Whose test is on the certificate? What a supplier’s COA covers — and what it does not

Reference page · published 2026-09-08

A certificate of analysis is a test report about a sample. Someone drew that sample, at their own site, at some point before the material was packed and shipped. The certificate describes what they found in it. It does not describe the container that arrived at your bench, and it was never designed to.

That gap is not an opinion. It is written into the federal rule that governs drug manufacturers in the United States, and the rule is unusually blunt about it: you may use a supplier’s numbers instead of running the tests yourself, but only on two conditions. You still run your own identity test on what arrived. And you have separately checked, on some schedule, that this supplier’s numbers hold up. Both conditions, every time.

Vendor checklists in this category ask whether a certificate exists. This page is about the question underneath that one: whose test is on it, on which container, and taken when. The sources are the regulation, FDA’s own published explanation of why the regulation reads that way, four warning letters where firms did not meet it, and one peer-reviewed study of how supplier paperwork works in practice. Nothing here is an accusation against any seller, and nothing here is a claim about Artemis Labs.

The rule itself, in its own words

The relevant text is 21 CFR 211.84, part of the current good manufacturing practice rules for finished pharmaceuticals. It has been on the books since 1978 and was last amended in 2008. Three pieces of it carry the whole idea.

First, the default is that incoming material does not get used until somebody has looked at it:

“Each lot of components, drug product containers, and closures shall be withheld from use until the lot has been sampled, tested, or examined, as appropriate, and released for use by the quality control unit.” — 21 CFR 211.84(a)

Second — and this is the word that does the work — sampling is per shipment, not per lot:

“Representative samples of each shipment of each lot shall be collected for testing or examination.” — 21 CFR 211.84(b)

A certificate covers a lot. The rule covers each shipment of that lot. One lot can travel as many shipments, on different days, in different conditions, to different places. The regulation counts each arrival as its own event.

Third, the two conditions:

“At least one test shall be conducted to verify the identity of each component of a drug product. Specific identity tests, if they exist, shall be used.” — 21 CFR 211.84(d)(1)

“Each component shall be tested for conformity with all appropriate written specifications for purity, strength, and quality. In lieu of such testing by the manufacturer, a report of analysis may be accepted from the supplier of a component, provided that at least one specific identity test is conducted on such component by the manufacturer, and provided that the manufacturer establishes the reliability of the supplier’s analyses through appropriate validation of the supplier’s test results at appropriate intervals.” — 21 CFR 211.84(d)(2)

Read (d)(2) slowly. It does not say a supplier’s certificate is worthless. It says the opposite: a supplier’s report of analysis is a legitimate substitute for most of your own testing. But identity is carved out and never delegated, and the supplier’s reliability is something you are expected to have established yourself, not assumed.

Why the rule is built that way — FDA’s own explanation

FDA publishes a questions-and-answers document on exactly this part of the regulations, Questions and Answers on Current Good Manufacturing Practice Requirements | Control of Components and Drug Product Containers and Closures. It is marked “Contains Nonbinding Recommendations,” so it is the agency’s stated thinking and not law. As an explanation of the reasoning, it is the clearest thing published on the subject.

It starts by pointing out that identity is a different kind of measurement from everything else on a certificate:

“Unlike most component attributes, a component’s identity is generally a discrete variable, i.e., the material in the container either is or is not what the label purports it to be.”

Purity is a number with a margin. Identity is a yes or a no. Then it names the two ways the answer can come out “no” even when the supplier did everything right:

“The component container’s content might differ from what the container label states due to mistakes in filling and labeling by the supplier or repacker, or as a result of the substitution of a container’s contents during distribution and warehousing before receipt by the drug product manufacturer.”

And then the sentence that is really the whole page:

“The past quality history of a supplier and the scope of their operations is relevant to the chance for mistakes to occur under a supplier’s control, but does not necessarily bear on what happens to a drug once it is outside the supplier’s control.”

A certificate is evidence about a period of custody that ended before the box was sealed. The document is honest about its own scope. It is readers who extend it past the loading dock.

The same guidance adds one detail worth keeping if you buy from a middleman instead of the maker: Testing samples from every container to determine identity may be valuable particularly for components purchased from distributors.

What a certificate is supposed to contain

The guidance also states, quoting section 11.4 of the international API manufacturing standard ICH Q7, what the maker’s certificate should carry. We have not read Q7 itself; this is FDA’s quotation of it, and it is cited that way here:

“Section 11.4 of ICH Q7 recommends that the API manufacturer’s COA should include, as applicable, the API’s name, grade, batch/lot number, date of release, and a list of ‘each test performed in accordance with compendial or customer requirements, including the acceptance limits, and the numerical results obtained . . . .’”

Name, grade, batch number, release date, tests, limits, results. A certificate missing the acceptance limits, or giving a verdict without the numbers behind it, is missing something the standard says should be there. That is a check any reader can run in ten seconds, and it needs no laboratory.

Four firms, four positions in the chain, one finding

The rule is not theoretical. FDA has cited it against firms at four different points in the supply chain, in letters spanning six years. What follows is only what each letter says.

A compounding pharmacy (2020)

FDA inspected Tailor Made Compounding LLC of Nicholasville, Kentucky, from August 20 to October 24, 2018, and issued warning letter 594743 on April 1, 2020. The letter charges both halves of the rule, in order:

“Your firm failed to conduct at least one test to verify the identity of each component of a drug product.”

“Your firm also failed to validate and establish the reliability of your component supplier’s test analyses at appropriate intervals (21 CFR 211.84(d)(1) and (2)).”

This is the earliest of the four and the closest to home: a US pharmacy, in the peptide compounding business, cited under the exact subsections quoted above. We have a separate record of this letter and the criminal case that followed it.

An ingredient manufacturer (2025)

Chengdu Brilliant Biopharmaceutical Co., Ltd., a facility in Sichuan registered with FDA as a manufacturer of active pharmaceutical ingredients, received warning letter 711330 on September 11, 2025. Two things about it are unusual.

The first is how it was produced. There was no inspection. FDA sent a records request under section 704(a)(4) of the Federal Food, Drug, and Cosmetic Act on March 12, 2025, read what came back, and wrote the letter from that alone:

“Because your methods, facilities, or controls for manufacturing, processing, packing, or holding of drugs as described in your response to our 704(a)(4) request do not conform to CGMP, your APIs are adulterated within the meaning of section 501(a)(2)(B) of the Federal Food, Drug, and Cosmetic Act.”

The second is the finding, headed Failure to test the identity of each batch of incoming production material, and FDA’s reason for it:

“Without adequate testing, there is no scientific evidence to assure that your raw materials conform to appropriate specifications before release.”

What FDA then asks the firm to commit to is the most direct statement of the two conditions anywhere in these documents:

“If you intend to accept any results from your supplier’s Certificates of Analysis (COA) instead of testing each component lot for strength, quality, and purity, specify how you will robustly establish the reliability of your supplier’s results through initial validation as well as periodic re-validation. In addition, include a commitment to always conduct at least one specific identity test for each incoming component lot.”

And the follow-up asks for the evidence, not the intention:

“A summary of results obtained from testing all components to evaluate the reliability of the COA from each component manufacturer. Include your SOP that describes this COA validation program.”

Checking a supplier’s certificates is, in FDA’s framing, a program with a written procedure and a file of results — not a judgment about whether the supplier seems serious.

An importer and distributor (2025)

FDA inspected Darmerica, LLC of Davie, Florida from March 3 to 19, 2025 and issued warning letter 716152 on December 8, 2025. Darmerica buys ingredient material and resells it. Three findings in that letter are about the physical journey of the sample, and they are the clearest illustration of the point this page is making.

The first is about where a sample is drawn. Under the heading “Use of Pre-shipment Samples”:

“During our inspection, it was observed that your firm was inappropriately relying on results of quality testing of pre-shipment samples that were shipped directly from the API manufacturer to your third-party laboratory for analysis.”

A sample sent ahead, straight from the maker to the lab, produces real numbers from a real laboratory. FDA’s objection is that those numbers are about the wrong material:

“Samples used for the sake of identity testing and evaluation of other quality attributes are to be taken at your facility from containers after receipt from the API manufacturer to ensure they are representative of the API in question and account for the conditions of transport to your facility.”

“Account for the conditions of transport” is the sentence. The journey is part of what the test is supposed to cover.

The second finding is about sequence. FDA describes material going out the door before its own certificate existed:

“Though a sample was sent to your third-party testing laboratory for analysis, the (b)(4) distribution of the (b)(4) API occurred prior to your firm’s own QU release of the (b)(4) API on (b)(4) and before the certificate of analysis (COA) was reviewed and authorized by your third-party lab on (b)(4) .”

The bracketed redactions are FDA’s, covering dates and quantities the agency withholds from published letters. What survives redaction is the order of events: shipped first, certified after.

The third is about the paperwork that arrived with the material:

“Our investigators observed your firm destroying original labels during API receipt. FDA is concerned that this practice may obscure supply chain information that may be necessary during CGMP investigations, complaints, or other matters.”

And FDA’s summary of whose job this is: As a manufacturer, you have a responsibility to sample, test, and examine incoming materials before release for use in production to assure adequate quality.

A repackager (2026)

Harbin Jixianglong Biotech Co., Ltd. of Heilongjiang received warning letter 723330 on May 1, 2026, after an inspection from November 3 to 7, 2025. The finding that matters here is about relabeling, and it is worth reading beside the ICH Q7 list of what a certificate should carry.

“Specifically, there is no quality unit approved procedure governing the repackaging and relabeling operations for APIs sourced from external manufacturers prior to distribution to the U.S. market.”

“You repackaged and relabeled this batch without documentation and created a new labeled batch number, CP-030-20250711.”

“You also changed the manufacturing date of the API from (b)(4) to July 25, 2025, and the retest date from to (b)(4) to July 24, 2027, without appropriate supporting data.”

The quotation above reproduces a duplicated word (“from to”) that appears in FDA’s published text. It is quoted as published.

Now compare that with the ICH Q7 list: name, grade, batch/lot number, date of release, tests, limits, results. A new batch number, a new manufacturing date and a new retest date are three of the identifying fields a certificate carries. FDA describes a second batch the same way, with the number CP-030-20250911 and dates moved to September 25, 2025 and September 24, 2027. A certificate can be complete, well formatted and internally consistent while the numbers identifying the batch were assigned by whoever relabeled it.

One smaller detail from the same letter is worth recording because it touches a phrase this category uses constantly. Among the corrective actions the firm proposed was putting a research-use statement on its certificates:

“Although you intend to implement a new procedure requiring your certificates of analysis to contain a statement of ‘Only for R&D use purpose’ for ‘developmental drug products,’ you did not mention any stipulations on the acceptable quantity to be released for R&D use.”

FDA’s reply is not that the statement resolves anything. It is a question about how much material would move under it. That is a different setting from the seller disclaimers collected on our record of research-use disclaimers in warning letters — this one is a proposed line on a quality document, not a website footer — but the agency’s posture toward the words is recognizably the same.

What the research literature adds

One peer-reviewed study speaks directly to whether supplier documentation is good evidence of what it documents. Hamill, Hampshire, Vinaya and Mamidi interviewed manufacturers and regulators in India about how active ingredient production and procurement actually work, and published the findings in BMJ Global Health in 2023 (PMID 37197796). The work was funded by the Wellcome Trust; the authors declare no competing interests.

Their central argument is structural, not accusatory:

“In this paper, we suggest that the complexity and opacity of transnational pharmaceutical supply chains may lead to the quality of the final product being compromised, despite regulatory compliance being achieved at each stage.”

And, on documentation specifically:

“Extensive regulatory guidelines have established processes and procedures for compliance that are evidenced through documentation. However, we question the assumption that this documentation always provides good evidence of compliance.”

The same paper is the strongest available argument for the other side, which is why it is worth reading past its headline. One quality manager the authors interviewed audits more than 600 suppliers with a team of thirteen field auditors, running vendor qualification documents, three-yearly batch testing, document review, performance testing and packaging and labelling checks — and, on site, checking “every activity, every system, every person.” The paper is not describing an industry where paperwork is decoration. It is describing one where serious documentation and a compromised end product can coexist, which is a narrower and more uncomfortable claim.

What does the evidence not show?

Six limits, and each of them matters.

These rules do not govern research supply. 21 CFR Part 211 applies to finished pharmaceuticals, and ICH Q7 to active ingredient manufacturing for drug products. Every firm named above is a registered drug establishment or a licensed pharmacy. None of these letters says that a research-reagent seller is one, and this page does not either. The rules are quoted here because they are the only written, public, federal statement of what a supplier certificate is good for — not because this category is measured against them.
No finding here says any certificate was wrong. FDA cites failures of process: identity not tested, supplier reliability not validated, samples drawn in the wrong place, batches relabeled without documentation. In none of the four letters does the agency find that a certificate’s numbers were inaccurate. Those are different claims and only the first one is supported.
Four letters are not a rate. FDA letters are not a random sample of anything. They record where the agency looked and what it found there. They cannot tell you how common any of this is, and nothing on this page should be read as saying they can.
FDA’s explanatory guidance is expressly nonbinding. The questions and answers document carries the words “Contains Nonbinding Recommendations” on its face. The regulation binds; the explanation of it does not.
The academic study is about a different market. Hamill and colleagues studied generic medicine and ingredient supply chains serving low-income and middle-income countries. It is not a study of peptides sold for laboratory research, and their conclusions are about system structure, not about any product a reader of this page might hold.
Nothing here is a statement about any specific supplier. That includes Artemis Labs. This page makes no claim about our own testing, our own suppliers, or our own incoming material. It sets out a published standard and the primary sources behind it, and readers are expected to apply it to everyone, including us.

Reading a certificate with all this in mind

None of what follows requires equipment. It is a way of reading a document you already have.

Find whose laboratory it is. A name and address for the testing party, not just the seller’s logo at the top. If you cannot tell who ran the analysis, the certificate does not tell you who ran the analysis.
Find the acceptance limits, not only the results. ICH Q7’s list, as FDA quotes it, has both. A verdict without the limit it was judged against is half a document.
Check the batch number against the vial. The certificate’s reason for existing is that it belongs to a specific batch. Our page on what a lot number proves covers what that number is defined to do.
Check the dates against each other. Release date, test date, and any retest date should sit in a sensible order relative to when the material was made and when it shipped.
Ask when the sample was taken, and where. This is the question the whole page is about, and it is almost never printed on the certificate. Asking is free.
Notice that identity and purity are separate questions. A high purity figure says one substance dominates the sample. It does not say which substance. Our page on HPLC purity numbers works through what that figure does and does not measure.

A seller who can answer where and when a sample was drawn is telling you something a certificate alone cannot. A seller who cannot is not necessarily hiding anything — most of this category buys finished vials and never draws a sample at all — but that is itself the answer to the question, and it is worth having.

Sources

21 CFR 211.84, Testing and approval or rejection of components, drug product containers, and closures. Code of Federal Regulations, Title 21, 2025 annual edition. govinfo.gov
U.S. Food and Drug Administration. Questions and Answers on Current Good Manufacturing Practice Requirements | Control of Components and Drug Product Containers and Closures. fda.gov
U.S. Food and Drug Administration. Warning letter 594743, Tailor Made Compounding LLC, April 1, 2020. fda.gov
U.S. Food and Drug Administration. Warning letter 711330, Chengdu Brilliant Biopharmaceutical Co., Ltd., September 11, 2025. fda.gov
U.S. Food and Drug Administration. Warning letter 716152, Darmerica, LLC, December 8, 2025. fda.gov
U.S. Food and Drug Administration. Warning letter 723330, Harbin Jixianglong Biotech Co., Ltd., May 1, 2026. fda.gov
Hamill H, Hampshire K, Vinaya H, Mamidi P. Insights from a qualitative study of the procurement and manufacture of active pharmaceutical ingredients in India. BMJ Glob Health. 2023 May;6(Suppl 3):e011588. doi:10.1136/bmjgh-2022-011588 · PMID 37197796