Certificate of Analysis (CoA) for Food Brands: What It Is, What to Check, and How to Manage Them
A CoA is your supplier's proof that an ingredient lot meets your specifications. Here is how to read one, what to verify, and how CoA management connects to FSMA 204 traceability requirements.
A Certificate of Analysis (CoA) is a document provided by a supplier that certifies the results of testing performed on a specific lot of an ingredient or material. It is your primary evidence that what arrived at your facility matches what you ordered — in terms of identity, purity, potency, and safety.
For food brands, CoAs are not optional paperwork. They are a core part of your HACCP plan, your organic certification audit trail, and your FSMA 204 traceability records. If you cannot produce a CoA for an ingredient lot during an FDA inspection or a retailer audit, you have a compliance problem.
What a CoA Contains
A well-structured CoA includes the following elements:
| Section | What It Contains | Why It Matters |
|---|---|---|
| Product identification | Ingredient name, supplier item code, your PO number | Confirms the CoA matches the specific lot you received |
| Lot number / batch number | Supplier's internal lot identifier | Critical for FSMA 204 traceability linkage |
| Manufacturing date / expiration date | Production date and shelf life | Determines FIFO rotation and use-by compliance |
| Physical/chemical specifications | Moisture content, particle size, pH, color, viscosity | Confirms ingredient will perform as expected in your formula |
| Microbiological testing | Total plate count, yeast/mold, Salmonella, Listeria, E. coli | Food safety — non-negotiable |
| Heavy metals (if applicable) | Lead, arsenic, cadmium, mercury levels | Required for baby food, supplements, and many organic certifications |
| Pesticide residue (if applicable) | Residue levels vs. tolerance limits | Required for organic certification and many retailer programs |
| Allergen statement | Presence/absence of major allergens | Label compliance and cross-contamination risk management |
| Certifications | Organic, kosher, non-GMO, gluten-free certificates | Required for certified claims on your label |
| Authorized signature | QA manager signature and date | Confirms the document is official |
What to Verify When You Receive a CoA
Receiving a CoA is not the same as verifying it. Most food brands file CoAs without actually checking whether the values are within spec. Here is a systematic verification process:
Step 1: Confirm the Lot Number Matches
The lot number on the CoA must match the lot number on the physical label of the ingredient you received. This sounds obvious, but suppliers occasionally send a CoA from a previous lot. If the lot numbers do not match, request the correct CoA before using the ingredient.
Step 2: Check Every Value Against Your Approved Specification
You should have an Approved Supplier Specification (ASS) or Ingredient Specification Sheet for every ingredient you purchase. Compare each value on the CoA against your specification limits. Flag any value that is out of spec — even if the supplier considers it acceptable.
Step 3: Verify Testing Dates
Microbial testing results are only valid for a limited time. A CoA with microbial testing performed 18 months ago on an ingredient that has been sitting in a warehouse is not meaningful. Check that the testing date is recent relative to the manufacturing date.
Step 4: Confirm the Testing Lab is Accredited
For high-risk ingredients, verify that the testing was performed by an accredited third-party laboratory (ISO 17025 accredited), not just an in-house lab. Retailer programs like Whole Foods and Costco increasingly require third-party lab verification.
Step 5: Verify Organic Certificate Validity
If you are purchasing certified organic ingredients, the CoA should reference a valid organic certificate. Organic certificates expire annually — confirm the certificate referenced on the CoA has not expired.
CoA Management at Scale
A food brand with 30 ingredients receiving 2 shipments per ingredient per month generates 60 CoAs per month, or 720 per year. Managing these in email folders or a shared drive creates several problems:
- No automated verification against specifications
- No linkage between CoA and the production lots that used the ingredient
- No alert when a CoA is missing for a received lot
- No audit trail for FSMA 204 or organic certification audits
The FSMA 204 traceability rule requires food brands to be able to link a finished product lot back to the specific ingredient lots used in its production, and to produce that traceability record within 24 hours of an FDA request. If your CoAs are not linked to lot numbers and production records, you cannot meet that requirement.
CoA Linkage in Guidance
Guidance links every CoA to the specific ingredient lot it covers, and every ingredient lot to the production batches that consumed it. When you receive an ingredient, the system prompts for the CoA, verifies the values against your specifications, and flags any out-of-spec results before the ingredient is approved for production use.
During an audit, you can pull a complete traceability record — from finished product lot back to every ingredient lot and its associated CoA — in seconds.
Frequently Asked Questions
How long should I keep CoAs on file?
FDA recommends retaining food safety records for at least 2 years. For FSMA 204 traceability records, the requirement is 2 years from the date of the transaction. For organic certification, keep CoAs for at least 5 years to cover potential audit lookback periods.
Can I use a supplier's CoA or do I need to test myself?
For most ingredients, a supplier CoA is sufficient if the supplier is approved and the testing was done by an accredited lab. For high-risk ingredients (allergens, heavy metals in baby food, certain botanicals), consider periodic independent verification testing to confirm supplier CoA accuracy.
What if a CoA value is out of spec?
Place the lot on hold immediately. Do not use it in production until you have resolved the discrepancy with the supplier. Document the non-conformance, your disposition decision (return, rework, or destroy), and the corrective action taken.
Link every CoA to every lot, automatically
Guidance connects CoAs to ingredient lots and production batches, so you always have a complete audit trail — for FDA inspections, retailer audits, and organic certification reviews.
Get Early Access →