Key takeaways

  • A COA is a third-party lab report on a specific batch. The batch number on the COA must match the batch you are buying.
  • Three sections matter: active fraction (label match within 10 percent), heavy metals (USP thresholds), microbial counts.
  • USP heavy-metal thresholds: lead under 5 ppb, cadmium under 5 ppb, mercury under 1 ppb (for elemental and inorganic), arsenic under 10 ppb (inorganic).
  • Three red flags: COA older than 12 months, COA tests a different batch than yours, COA from the manufacturer's internal lab without third-party accreditation.
  • If a brand will not share the COA, that is the answer. Buy from someone who will.
  • Most supplement recalls trace back to either heavy-metal contamination or microbial failure - the same two panels you are reading on the COA.

What a COA actually is

A certificate of analysis is a lab report on a specific batch of a specific product. It states the active fraction, the heavy-metals load, the microbial counts, and (usually) the test methods used. Each batch produced by a manufacturer should have its own COA, with a batch or lot number that matches the bottle you bought. A COA without a batch number, or a COA whose batch number does not match the one printed on your bottle, is not a verification of your product. It is a document about a different bottle. Reputable manufacturers run a COA for every production batch; budget manufacturers might run one COA per quarter and use it to cover whatever ships, which is less useful but is at least transparent.

Three sections to read

First, the active fraction: does it match the label claim within 10 percent? A 500 mg capsule that the COA shows at 482 mg is fine. At 350 mg, you are paying for product that is not in the bottle. Second, heavy metals: are values under USP thresholds (lead under 5 ppb, cadmium under 5 ppb, mercury under 1 ppb for elemental and inorganic forms, arsenic under 10 ppb for inorganic arsenic)? Some products report 'below limit of quantification' which is the cleanest possible result. Third, microbials: total aerobic count under 10,000 CFU/g, no E. coli, no Salmonella, yeast and mold under 1,000 CFU/g. The exact numbers come from USP General Chapter 2023 and similar pharmacopeial standards.

The active fraction in detail

The active fraction line is the most-manipulated part of a COA, so read it carefully. Things to look for. Is the assay specific to the active you care about, or generic? For Lion's Mane, 'beta-glucans 25 percent' (Megazyme assay) is specific; 'polysaccharides 30 percent' is not (it could be mostly grain starch). For Ashwagandha, 'withanolides 5 percent by HPLC' is specific; 'standardized extract' is not. Is the percent of dry weight stated, or 'as-is' (which can be inflated by moisture content)? Is the dose-per-serving derivable from the percent (a 500 mg capsule at 25 percent beta-glucans = 125 mg of active beta-glucans, which is the number that should match a trial dose). If the COA reports the active fraction in vague terms, the brand is leaving room to ship lower-potency batches without lying about the label.

The heavy metals panel in detail

Four metals matter most: lead, cadmium, mercury, arsenic. USP Dietary Supplements thresholds, daily-intake-adjusted, are typically: lead under 5 micrograms/day, cadmium under 5 micrograms/day, mercury under 15 micrograms/day for methylmercury (the most toxic form), arsenic under 15 micrograms/day for inorganic arsenic. Concentration thresholds depend on serving size, but a useful shorthand is parts-per-billion: lead under 5 ppb is a tight target met by clean batches, lead under 10 ppb is acceptable for most botanicals, lead above 20 ppb is a yellow flag. The metals load is product-specific: leafy botanicals (Bacopa, Ashwagandha) accumulate metals more than seed-based supplements (creatine, fish oil from fish far from polluted estuaries), so the same threshold has more headroom in some categories than others.

The microbial panel in detail

Standard panel: Total Aerobic Microbial Count (TAMC), Total Yeast and Mold Count (TYMC), Escherichia coli, Salmonella, sometimes also Staphylococcus aureus and Pseudomonas aeruginosa. USP limits for non-sterile dietary supplements: TAMC under 10^4 CFU/g (10,000), TYMC under 10^3 CFU/g (1,000), absence of E. coli and Salmonella in the test sample (typically 1 to 10 g of product). 'Absence' here means below the detection limit of the assay, not literally zero molecules. A COA showing 'TAMC: 2400 CFU/g, TYMC: 100 CFU/g, E. coli: absent, Salmonella: absent' is comfortably within USP limits. A COA missing one of these lines is incomplete. A COA showing E. coli or Salmonella positive is grounds for an immediate recall, not a 'use with caution'.

The identity / purity test

Often missed by readers but important on botanicals: the identity test confirms that the material is actually what the label says. For Lion's Mane, the identity test confirms the powder is Hericium erinaceus, not a related but cheaper species. Methods include HPTLC (high-performance thin-layer chromatography) fingerprinting, DNA barcoding (the gold standard for species ID), and macroscopic / microscopic inspection by a botanical expert. Identity matters because adulteration is a documented problem in the botanical supplement market. The 2015 New York Attorney General investigation famously found that several major retailers' herbal supplements often did not contain the species on the label. A COA without an identity test is a COA that cannot rule out substitution.

Three red flags

First, the COA is older than 12 months: stale, ask for a current one. Second, the COA tests a different batch than the one you are buying: not actually verifying your product. Third, the COA is from the manufacturer's internal lab, not an accredited third party (Eurofins, Alkemist Labs, NSF, ConsumerLab, ChromaDex, Covance): trust but verify. Manufacturer-internal COAs are not necessarily wrong, but the conflict of interest is structural - the same entity that benefits from the result is producing the result. A fourth red flag worth noting: a COA that lists pass/fail without numbers. 'Heavy metals: pass' is not a useful data point because the threshold for 'pass' is set by the same lab that is reporting the result. Insist on numerical values.

An annotated example

A typical Lion's Mane fruiting-body extract COA will list, in roughly this order: product name and batch number; date of manufacture and date of testing; active fraction (beta-glucans by Megazyme assay, often 25 to 35 percent); other polysaccharide markers; heavy metals (ICP-MS or ICP-OES, four metals at minimum); microbial panel (TAMC, TYMC, E. coli, Salmonella, sometimes S. aureus and P. aeruginosa); identity confirmation (typically HPTLC or DNA barcoding for botanicals); and the laboratory's name, accreditation status (ISO/IEC 17025 is the standard), and analyst signature. If any of these is missing on a COA you are quoting, the document is incomplete relative to industry practice. A clean COA on the bottle you are about to buy might read: 'Batch 24G117, Lion's Mane fruiting body extract, beta-glucans 28.4 percent (Megazyme), Pb 1.2 ppb, Cd 0.8 ppb, Hg 0.3 ppb, As 2.1 ppb, TAMC 850 CFU/g, TYMC 40 CFU/g, E. coli absent, Salmonella absent, identity confirmed by HPTLC. Tested by Eurofins, ISO 17025 accredited.' Every line is a number with a method behind it.

Lab credibility, ranked

Top tier: ISO/IEC 17025-accredited third-party labs that publish their methods (Eurofins, Alkemist Labs, NSF International, USP, ConsumerLab). Solid: smaller third-party contract labs with public ISO accreditation. Acceptable: government or academic labs working under defined protocols. Manufacturer-internal: weighted less, but not dismissed entirely if the lab follows USP methods and the company publishes the test methodology. Anonymous: a COA on plain letterhead with no lab name, no accreditation, and no analyst signature is a marketing document, not a lab document. If you are choosing between two products and one cites ConsumerLab while the other cites 'our quality team', the ConsumerLab product has done structurally more work to earn trust.

Test methods that matter

Active fraction, ranked by reliability: HPLC with reference standards (gold standard for chromatographic separation of specific actives), Megazyme enzymatic assay (specific for beta-glucans, the right call for mushroom products), HPTLC fingerprinting (good for botanical identity, less precise for quantification), UV spectrophotometry (cheap, acceptable for some markers, less specific). Heavy metals: ICP-MS (most sensitive, the right tool for parts-per-billion measurement), ICP-OES (acceptable, less sensitive). Microbial: USP plate-count methods or validated rapid methods (BAX system, etc.). Identity: DNA barcoding (most rigorous), HPTLC fingerprinting (industry standard, less expensive), morphological inspection (lowest tier). When a COA does not cite a test method, downgrade your confidence in the result.

Where COAs are typically published

Best-case: a brand publishes every batch's COA on a public page, indexed by lot number, with a search box or downloadable PDF for each batch. A few brands actually do this (Real Mushrooms, some smaller direct-to-consumer mushroom and adaptogen brands). Common case: COAs available on request via email or contact form, usually delivered within 1 to 5 business days. Worse case: COAs available only to retailers or distributors, not consumers, on the basis that 'we want to protect proprietary methods'. Worst case: no COA disclosure at all, and the customer service script is 'we test internally'. The publishing posture itself is a quality signal: brands with nothing to hide tend to publish.

DIY verification when you can't get a COA

If the brand will not share a COA, you have a few weak-but-non-zero options. ConsumerLab buys products on the open market and tests them; their database covers many supplement categories and is paywalled but trustworthy. LabDoor does similar consumer-facing testing and ranks products publicly. The USP Verified mark on the bottle indicates the product passed an audit covering label accuracy and contaminants (different from third-party lab testing per batch, but a useful baseline). Reddit and supplement-forum communities sometimes pool independent test results, which is anecdotal but occasionally surfaces problems before official channels. None of these are substitutes for a real COA, but they are the next-best thing if the manufacturer is opaque.

A quick checklist

Before you buy, screen the COA against this list. One: batch number on the COA matches the batch on your bottle. Two: COA dated within the last 12 months. Three: third-party accredited lab (ISO/IEC 17025) named on the document. Four: active fraction within 10 percent of label claim. Five: heavy metals all under USP-grade thresholds, with numerical values not just pass/fail. Six: microbial panel passing on TAMC, TYMC, E. coli, Salmonella. Seven: test methods cited (HPLC, Megazyme, ICP-MS). Eight: identity test present for botanicals (HPTLC or DNA barcoding). If any one of those is a no, ask the manufacturer to clarify before you commit. If you get evasion or 'we don't share that for proprietary reasons', the brand has answered your question.

FAQ

What if a brand won't share the COA?

That's a no-buy signal. Reputable brands share COAs on request or post them on their site. Hesitation usually means the test results are not flattering.

Are USP-Verified products worth the premium?

Often yes for high-volume staples like fish oil and creatine where the price premium is small and the verification covers identity, potency, contaminants, and good manufacturing practice. The USP Verified mark is one of the most rigorous third-party programs in the US, and the mark on the bottle is a meaningful signal you can take at face value.

Do I need a COA for every supplement I buy?

No, but the bigger the dose, the longer the duration, and the more specialized the ingredient, the more the COA matters. For a 30-day course of a well-known commodity (vitamin D3, magnesium glycinate from a USP-Verified brand) the COA is reassuring but not essential. For a multi-month course of a specialty ingredient (Lion's Mane, Bacopa, Cordyceps), the COA is the document that separates a product from a label.

How do I read a heavy-metals number that's reported as 'less than X'?

It means the metal was below the limit of quantification of the assay. 'Less than 0.5 ppb' is the cleanest possible result for that metal at that lab's sensitivity. It is functionally equivalent to 'not detected' but stated more precisely. Always better than a numerical value above the detection limit.

What's the difference between USP, NSF, and ConsumerLab certifications?

USP Verified is a per-batch audit covering label accuracy, contaminants, and good manufacturing practice; the bar is high. NSF Certified for Sport is similar but adds a banned-substances screen for athletes. ConsumerLab is independent retail testing - they buy products and report results, no certification mark on the bottle, but their database is searchable. All three are credible. If a product carries any of them, that is a meaningful baseline of quality even before you read the COA.

What is GMP and does it matter?

Good Manufacturing Practice is a baseline regulatory requirement (FDA 21 CFR 111 in the US) for supplement manufacturers. A GMP-compliant facility has documented procedures for sanitation, batch records, ingredient identity testing, and stability testing. GMP compliance is necessary but not sufficient - it sets a floor, not a ceiling. A GMP-compliant facility can still produce a poorly-formulated supplement with weak third-party testing. Look for GMP plus a credible third-party COA, not GMP alone.

Has a supplement I take ever been recalled?

Possible. The FDA maintains a public recall database (fda.gov/safety/recalls-market-withdrawals-safety-alerts) that includes dietary supplement recalls. Most supplement recalls are for either heavy-metal contamination, microbial failure (mostly Salmonella in herbal products), or undisclosed ingredients (a 'natural' product spiked with a pharmaceutical). Searching the brand name in the database is a 30-second sanity check before buying anything new.

Can a COA be faked?

Yes, in theory. The defenses are: (a) prefer COAs that name a third-party lab you can call to verify, (b) check the lab's accreditation status with ISO/IEC 17025 directly if you really care, (c) cross-reference with public test programs (ConsumerLab, USP Verified). Outright fabrication of COAs is rare in the legitimate market because it carries large legal and reputational risk; selective use of cherry-picked old batches is the more common manipulation.

Key sources

Direct citations for the claims above. Click through to the original.