Quality credentials

What a certificate of analysis actually shows

A certificate of analysis is a laboratory report about one specific batch — these tests, by this laboratory, on this lot, on this date, with these numbers. It is not a certification, not an approval, and not a quality award, and almost every mistake people make reading one comes from treating it as though it were. This page takes the document apart field by field: the one line that decides whether it describes your bottle at all, what ISO/IEC 17025 accreditation does and does not establish, what each testing panel covers, the red flags that mark a report as decorative rather than analytical, and the question a COA can never answer no matter how clean it looks.

What is a certificate of analysis?

It is a record of test results for one batch of material, issued by the laboratory that ran the tests. Strip away the letterhead and a COA makes a very narrow factual claim: we received this material, identified as this lot, on this date; we ran these named methods; here are the values we obtained; here are the limits those values were compared with. That is the whole document. Everything genuinely useful about a COA — and every one of its limits — follows from how narrow that claim is.

The narrowness is the point rather than a weakness. A COA is the only common supplement document that reports a measurement of physical material. A manufacturing certification describes a facility's systems. A label describes an intention. A COA describes what came out of an instrument when someone put a sample of a real batch into it. That is a different kind of evidence, and it is worth more precisely because it claims less.

Which sets up the distinction that runs through this whole page, and the reason it is the natural companion to what "GMP certified" means on a supplement label: a GMP audit is about the factory, a COA is about the batch. One tells you the systems were sound when the auditor visited. The other tells you what was found in a specific lot. Neither substitutes for the other, and a company that offers one when you asked about the other has changed the subject.

Which line on a COA matters most?

The lot or batch number, and it is not close. A COA describes one batch, so the lot number is the entire link between the results printed on the page and the material sitting in front of you. Read it before you read a single test result: find the lot code on the bottle, find the lot code on the report, and confirm they are the same. If they differ, nothing else on the document is about your product. It is a genuine report about somebody else's batch.

This one check quietly reorganises how a shopper should read the whole category. A COA posted permanently on a product page, undated and without a lot number, is not fraudulent and is not useless — it demonstrates that testing happens and shows what the company tests for. But it cannot tell you what was in the bottle you own, because no document can do that unless it names your lot. The strongest version of the practice is a company that will produce the report for a lot code on request, which is exactly why lot codes are printed on bottles in the first place.

There is a physical counterpart to this, and it is one of the more reassuring details in the federal rulebook: US supplement manufacturers are required to hold reserve samples of each distributed lot, kept in the same container and closure system the product was sold in. Somewhere in a warehouse there is meant to be a sealed bottle from the same lot as yours. The lot number on your bottle is the index into that system.

What does ISO/IEC 17025 accreditation mean?

It means an independent accrediting body has assessed the laboratory against the international standard for testing competence, for a defined list of methods. ISO/IEC 17025 is the standard covering the general requirements for the competence of testing and calibration laboratories, and it is the single most useful credential on a COA because it is the only one that speaks to whether the numbers can be trusted at all. An accredited laboratory normally prints its accreditation number and the name of the accrediting body directly on each report, which makes the claim checkable rather than decorative.

Two limits belong with that, stated plainly because the credential is often oversold. First, accreditation assesses the laboratory, not the product — a competent laboratory can accurately measure a mediocre batch, and will report exactly that. Second, accreditation is granted for a defined scope of methods, so a laboratory can genuinely hold ISO/IEC 17025 accreditation while the particular test on your report sits outside the accredited scope. Neither of these makes the credential weak. They make it specific, which is what a credential is supposed to be.

It is worth knowing where this standard shows up commercially, because it changes what a COA signals in this category. Amazon requires dietary supplement sellers to submit a certificate of analysis from an ISO/IEC 17025 accredited laboratory to an Amazon-approved testing, inspection and certification verifier — a requirement effective 8 April 2024, with the report required to have been issued within the previous six months. The consequence deserves to be said out loud: on that marketplace, holding a verified COA is closer to an entry requirement than a distinguishing feature. So "we have a COA" is roughly where "GMP compliant" sits — a floor, not a differentiator. The differentiating question is what specification the report was tested against.

What do the testing panels cover?

A finished-product COA for a botanical supplement typically carries four or five distinct panels, and they answer genuinely different questions. Reading them as one undifferentiated block of "test results" is how a partial report passes for a complete one.

The habit worth building is to check which panels are present before reading any individual result. A report that shows only potency is a real report that answers one question, and the fact that a company chose to answer only that question is itself information.

How do you read the results themselves?

Look for three things on every line, together: the method, the specification limit, and the actual result. Those three columns are what make a number interpretable. The method says how it was measured, the limit says what it was compared with, and the result says what was found. Remove any one of the three and the line stops being evidence.

The commonest failure here is a report that prints only "Pass" or "Conforms" where a value should be. Pass against what? A pass is a comparison whose two terms have been deleted, leaving only the verdict. Occasionally that is legitimate — some tests genuinely return a presence-or-absence answer — but a potency assay does not, and a heavy metals panel does not. If a number could exist and does not appear, the report has chosen not to show it.

There is a subtler tell that runs in the opposite direction, and it is the one that separates a careful reader from a trusting one: results that land exactly on the specification, batch after batch, are less credible than results that wobble. Real analytical measurement has natural variation in it. A moisture limit of "maximum 12%" that returns precisely 12.0% on every report is not the sign of a very consistent factory. Genuine data is slightly untidy, and slight untidiness is a mark in a document's favour.

What is the "typical values" red flag?

A COA reporting typical, representative or nominal values is describing a product line rather than measuring your batch. Those figures are what the manufacturer expects a normal batch to produce. They are perfectly legitimate as a product description and they belong on a specification sheet — but they are not test results, and no amount of them can tell you what was in the lot you own.

This is precisely the same distinction the GMP page draws between a facility and a lot, one level further in. A facility certificate says the systems were sound when the auditor visited. A typical-values sheet says what a batch usually contains. Only a lot-specific report with a matching batch number says what this batch contained. Each answers a real question; the error is letting a document answer a question it was never asked.

The related flags cluster around the same theme — a document that resembles a report without functioning as one. No issuing laboratory named. No lot number. No accreditation details. No method column. No specification limits alongside the results. No date of analysis. Any one of these on its own may have a mundane explanation. Several together describe a template rather than a measurement.

Why can't a manufacturer just rely on the supplier's COA?

Because federal law does not let it, and the detail is more interesting than the rule. Under 21 CFR 111.75(a)(1), a US supplement manufacturer must conduct identity testing on every incoming dietary ingredient — not a sample of shipments, not trusted suppliers exempted, every one. The only escape is a petition to FDA under 21 CFR 10.30 with a scientific rationale and supporting data showing no material diminution of assurance compared with 100% identity testing, and it must be granted before it applies. A supplier's certificate, by itself, does not discharge that obligation.

For the other specifications — purity, strength, composition, contaminant limits — a manufacturer may rely on a supplier COA, but only under conditions that are worth reading closely, because they amount to a checklist a shopper can borrow. The manufacturer must first qualify the supplier by confirming the supplier's test results with its own; the certificate must include a description of the test methods, the limits and the actual results; the qualification must be documented; it must be periodically re-confirmed; and quality control personnel must review and approve the documentation.

Notice what the middle condition says. The regulation's own standard for a usable certificate is methods, limits and actual results — the same three columns above. A COA that omits them does not meet the bar a manufacturer would need to lean on it internally, which is a useful way to calibrate how much weight to put on one as a shopper. And notice the structural point the whole regulation makes: a COA is an input to a quality system, not a replacement for one. Its value depends on the system it feeds into.

What can a COA never tell you?

Whether the specification it tested against was a good one. This is the honest ceiling on the document, and it mirrors the ceiling on a GMP certificate exactly. A COA reports whether a batch met the limits someone chose in advance. It has no opinion on whether those limits were demanding or generous, whether the compound tested was the one that matters, or whether the number on the label was worth hitting. A perfectly clean COA against an undemanding specification is a real pass, and it is a pass at a low bar.

Two smaller silences follow from the same root. A COA reports only the tests that were run, so a panel without heavy metals is silent on heavy metals rather than reassuring about them. And a COA describes the batch on the date of analysis, not the bottle after a year in a warm cupboard — which is why storage and shelf life are separate questions, covered on how to store oregano oil.

All of which converges on one shopper-facing consequence, and it is the reason this page exists. A test needs a target. A laboratory cannot assay a product against an adjective — there is no method for "premium", "potent" or "high strength". Every testable specification is a number attached to a named compound. So the first thing to check is not whether a COA exists, but whether the label states something a COA could verify.

What does this mean for a bottle of WaveDrops?

It means the specification is published in the unit a laboratory can actually test. Every 2-drop serving is stated at about 18 mg of carvacrol and roughly 0.9 mg of thymoquinone — a named compound and a mass, which is the form an assay result takes. A percentage alone cannot play that role: 80% carvacrol is a ratio inside the oil and says nothing about how much oil a serving contains, so two products quoting the same percentage can deliver quite different amounts. A milligram figure closes that gap, and it also makes the claim falsifiable, which is the point.

The second half is what is not in the bottle. There is no filler carrier oil — no olive oil, sunflower oil or added blend to make the volume up. The wild-harvested Greek Origanum vulgare oil and the cold-pressed Nigella sativa oil are both declared actives, so every millilitre is the two oils themselves rather than a small amount of active suspended in something cheaper. The 0.34 fl oz (10 mL) amber glass dropper gives about 200 two-drop servings, and the product is made in a GMP-certified facility — the floor, stated as a floor.

For the label-reading side of the same question, see how to read a Supplement Facts panel, and for the full buying checklist, the quality oregano oil checklist.

Three claims about COAs this page refuses

Stating what is not true is part of stating what is.

"A COA proves the product is pure and safe." It reports results for the tests that were run, judged against limits that were chosen. Both of those were decisions, and a document cannot vouch for the decisions behind it. A COA is strong evidence about a defined set of questions and completely silent outside it.

"An ISO/IEC 17025 lab means the result is government-certified." No agency certifies a supplement result. ISO/IEC 17025 accreditation is granted by an independent accrediting body and assesses the laboratory's competence for a defined scope of methods. It is a strong credential about who did the measuring, and it is not an endorsement of what was measured.

"The COA on the website is about the bottle I bought." Only if the lot numbers match. Without a batch number, or with a different one, the report is a true document about material you do not own. Check that line first, every time.

Refusing these three is not an argument that certificates of analysis are worthless — quite the reverse. A COA is the closest thing this category has to a measurement, and it deserves to be read as one rather than displayed as a badge.

Related reading: what "GMP certified" means on a supplement label, carvacrol percentage: what to look for, and the oregano oil and black seed oil buyer's guide. Or return to the WaveDrops homepage.

Get WaveDrops on Amazon

These statements have not been evaluated by the FDA. This product is not intended to diagnose, treat, cure, or prevent any disease.