How to Read a Certificate of Analysis
A consumer's visual guide to understanding supplement test reports.
8 min read - Last updated April 2026
Key Takeaways
- A COA (Certificate of Analysis) is a lab report showing what's actually in your supplement - and what shouldn't be
- Every COA should include a lab name, test date, lot number, testing method, results, and pass/fail status
- "ND" (Not Detected) doesn't mean zero - it means the amount is below what the lab's equipment can measure
- A COA from the brand itself is not the same as one from an independent lab - look for ISO 17025 accreditation
- If a brand can't produce a COA for the specific lot number on your bottle, that's a red flag
You just bought a supplement. Is it safe?
You've probably seen brands throw around phrases like "third-party tested" or "lab verified." Some even link to a document covered in numbers, chemical symbols, and abbreviations. That document is a Certificate of Analysis, or COA.
The problem? Most COA guides are written for lab scientists or procurement teams. Not for you - the person holding a bottle and wondering if what's inside matches what's on the label.
This matters more now than ever. In October 2025, Consumer Reports tested 23 protein powders and found that more than two-thirds exceeded their safe daily limit for lead. One product contained over 15x the safe level per serving. Knowing how to read a COA is the difference between trusting a label and trusting actual data.
This guide walks you through a real COA, section by section, in plain English. By the end, you'll know exactly what to look for, what the numbers mean, and which red flags should make you ask questions.
What is a COA?
A Certificate of Analysis is a document from a laboratory that reports the results of testing a specific product batch. Think of it like a car's MOT certificate - it tells you what was inspected, what passed, and what didn't.
Every COA answers three questions:
- What's in this product? (active ingredients, potency)
- What shouldn't be in this product? (heavy metals, bacteria, contaminants)
- Did it pass? (results compared against safety limits)
A good COA is specific to one batch (identified by a lot number), tested by one lab, on one date. It's a snapshot of that exact production run.
What are the sections of a COA?
Here's what you'll find on a properly done COA, and what each section tells you. Below is a real batch quality report from transparency.ketosource.co showing all five sections:
A real batch quality report from transparency.ketosource.co. Each section is explained below.
1. Lab information
This section identifies who did the testing. You're looking for:
- Lab name and address - a real, verifiable laboratory
- Lab accreditation - the gold standard is ISO/IEC 17025. This means an independent body has audited the lab's methods, equipment, and staff. You can verify accreditation through registries like ANAB or A2LA
- Report number - a unique ID for this specific test report
Why it matters: A COA without a named lab is like a health inspection report with no inspector. It could say anything.
2. Sample identification
This section tells you exactly what was tested:
- Product name - should match what's on your label
- Lot/batch number - this is the key. It should match the number printed on your bottle or packaging. If the lot number on your bottle doesn't match the COA, that report doesn't apply to your product
- Date received and date tested - tells you when the lab actually ran the analysis
Why it matters: Some brands publish one "representative" COA for all batches. That's better than nothing, but it doesn't tell you about the specific batch you're holding.
3. Test results
This is the core of the COA. You'll typically see a table like this:
| Analyte | Method | Result | Specification | Status |
|---|---|---|---|---|
| Lead (Pb) | ICP-MS | ND (<0.01 ppm) | <0.5 ppm | Pass |
| Cadmium (Cd) | ICP-MS | 0.003 ppm | <0.5 ppm | Pass |
| Total aerobic count | USP 2021 | <10 CFU/g | <1,000 CFU/g | Pass |
| C8 (caprylic acid) | GC-FID | 98.2% | >95% | Pass |
Lead (Pb)
Pass- Method
- ICP-MS
- Result
- ND (<0.01 ppm)
- Spec
- <0.5 ppm
Cadmium (Cd)
Pass- Method
- ICP-MS
- Result
- 0.003 ppm
- Spec
- <0.5 ppm
Total aerobic count
Pass- Method
- USP 2021
- Result
- <10 CFU/g
- Spec
- <1,000 CFU/g
C8 (caprylic acid)
Pass- Method
- GC-FID
- Result
- 98.2%
- Spec
- >95%
Analyte - what's being tested. This could be a contaminant (lead, arsenic, bacteria) or an active ingredient (the thing you're paying for).
Method - how the lab tested it. Common methods include:
- ICP-MS (Inductively Coupled Plasma Mass Spectrometry) - the most sensitive method for detecting metals. It can find metals at parts-per-billion levels. Think of it as a metal detector that works at the molecular level.
- GC-FID (Gas Chromatography with Flame Ionization Detection) - used for measuring fatty acid content in oils
- USP methods - standardized procedures from the United States Pharmacopeia
Result - what the lab found. This is where you'll see numbers like "0.003 ppm" or abbreviations like "ND."
Specification - the limit. If the result is below this number, the product passes. Specifications come from regulatory standards like California Prop 65, EU EFSA limits, or USP guidelines.
Real heavy metal results from a batch report. Each metal tested against three different safety standards.
One thing to know: different standards set very different limits. For lead, California Prop 65 allows 0.5 mcg per day. USP allows 5 mcg per day - ten times higher. A product can "pass" under USP and still exceed Prop 65. When you see "Pass" on a COA, check which standard the specification is based on.
Status - Pass or Fail. That said, "Pass" only tells you the result was below the specification. It doesn't tell you how far below. A product at 4.9 mcg of lead that "passes" at a 5 mcg limit is very different from one at 0.1 mcg. The actual number matters more than the word "Pass."
4. What "ND" and "less than" actually mean
You'll see these abbreviations a lot, and they trip people up:
ND (Not Detected) doesn't mean "zero." It means the amount is below the lab's detection limit - the smallest quantity their equipment can reliably measure. A result of "ND (<0.01 ppm)" means the lab's equipment can detect down to 0.01 parts per million, and it found nothing at or above that level.
LOD (Limit of Detection) is the smallest amount the method can find. Think of it like this: if you're trying to find a needle in a haystack, the LOD is the smallest needle your magnet can pick up. Anything smaller slips through.
LOQ (Limit of Quantification) is the smallest amount the lab can measure precisely. The LOD might detect something is there, but the LOQ is where the lab can say "it's exactly this much."
Parts per million (ppm) and parts per billion (ppb) - these are concentration units. One part per million is like one drop of ink in a 10-gallon fish tank. One part per billion is one drop in a backyard swimming pool (about 10,000 gallons). Another way to think about it: 1 ppb is one second in 32 years. When a COA says "0.003 ppm of lead," that's 3 parts per billion. Modern ICP-MS equipment can detect metals at these levels - that's how sensitive the testing is.
5. Signatures and dates
A credible COA includes:
- Date of analysis - when the tests were actually run
- Authorized signature - from the lab director or authorized signatory
- Lab seal or stamp - many accredited labs include their accreditation mark
What does a bad COA look like?
Not all COAs are equal. Some are marketing documents dressed up to look like lab reports. Here's what to watch for:
Red flags
Who actually did the testing?
Can't match to your specific product
Could be years old
"Tested for heavy metals" is meaningless without the method
That's like grading your own exam
Tests purity but skips heavy metals and microbial
Real results look like "98.2%," not "100%"
Results without specs are just numbers
What a credible COA includes
- Named, accredited (ISO 17025) independent lab
- Lot-specific testing (matched to your bottle)
- Full panel: active ingredients, heavy metals, microbial
- Testing methods identified for each analyte
- Clear specifications with pass/fail for each test
- Dated, signed, and numbered
Get the Supplement Safety Checklist
A printable 1-page checklist covering COA red flags, lab verification steps, and the questions to ask any brand. Take it to the store.
How to verify the lab is real
You don't have to take anyone's word for it. Here's how to check:
- Find the lab name on the COA
- Search the ANAB directory or A2LA directory for the lab's accreditation status
- Check the scope - a lab can be ISO 17025 accredited for some tests but not others. Make sure their accreditation covers the tests on your COA
- Verify the lab exists - search the lab name and address. A real lab has a website, a physical location, and typically lists their accreditations prominently
What this looks like in practice
On transparency.ketosource.co, every product has batch-specific test results from Eurofins (an ISO 17025 accredited lab). You can enter the lot number from your bottle and see the actual results for that production run - heavy metals benchmarked against Prop 65 and EU EFSA limits, active ingredient purity, and microbial safety.
Here's what that looks like for a real batch:
Lab
Eurofins Food Testing UK Limited
ISO 17025 accredited
Product
C8 MCT Oil
Heavy metals
All 4 tested (Pb, Cd, As, Hg)
All below Prop 65 limits
Active ingredient
98.4% C8 caprylic acid
Label claims >95%
Microbial
All counts below limits
No pathogens detected
Quality Score
98.4 / 100
That's what transparent testing looks like. No login required, no request forms, no "contact us for a copy." Just the data, matched to your bottle.
What You Can Do
- 1 Find your lot number - it's printed on your supplement bottle or packaging. Usually on the bottom or side label
- 2 Ask the brand for a COA - specifically for your lot number. If they can't provide one, that tells you something
- 3 Check the COA against this guide - does it have a named lab, test date, lot number, methods, specs, and pass/fail?
- 4
- 5 Compare results to limits - are the results below the specifications? Do the specifications reference recognized standards (Prop 65, EU EFSA, USP)?
- 6 Look up your product on transparency.ketosource.co if you're a Ketosource customer - your batch results are already published
Related Guides
How to Verify Your Supplement's Test Results
The next step after reading a COA - a 5-step protocol using free public databases
The Supplement Safety Crisis - What the 2025 Data Shows
Coming soonWhy COAs matter more than ever
Certifications Explained - NSF, USP, Informed Sport & More
Coming soonWhat certifications do (and don't do) vs. actual COA testing
Look up your product's test results
transparency.ketosource.co batch lookup
Sources
- ISO/IEC 17025:2017 - General requirements for the competence of testing and calibration laboratories.
- Consumer Reports (2025, October) - "Protein Powders and Shakes Contain High Levels of Lead." Testing of 23 products.
- California Proposition 65 Safe Harbor Levels - Lead 0.5 mcg/day, Cadmium 4.1 mcg/day, Mercury 0.3 mcg/day, Arsenic 10 mcg/day.
- USP General Chapter 232 - Elemental Impurities Limits. Lead 5 mcg/day, Cadmium 5 mcg/day.
- ANAB Laboratory Accreditation Directory - ANSI National Accreditation Board.
- A2LA Accredited Laboratory Directory - American Association for Laboratory Accreditation.
- European Food Safety Authority (EFSA) - Contaminant limits in food supplements.
- ConsumerLab.com - "Can I Trust Supplement COAs?" (paywalled)