capsule should test between 450 mg and 550 mg.

What to look for:

• Actual numerical values, not just "pass" or "within specification." A COA that shows "500 mg claimed / 507 mg measured" tells you more than one that simply says "pass."
• Identity confirmation: a separate test verifying that the ingredient is actually what it claims to be, not an adulterant or a different compound. This is done via methods like HPLC (High Performance Liquid Chromatography) or mass spectrometry.
• All active ingredients tested, not just the headline compound. A formula with five ingredients should have potency results for all five.

Heavy metals testing

Supplements, like all products derived from natural materials, can contain trace amounts of heavy metals from the soil, water, or processing environment. The four metals of primary concern are arsenic (As), cadmium (Cd), lead (Pb), and mercury (Hg).

The reference standard most commonly used is the United States Pharmacopeia (USP), which sets maximum allowable limits by product type ². Typical limits for dietary supplements are:

Results should be reported as measured values, not just pass/fail. A result of "< 0.01 ug/g" (below the detection limit) is more reassuring than "< 1.5 ug/g" (technically passing but closer to the limit).

For fish oil specifically, heavy metals testing is necessary but not sufficient. Fish oils can also oxidise, a process that degrades the fatty acids and can produce harmful byproducts. Quality fish oil COAs will include oxidation markers: peroxide value (primary oxidation), anisidine value (secondary oxidation), and TOTOX (total oxidation value, calculated as 2x peroxide value + anisidine value). The GOED voluntary standard sets a TOTOX limit of less than 26 ³.

Microbiological testing

This panel checks for harmful microorganisms that could indicate contamination during manufacturing or storage.

The standard tests include:

CFU/g stands for colony-forming units per gram, a measure of viable microbial organisms. For Salmonella and E. coli, the only acceptable result is "not detected." For the count-based tests, lower is better, with USP limits serving as maximum thresholds ².

Red flags: what should concern you

Not all COAs are created equal. Here are the signals that a COA may be less meaningful than it appears.

No lot or batch number. A COA without a lot number is not batch-specific. It may reflect testing from a different production run, or from years ago. The lot number on the COA should match the lot number printed on your product.

In-house testing only. If the testing laboratory is a division of the brand itself, the independence that makes third-party testing valuable is absent. This does not mean the results are wrong. It does remove the structural safeguard against bias.

Missing panels. A COA that shows potency testing but omits heavy metals and microbiological testing is incomplete. Potency without safety is only half the picture.

"Pass/fail" without values. A result that says "pass" without showing what was measured tells you the product met a threshold, but not by how much. Transparency means showing the numbers.

Outdated testing. Supplements have shelf lives, and manufacturing conditions can vary between batches. A COA from two years ago may not reflect the batch in your hands.

Missing lab accreditation. The testing laboratory should be identifiable and ideally ISO/IEC 17025 accredited. If the lab name is absent or the accreditation is unclear, the credential cannot be verified.

Green flags: what good looks like

A strong COA is the opposite of the red flags above:

• ISO/IEC 17025 accredited third-party laboratory clearly identified
• All three panels present: potency, heavy metals, microbiological
• Lot number matching the product you are evaluating
• Actual measured values reported for every test, not just pass/fail
• Recent batch date, reflecting a current production run
• For fish oils: oxidation markers (TOTOX) included alongside heavy metals

A COA that meets all of these criteria is a document you can trust. It is also, unfortunately, a document that many brands in the supplement industry cannot produce on request.

How to request a COA

If quality matters to you (and if you are reading this, it probably does), asking for a COA is straightforward.

Contact the brand or retailer directly. Most will have a customer service channel. Ask for the COA corresponding to the lot number on your product. A brand that values transparency will have this document readily available.

Evaluate the response. A brand that provides a batch-specific, third-party COA promptly has nothing to hide. A brand that cannot produce one, or redirects you to vague "quality" pages, or provides only in-house potency testing, is telling you something about their quality infrastructure.

Check the details. When you receive the COA, verify that the lot number matches your product, the lab is a third-party facility, all three testing panels are present, and the results show actual values.

The bigger picture: why transparency is a buying signal

The supplement industry has a trust problem. The regulatory framework in most countries, including New Zealand's Dietary Supplements Regulations 1985, does not require pre-market approval. The responsibility for quality falls on the sponsor, and enforcement is primarily reactive rather than preventive.

Quality varies enormously as a result. The same compound can be found in products ranging from rigorously tested, pharmaceutical-grade formulations to underdosed, poorly manufactured alternatives. The consumer often cannot tell the difference from the label alone.

A willingness to show a COA is, in this context, a structural buying signal. It separates brands that have invested in quality infrastructure from those trading on marketing alone. It costs real money to commission third-party testing for every batch across every panel. Brands that do it are the ones most likely to be doing the other things that matter: sourcing from verified suppliers, manufacturing in certified facilities, standing behind what is in the bottle.

At Biohacker, every product we carry is third-party tested. We select for brands that maintain this standard because it is the minimum threshold for trust in a category where trust has to be earned. If the approach to quality and evidence-based selection is something you value, our Daily Foundation Guide and Recovery and Immune Guide explain how we think about product selection across every category.

This article is for general educational purposes only. It is not medical advice, and nothing here is intended to diagnose, treat, cure, or prevent any disease.

References

¹ ISO/IEC 17025. General requirements for the competence of testing and calibration laboratories. International Organization for Standardization.

² USP <2232>. Elemental Impurities in Dietary Supplements. United States Pharmacopeia.

³ GOED Voluntary Monograph. Global Organization for EPA and DHA Omega Oils. Oxidation standard: TOTOX < 26.

⁴ Certificate of Analysis best practices: Consumer Healthcare Products Association (CHPA) guidelines for dietary supplement component COAs.

⁵ COA interpretation guides: Blue Ocean Regulatory Inc. (2024), Good vs. Bad Supplement COAs; Sourcify (2024), How to Read a Certificate of Analysis for Supplements.