Is Your Supplier's Certificate of Analysis Enough?

Usually not on its own, at least for spices, botanicals and other foods that fail at the border. A certificate of analysis is a true statement about the sample a lab was given, and the supplier usually chose that sample. Treat it as evidence to check rather than proof, and pair it with your own test on a sample drawn by someone independent.

The most important line on any CoA is often the one buyers skip. Under ISO/IEC 17025, the standard testing labs are accredited to, a lab that wasn't responsible for drawing the sample has to say in its report that the results apply to the sample as received (NIST crosswalk of ISO/IEC 17025:2017, clause 7.8.2.2 (opens in a new tab)). That's not a lab covering itself. It's the lab being honest about the limit of what it knows. I'll keep coming back to "as received" in this post, because nearly every way a clean CoA fails to protect you sits inside those three words. One caveat - this is about how reliable the paperwork is. Which tests your border needs is a different question, answered in why the same spice lot passes in one country and fails in another.

1. What Does a Certificate of Analysis Actually Prove?

That a lab tested a particular sample, by a particular method, and got particular results. If the lab is competent and accredited for that test, those results are probably right. What the CoA can't tell you is whether that sample represents your shipment.

Think about what "as received" leaves open. The lab doesn't know who picked the sample, from which bags, before or after cleaning, sterilising or blending. It doesn't know whether the lot was split later, topped up from another batch or relabelled. ISO/IEC 17025 also requires a lab to flag information the customer supplied, such as a lot number or a sampling date, with a disclaimer where it could affect the results (same NIST crosswalk). So the lot number on a CoA can be no more than what the supplier wrote on the sample bag.

None of that makes a CoA worthless. It makes it a statement about a sample, and your job is to connect that sample to your goods.

2. Why Do Lots With a Clean CoA Still Get Refused?

For three different reasons, and they need different fixes.

The first is the sample. A test on a sample that didn't represent the lot can be accurate and still beside the point. Aflatoxin, for one, sits in pockets through a lot. The EU's own sampling rules for mycotoxins say aflatoxins are "very heterogeneously distributed in a lot", which is why they demand incremental samples from many points (Regulation (EC) No 401/2006, recital 7 (opens in a new tab)), so a single grab sample can pass while the lot fails. And the hazard that holds most US spice shipments is a microbe, not a paperwork gap. A sourcing start-up called Salmonella "the single biggest reason spice shipments get held" in July 2026 (LinkedIn, 2026 (opens in a new tab)), which matches our count of FDA refusals, where Salmonella is the leading charge on Indian spice lines by a wide margin.

The second is the panel. A report can be perfectly accurate and not cover what your border tests for. That's the subject of the same spice, three borders article, so I'll leave it there.

The third is the paper itself. In the EU, 100 of 254 notifications on Indian botanicals and supplements carried no hazard, only certificates and reports that were missing, improper or didn't match the lot (our count of RASFF). Across all Indian notifications it was 299 of 1,765. No contamination, just documents that didn't line up.

3. Who Issued the Certificate?

This is the first thing I check, and there are three common answers.

The supplier's own lab. Plenty of good exporters run an in-house QC lab, and that's a sign of process control I'd want to see. But it isn't independent, and a report from it is the supplier checking its own work.

A third-party lab the supplier chose and paid. Better, and the usual case. The lab is independent of the supplier, but the sample still came from the supplier.

A lab you chose, testing a sample someone independent drew. That's the one that answers your question.

For any Indian lab, check its accreditation yourself. NABL accredits testing labs in India to ISO/IEC 17025 and runs a public laboratory search on its site (NABL (opens in a new tab), read 18 October 2026). Accreditation covers the tests listed in the lab's scope, not everything it offers, and India's food regulator instructed its notified food labs that the NABL symbol belongs on test reports only "for tests that are covered under their scope of accreditation" (FSSAI order, 15 October 2024 (opens in a new tab)). So a NABL logo at the top of a CoA doesn't mean every line on it is accredited. Look the lab up, open its scope, and find your analyte in your kind of product. There's a second check that takes ten seconds. NABL requires accredited labs to print a unique laboratory report (ULR) number on every report issued within their accredited scope, and says the number "is not to be used in reports containing parameters outside the scope of NABL accreditation" (NABL clarification on ULR numbers, 11 June 2026, revised 15 June 2026 (opens in a new tab)). The ULR carries the lab's certificate number, the year and a running number. A report that claims accreditation and carries no ULR is a question to ask the lab before you accept it.

Some buyers go further than checking the lab. In 2020 a US buyer of Indian botanicals said that with any Indian or Chinese heavy-metal CoA "it's probably wise to move the decimal point one place to the right" (r/Nootropics, 2020 (opens in a new tab)). That's one buyer's rule of thumb, and an unfair one to apply to every lab. The fairer voice in the same research said trust comes from a long relationship plus a few third-party spot checks. I'd go with that.

4. How Do You Read a CoA Line by Line?

With the invoice and the packing list next to it. These are the lines I check, in order.

The method and limit-of-quantification line catches more people than any other, because "not detected" means nothing if the lab couldn't detect below your border's limit. The food import testing guide explains how to ask a lab for those limits, so I won't repeat it here.

5. What Does a CoA Never Cover?

A few things buyers assume it covers.

• An organic certificate isn't a contaminant test. US spice buyers on a 2024 cooking-forum thread made the point that an organic certificate is paperwork about how a crop was farmed, while heavy-metal testing is a separate step (r/Cooking, 2024 (opens in a new tab)).
• A GMP certificate isn't a batch test. As one voice on an Ayurveda forum put it, "GMP Certification is for manufacturing process" (r/Ayurveda, 2017 (opens in a new tab)). It tells you about the factory's system, not your lot.
• A CoA on one ingredient isn't a CoA on the blend. A masala is only as clean as its dirtiest component, and a report on the chilli says nothing about the coriander.
• A clean CoA doesn't release a supplier from a US import alert. If the firm is on an alert, its goods can be held whatever the report says. Check that first, as FDA import alerts explains.

6. How Does a Split Sample Work?

It's the simplest way to make a supplier's CoA worth trusting. Someone independent of the supplier draws a sample from the packed lot, from many points rather than the top of one bag, and divides it into three sealed portions with the lot number on each.

1. One goes to the supplier's usual lab.
2. One goes to a lab you choose, accredited for your tests in your product.
3. One stays sealed as a counter-sample, in case the two disagree.

If the two results agree, you've learnt that the supplier's lab and paperwork can be trusted for that test, and you can start testing less often. If they disagree, the counter-sample settles it, and you've learnt something far more valuable before the shipment sails rather than after. Either way, the supplier's lab is no longer testing a sample "as received" from an unknown hand.

Drawing and sealing samples needs a person in the warehouse in India. If you don't have one, SourcingSync (opens in a new tab) draws and seals samples at origin and sends them to the labs you choose.

7. When Is the Supplier's CoA Enough?

When it has earned it. A supplier whose CoAs have matched your independent tests over several lots, whose lab is accredited for the right tests and whose paperwork lines up with the invoice every time, has given you a reason to rely on its reports. Keep a spot check going, every few lots, and go back to testing every lot if a result ever disagrees or something in the supply changes.

On a first order, or on a product with a known border history like spices to the US or botanicals to the EU, I wouldn't rely on it alone. That isn't a judgement on Indian labs. It's what a careful buyer does with any certificate on a sample they didn't draw. What each spice tends to fail on is on spice sourcing, and Australian buyers will find their border's record in Indian food failures at the Australian border.

Questions Buyers Ask

8. Back to "As Received"

Those words are the lab telling you exactly what it can and can't vouch for. It tested what it was handed. Whether what it was handed was your lot is the question only you can close, by checking who issued the report, matching the paper to the goods and, at least until a supplier has earned it, drawing a sample of your own.