How to read a Certificate of Analysis: the eight tests that matter
Why most COAs look the same
A Certificate of Analysis (COA) is the batch's report card: the tests run on that lot, the method used, the limit it had to meet and the result. On paper, a good COA and a weak one look much alike. Both have a logo, a table and "complies" down the right-hand column.
The difference is in the detail: whether the results are numbers or adjectives, whether the laboratory is accredited for the tests it reports, and whether the panel covers the risks that actually matter for that material. For botanicals, resins such as Shilajit, and supplements made from them, those risks are well known: wrong identity, low potency, heavy metals, microbes, pesticide residues, mycotoxins, process contaminants and leftover solvents.
This guide shows what to check on the page before you approve a batch, the eight tests that protect you, and the red flags that should stop a shipment.
Before the results: check the header
Many problems on a COA are visible before you reach the test table. Check these first:
Product and batch. The product name and batch number match the label, the cartons and the invoice exactly.
Dates. The date of analysis falls after the date of manufacture, and the best-before or retest date makes sense for the format.
Who tested it. The manufacturer's own quality control lab, or an independent laboratory. Both are normal, but for export batches the key contaminant tests should come from a laboratory accredited to ISO/IEC 17025.
Accreditation scope. Accreditation covers specific tests, not the whole lab. Accredited results are usually marked as such on the original report.
Specification beside each result. Every line shows the limit the batch had to meet and a numeric result.
Methods. Each test names its method, such as ICP-MS for metals or HPLC for a marker compound, or a pharmacopoeia reference.
Units. mg/kg, µg/kg, % and CFU/g are not interchangeable. A result in the wrong unit can hide a failure a thousand times over.
Sample. Whether the finished product was tested, or only the raw material. EU contaminant limits apply to the product as sold.
Sign-off. Named, dated authorisation by the responsible QC person or laboratory.
The eight tests that matter
1. Identity: is it the right material?
Identity proves the material is what the label says, and not a cheaper substitute. For botanicals this is usually an HPTLC or HPLC fingerprint compared with a reference, sometimes backed by microscopy. For essential oils it is the GC-MS profile.
Look for: a named method and a clear "conforms to reference" result. Appearance, colour and odour alone are not identity tests.
2. Assay: is it as strong as declared?
The assay measures the marker compound the product is standardised to: withanolides in ashwagandha, curcuminoids in turmeric, fulvic acid in Shilajit. It is the number you are paying for.
Look for: a numeric result against a minimum (for example "fulvic acid 76.2%, specification >75%") and the method used. Results from different methods are not comparable, so a fulvic acid figure without its method tells you very little.
3. Heavy metals: lead, cadmium, mercury and arsenic
Botanicals and mineral-rich materials such as Shilajit take up metals from the soil and rock. For food supplements sold in the EU, the limits are 3.0 mg/kg for lead, 1.0 mg/kg for cadmium and 0.10 mg/kg for mercury (Regulation (EU) 2023/915).
Look for: ICP-MS results as numbers, on every batch and on the finished product. A one-off certificate from an earlier lot is not a control.
4. Microbiology: is it clean?
Plant materials carry soil organisms, and poor drying or storage lets them grow. A standard panel covers total plate count, yeasts and moulds, E. coli and Salmonella, often with Staphylococcus aureus and bile-tolerant gram-negative bacteria.
Look for: counts in CFU/g against limits, and "absent in 25 g" for Salmonella. Many buyers benchmark against Ph. Eur. 5.1.8 or USP <2023>, so ask which standard the specification follows.
5. Pesticide residues, including ethylene oxide
Residues must stay within the EU's maximum residue levels (Regulation (EC) No 396/2005). A good multi-residue screen by GC-MS/MS and LC-MS/MS covers several hundred compounds. Ethylene oxide is not approved in the EU and must be tested separately, reported as the sum of ethylene oxide and 2-chloroethanol.
Look for: the number of compounds screened, the limit of quantification, and a separate ethylene oxide line for botanicals, spices and mineral ingredients such as calcium carbonate.
6. Mycotoxins: aflatoxins and ochratoxin A
Moulds on seeds, roots, spices and dried fruit produce toxins that survive processing. Aflatoxins B1, B2, G1 and G2 and ochratoxin A are the main ones.
Look for: results for aflatoxin B1 and total aflatoxins, by HPLC with fluorescence detection or LC-MS/MS, on any spice-, seed- or root-based product.
7. PAHs and pyrrolizidine alkaloids
Polycyclic aromatic hydrocarbons (PAHs) form when plant material is dried over smoke or open flame. Pyrrolizidine alkaloids are natural plant toxins, often from weeds harvested alongside the crop. For botanical food supplements in the EU, the limits are 10 µg/kg benzo(a)pyrene, 50 µg/kg for the sum of four PAHs, and 400 µg/kg pyrrolizidine alkaloids.
Look for: both tests on botanical extracts, which concentrate these contaminants along with the actives.
8. Residual solvents
Extracts made with ethanol, hexane, acetone or other solvents can retain traces. The EU lists the extraction solvents allowed in food and their residue limits (Directive 2009/32/EC).
Look for: a GC headspace result for each solvent used in the process, and a statement of which solvents were used. Water-only or ethanol-only extraction should be stated as such.
Supporting tests worth seeing: moisture or water activity (for resins and powders, the main driver of shelf life and microbial growth), disintegration for capsules and tablets, and acid-insoluble ash for Shilajit, which shows how well rock and sand were removed.
Red flags that should stop a batch
"Complies" or "passes" with no number. You cannot tell how close the batch is to the limit, or whether the test was run at all.
"Not detected" with no limit of quantification. If the method cannot see below the legal limit, "not detected" proves nothing.
Identical results on different batches. Often a sign of a template COA rather than real testing.
Analysis dated before manufacture. The report cannot belong to this batch.
Batch number differs from the cartons or invoice. The COA may be genuine, but for another lot.
Marker assay with no method. Fulvic acid, withanolides and similar figures vary widely between methods.
Contaminants tested on the raw material only. EU limits apply to the finished product as sold.
No ethylene oxide result for an Indian botanical, spice or mineral. India has been the largest single origin of EU ethylene oxide alerts since 2023.
A summary COA but no original laboratory report. You cannot check accreditation, scope or authenticity.
A lab report whose layout, logo or numbering looks altered. Check the report number directly with the issuing laboratory.
One red flag is a question to ask. Two or more on the same COA is a reason to hold the batch until an independent test is back.
How to verify a COA independently
A COA is the supplier's evidence. For a first order, a new material or a new supplier, check it with a test of your own. A simple, fair procedure that both sides can agree in advance:
One homogenised batch. The supplier produces the order from a single, mixed batch, so one test represents all of it.
Random samples. You or your agent pick sample units at random from the finished, packed lot, not from a separate "sample" jar.
Independent laboratory. The samples go to an ISO/IEC 17025-accredited laboratory of your choice, testing the same parameters as the COA.
Order held until results. The batch is not released or shipped until the independent results are in.
Same-batch confirmation. The lab report, the supplier's COA and the shipped lot carry the same batch number.
After a supplier has passed several batches, many buyers move to periodic or risk-based testing: every batch for heavy metals and ethylene oxide, and the full panel every few batches.
Also ask for retained samples of each batch to be kept until after the best-before date. Ask for the original laboratory report behind any summary COA; reputable laboratories print a report number, and often a verification code, that you can check with them directly.
At Giva Agro, every batch ships with its Certificate of Analysis, and we welcome independent verification at a laboratory of the buyer's choice, with retained samples kept for exactly that purpose.
Frequently asked questions
Is a manufacturer's in-house COA good enough?
For routine release, often yes, provided the methods are named and the results are numeric. For export batches, heavy metals, pesticides and ethylene oxide should come from an ISO/IEC 17025-accredited laboratory, and a first order should be verified independently.
How often should each test be run?
Identity, assay, heavy metals, microbiology and ethylene oxide on every batch. The other contaminant tests on every batch for new suppliers and materials, then at an agreed frequency once the supply is proven.
What does "ND" mean on a COA?
Not detected: the result was below the method's limit of detection or quantification. It is only meaningful if that limit is stated and sits below the legal or specification limit.
Who pays for independent testing?
Usually the buyer, as part of supplier approval. Agree the laboratory, the parameters and what happens if a result fails before samples are sent.
What should a Shilajit COA show in particular?
Fulvic acid with its method, heavy metals by ICP-MS on every batch, acid-insoluble ash, moisture, microbiology and pesticide residues. Our Himalayan Shilajit page lists the full panel we release against.
Want to see a real COA before you buy?
Ask us for a sample Certificate of Analysis for the product you are considering, along with its specification sheet. Samples ship in 7–10 working days with the batch COA.
Request a sample and COA · Herbal supplements and nutraceuticals
Related guides: Importing dietary supplements into the EU: a brand owner's checklist · Private label, white label, contract manufacturing or OEM — which do you need?
EU limits quoted are current as of October 2026. Always check your specification against the latest regulations for your destination market.
