What is a certificate of analysis, and how do you read one?

August 23, 2026

A certificate of analysis, or COA, is a lab report for one specific production batch. It states what was tested, usually identity, potency, and heavy metals, the limit for each, and the actual result. No law requires a supplement brand to show you one. Whether you get to see it comes down to whether the brand offers it.

Supplements don't go through the FDA before they reach a shelf. No government agency checks that the label matches the tub before you buy it [4]. A COA is the document that would tell you, if you can get someone to hand it over. Most people have never seen one, because most brands never show one.

What's actually in a certificate of analysis?

Image placeholder: a certificate of analysis for one supplement batch, showing identity, potency, and heavy metals test rows.

A real COA is built around four questions, and a good one answers each with a number, not a checkbox [5]:

Identity. Is this actually creatine monohydrate, or something else that got labeled creatine? Confirmed by chemical fingerprinting of the sample itself, not by trusting the label on the drum it arrived in.
Potency, or assay. How much of the labeled ingredient is present, given as a percentage of what the label claims.
Heavy metals. Metals like lead and arsenic, each checked against a stated limit and reported in a defined unit, such as parts per million. A result with no unit, or no limit beside it, tells you nothing [7].
Microbial and other contaminants. Yeast, mold, and bacteria counts, and sometimes pesticide or solvent residue, depending on the ingredient.

Every row should carry the measured number next to the limit it's checked against. A row that just says "pass" is telling you the brand's opinion of its own result, not the result [7].

That limit needs a source too. Sometimes the method and its limit trace to a recognized compendial standard, published by a body like USP, EP, AOAC, or ASTM [6]. Just as often it isn't: federal manufacturing rules require a supplement maker to set its own specifications for identity, purity, strength, and composition, rather than follow one number handed down for every product [2][6]. Both are legitimate. A limit the manufacturer wrote for itself just isn't the same kind of check as a limit it had to meet, and a COA rarely tells you which one you're looking at.

Does a brand have to give you one?

No. Federal rules for supplement manufacturing do involve certificates of analysis, but not in the direction most people assume. Before a dietary ingredient goes into a batch, the manufacturer has to run at least one test of its own to verify that ingredient's identity — a supplier's certificate of analysis cannot substitute for that test, unless the FDA has granted a specific exemption [1]. A supplier's COA can substitute for the other components in a formula and their other specifications, but only after the manufacturer has qualified that supplier by confirming the supplier's own results directly, and a COA relied on that way still has to state its method, its limits, and its results [1]. Every one of those duties runs between businesses, supplier to manufacturer, and none of them reaches the shopper. That rule creates no consumer-facing disclosure duty, and nothing in the federal supplement manufacturing rules requires the finished-batch COA to reach the person who buys the tub [1][4].

So getting one is a matter of what a brand chooses to offer, not something you can demand as a right. Some brands offer it freely. Some will send it if you ask. And some don't have one to send.

Is a COA the same as a certification like USP Verified?

No, and the difference matters. A COA is one batch, tested once, usually by a lab the brand itself chose and paid for. A mark like USP Verified means an independent body tests the finished product on an ongoing basis and audits the facility that makes it. It confirms the product contains what the label says, at the stated potency, without harmful contaminant levels [3]. A COA is closer to a receipt for one transaction. A certification is closer to a standing inspection.

Neither one is fake. They're just answering different-sized questions, and a brand that only has one shouldn't be describing it as the other.

What does the lot number on a COA tell you?

Every COA should carry a lot or batch number, and that number is the whole point [5][7]. It's what ties the sheet of results to the actual tub in your kitchen, not to an earlier batch, and not to the raw powder that went into it.

That last distinction matters more than it sounds. A COA for the ingredient's raw lot tells you the creatine (or whey, or whatever it is) was clean before production started. It says nothing about what happened during blending, dosing, and packaging, which is why the federal rules make the finished batch its own test point against its own specifications [1], and why a COA footnoted "verified via raw material" means no finished-product test was run at all [7]. If a brand hands you a COA, ask plainly whether it covers the finished batch or just the raw ingredient that went into it.

What are the red flags on a COA?

A few things to check on any COA you're handed [7]:

No lab name, or a lab you can't find any independent trace of. A COA is only as credible as the lab that signed it.
No date, or a COA that predates the batch currently on the shelf. Amazon requires supplement sellers to submit a new certificate of analysis every 12 months [8], which is the closest thing to a shelf life that anyone actually enforces.
Potency shown as a checkbox, "complies" or "pass", with no percentage next to it.
A lot number that matches the raw ingredient, not the finished, packaged batch.
No lab accreditation listed. To sell a supplement on Amazon, the certificate has to come from an ISO/IEC 17025 accredited lab, or the product has to be enrolled in a third-party quality assurance program [8]. With neither, nothing outside the lab vouches for what its result means.

None of these alone proves a document is fake. Together, they're the difference between a document you can actually check and one you're just supposed to trust.

Does any of this actually matter?

Heavy metals are where the gap between a label and a tub shows up most starkly. The Clean Label Project, an organization that also sells its own certification program, reported in January 2025 that it had tested 160 top-selling US protein powders across 70 brands and found 47% exceeded at least one federal or state safety limit for toxic metals, with 21% of samples over twice California's Prop 65 level for lead [9]. It isn't peer-reviewed, and that 47% blends federal and California thresholds rather than measuring against a single standard. Consumer Reports ran its own, separately sourced test of 23 protein powders and shakes the same year and found lead above its safety threshold in a single serving of more than two-thirds of the products it checked [10]. Two organizations, two different samples, pointing at the same category-wide pattern.

That data doesn't name a specific product. It's the reason to ask a brand for its COA rather than assume one exists.

How AUROM handles this

AUROM's creatine is single-ingredient micronized creatine monohydrate, 5 g per scoop, made in a cGMP-compliant facility in the US. Nothing else is in the tub to hide a problem behind. A Certificate of Analysis is available per batch for the creatine, on request. It isn't a certification and we don't call it one. It's the lab sheet for the batch you'd be buying. You can see what's in the tub on the creatine monohydrate page.

Asking any brand for its COA should get you the same thing, from any brand that has one worth showing.

Questions, answered

Is a COA the same thing as third-party testing? Not necessarily. A COA can come from a brand's in-house lab or a lab it hired directly. Third-party testing usually means a lab with no financial relationship to the brand ran the test. A COA worth trusting states plainly which situation you're looking at.

Does a COA prove a product works? No. A COA confirms what's in the tub: identity, potency, contamination limits. It says nothing about whether the dose is large enough to do anything, or whether the ingredient itself is effective. That's a separate question, answered by research on the ingredient, not by a lab sheet.

What if a brand won't share a COA? That's information too. The federal supplement rules require a manufacturer to test its finished batches and keep the records, but nothing in them requires a brand to issue a certificate of analysis to a shopper, or to share one on request [1]. A brand's answer, or its silence, tells you how it treats the question.

Is it normal for a COA to test the raw ingredient instead of the finished product? It happens, and it's worth asking about directly. An ingredient-lot COA and a finished-batch COA answer different questions, and only the finished-batch version covers what happened during actual manufacturing [1][7].

How old is too old for a COA? There's no legal limit for what a brand shows a shopper. The closest real-world benchmark is Amazon's supplement-testing policy, which requires sellers to submit a new certificate of analysis every 12 months [8]. A COA past that mark, or one that predates the batch currently on shelves, is a document about an earlier batch, not the one in front of you.

A certificate of analysis won't make a bad product good, or a good product better. What it does is turn a label claim into a number you can check, one batch at a time. Ask for one. What you get back, or don't, tells you plenty.

These statements have not been evaluated by the Food and Drug Administration. This product is not intended to diagnose, treat, cure, or prevent any disease.