Certificate of Analysis (CoA) – Lot‑Specific Proof of Quality, Safety & Identity

This topic is part of the SG Systems Global regulatory glossary series.

Updated October 2025 • Cross‑Industry (Pharma, Food, Supplements, Devices, Cosmetics, Chemicals) • LIMS / QMS / MES • Data Integrity, e‑Signatures, Label Alignment

A Certificate of Analysis (CoA) is the authoritative, lot‑specific statement of conformance that presents tested results against approved specifications for a product or component. It unifies laboratory data, method/version context, acceptance criteria, sampling plans, and signatures into a legally relevant record that enables Batch Release and downstream use. A defensible CoA does more than list numbers: it integrates genealogy, deviations/OOS handling, Change Control history affecting the lot, and the current effective BOM / recipe and label claims. In modern operations, the CoA is compiled automatically from controlled sources (eBMR, LIMS, QMS) and issued in human‑readable (PDF) and machine‑readable (JSON/CSV) formats with controls to prevent tampering under 21 CFR Part 11 / EU Annex 11.

“If the CoA isn’t generated from source‑truth and bound to the lot genealogy, it’s not assurance—it’s stationery.”

1) What It Is

A CoA certifies that a specific lot (or serialised unit for devices) meets identity, purity, quality, safety, and performance specifications defined in approved master data. It summarises sampling plans, test methods, results with units and significant figures, pass/fail determinations, and context such as manufacturing date, expiry/retest date, storage conditions, site of manufacture, and responsible signatories. For pharma and supplements, the CoA typically covers identification, assay/potency, related substances, residual solvents, water, microbial attributes, and physical tests (appearance, pH, viscosity). For food, allergens and label claim checks are central; for devices, sterilisation/bioburden endpoints and UDI integrity may feature. The CoA should reference the effective specification version so changes are traceable through CPV, APR/PQR, and SPC control limits.

CoA vs. CoC. A Certificate of Conformance (CoC) attests that a product meets specified requirements but may not include analytical data. A CoA must present actual results. Many sectors require both: CoA for data; CoC for contractual/regulatory declarations (e.g., origin, REACH, Proposition 65). Supplier CoAs for Component Release can support reduced testing—only when supplier qualification, method comparability, and correlation studies justify it.

2) Lifecycle & Governance

A credible CoA lifecycle spans definition → generation → review/approval → issuance → retention → complaint/recall linkage. In definition, Quality sets the specification with tests, methods, limits, units, and sampling aligned to predicate rules and filings. Methods carry version control and validation status; attributes map to filings or label claims. During generation, LIMS posts approved results (with instrument/method trace), and eBMR contributes manufacturing context (yield, alarms, deviations). Any OOS / OOT must be investigated and closed in QMS, with final decisions reflected on the CoA. Review/approval is executed via Approval Workflow and e‑signatures. Issuance produces locked, tamper‑evident documents and, increasingly, QR/GS1 links to a verification portal. Retention follows record‑keeping rules; the CoA must be retrievable with complete audit trails. If complaints or recalls occur, the CoA is the primary evidence for what was released, when, and under which spec revision.

Minimum credible contents. Product/strength/SKU; lot/serial; manufacturing and expiry/retest dates; site; specification version; test list with method IDs and units; sampling plan; numerical results with rounding rules; pass/fail; reviewer/approver names and e‑signatures; storage/transport conditions; special statements (allergen, GMO, BSE/TSE). Optional but recommended: stability status, cross‑contamination notes where relevant, and supply‑chain identifiers to support Batch Genealogy.

3) Data Structure, Integrity & Traceability

CoA credibility depends on provenance and immutability. Each result must be traceable to a specific instrument, method version, analyst, and sample. Calculations and units must be controlled; conversions (e.g., anhydrous vs. as‑is potency) must be explicit. Where composites are used, logic and sample IDs must be recorded. All edits require reason‑coded entries with timestamped trails consistent with ALCOA+. The CoA should reference the effective recipe/spec and label template in force at the time of release to close the loop with Change Control. Linking CoAs to Bin / Location Management and Barcode Validation ensures the document issued to customers matches the actual lot shipped.

Machine‑readable CoAs. Structured payloads allow automated receiving and disposition. A pragmatic schema includes a header (product/lot/spec/version/site), test array (id, method, units, result, limit, pass/fail), attachments (chromatograms, spectra), signatures, and a cryptographic hash shared with the PDF. QR codes/GS1 Digital Link on labels can point to the CoA endpoint, enabling instant verification at goods receipt and eliminating version mismatches.

4) Sampling Plans & Method Validation

Sampling defines representativeness. Whether using AQL tables, attribute sampling for micro, or variable plans for assay, the plan must appear or be referenced on the CoA. If stratified sampling is used (drum, bag, time‑based pulls), record strata and composite logic. Tie sampling to GMP sampling plans and keep chain of custody intact from collection to analysis. For retesting or re‑sampling, QMS must provide scientific justification—not “result shopping.”

Methods require fitness‑for‑purpose. Document TMV parameters—specificity, accuracy, precision, linearity, range, robustness—and carry status (validated/verified/compendial). Version methods and tie them to the CoA so results remain interpretable years later. For compendial changes, perform verification and update specifications via Change Control.

5) Digital Enforcement & Label Alignment

In a disciplined stack, the CoA is compiled by the system of record: LIMS contributes results; MES contributes batch context; QMS contributes deviation/CAPA status; labels pull claims from approved masters. Attempting to release a lot without a complete CoA—or with a CoA referencing superseded specs—must be blocked. Label content (strength, allergens, expiry) must reconcile with the CoA data; printing from legacy templates should be technically impossible via Approval Workflow and version interlocks.

Incoming CoAs & reduced testing. Supplier CoAs are part of Component Release. Acceptance may enable skip‑lot or attribute reductions—but only after supplier qualification, method comparability, and historical correlation. Supplier changes must trigger Change Control and risk reassessment; WMS should quarantine lots until verification is complete.

6) Common Failure Modes & How to Avoid Them

• Manual CoAs. Re‑keying invites transcription errors. Use direct interfaces/APIs, lock templates, and enforce audit trails.
• Spec/version drift. Outdated limits referenced after changes. Bind CoA generation to current spec via Change Control.
• Label misalignment. Claims not matching CoA or masters. Ensure label templates pull from the same master data set.
• Open OOS/OOT investigations. Do not release lots until investigations close; annotate justified re‑tests.
• Supplier CoA over‑trust. Skip‑lot testing without qualification/correlation. Require periodic verification sampling.
• Editable PDFs. Use tamper‑evident documents hosted with e‑signatures under Part 11.

7) How It Relates to V5

V5 by SG Systems Global generates CoAs directly from source‑truth across production, lab, quality, and warehouse. Each lot’s history—materials, Batch Weighing tolerances, alarms, yield, Cleaning Validation status—feeds the context section. LIMS results flow via V5 Connect API, preserving method IDs, LOQs, and analyst attribution. QMS contributes deviation/OOS dispositions and CAPA references. The CoA template is version‑controlled; generation is blocked if the spec or label template is obsolete. At shipment, Bin / Location Management and Barcode Validation ensure the right PDF/QR is attached to the actual lot and customer order. For APR/PQR, V5 aggregates CoA attributes (assay trends, micro rates) into dashboards and CPV charts with SPC to detect drift long before failures.

Incoming materials. For Component Release, supplier CoAs are ingested, parsed, and compared to purchase specs; WMS automatically places discrepant lots in Quarantine/Hold; sampling/verification instructions publish to LIMS; only upon QA approval does inventory move to “Released,” enabling picks into Batch Tickets.

8) Segment Patterns & Special Considerations

Pharma/API: Emphasise identification (IR/UV), assay on anhydrous or as‑is basis, impurities by HPLC/GC, residual solvents, water (KF), micro where applicable, and stability. Tie the CoA to process validation and filings.

Supplements/Nutra: Identity (botanical markers), potency (assay), micro (TPC/yeasts/moulds/pathogens), heavy metals, pesticides, and identity testing for incoming botanicals. Link to 21 CFR 111 batch controls.

Food & Beverage: Allergen declaration checks, label claim verification (net content, nutrition facts), micro, and shelf‑life indicators. Align with FEFO and HACCP.

Medical Devices: Sterility assurance level, bioburden, endotoxin, functional tests, packaging integrity, and UDI verification. The CoA complements the DHR.

Cosmetics: Identity, micro, stability/compatibility, claim substantiation, and MoCRA‑relevant statements.

Related Reading
• Systems & Records: Automated Batch Records (eBMR) | Batch Manufacturing Record (BMR) | Barcode Validation
• Release & Supply: Batch Release | Component Release | Bin / Location Management
• Quality & Trending: Continued Process Verification (CPV) | Control Limits (SPC) | APR / PQR
• Compliance Foundations: 21 CFR Part 11 | EU Annex 11 | Audit Trail (GxP)