A polished PDF with green “Pass” marks is not enough to release a food shipment. A useful Certificate of Analysis must connect the tested sample to the contracted lot, apply an appropriate method, report interpretable results and support—not replace—the buyer’s verification programme.
Fast decision rule
Review the COA in this order: identity → sampling → laboratory scope → method → result and unit → correct limit → authorised release. Stop if any link is missing.
What a COA can—and cannot—show
A COA records analytical or physical results for a stated sample. It can show that the sample produced those results under the reported method and laboratory conditions. It cannot automatically prove that every bag in a container is identical, that the sample was collected representatively, or that untested hazards are absent.
Codex identifies good hygiene practices and hazard-based food-safety controls as foundations across the food chain. Testing is one verification tool within that system, not a substitute for supplier approval, process controls, traceability and an agreed specification. See the Codex General Principles of Food Hygiene.
1. Match the report to the shipment
Identity fields
- Supplier and manufacturing/processing site where relevant
- Product, variety/form and grade
- Lot/batch number and production or packing date
- Quantity represented and sample identification
- Sampling location, date and party
- Report number, issue date and page numbering
- Seal or chain-of-custody reference for independent samples
Compare these fields with the contract, packing list, bag markings, inspection record and container loading report. A report from a previous crop, different lot or generic “representative sample” should not be silently reused.
2. Ask who took the sample and how
Sampling often contributes more uncertainty than the instrument. A few scoops from accessible bags may miss variation across a warehouse lot. The specification should state the number and location of increments, composite preparation, sample reduction, sealing, retention and the person authorised to sample.
Codex’s current CXS 234-1999 is the central reference for recommended methods of analysis and sampling provisions. Use the product/destination-relevant plan; do not assume one sampling approach fits rice, whole spices and heterogeneous mycotoxin risks equally.
3. Verify the laboratory and its scope
ISO/IEC 17025:2017 is the international standard for competence, impartiality and consistent operation of testing and calibration laboratories. However, an accreditation logo does not mean every possible test is accredited.
| Check | Buyer question |
|---|---|
| Accreditation body | Is the body recognised in the relevant market, and can the certificate be verified? |
| Current validity | Was accreditation valid when testing occurred? |
| Scope | Does it cover the food matrix, analyte and method—or is the test clearly marked non-accredited? |
| Report control | Are page count, signatures/approval, amendments and verification details controlled? |
| Subcontracting | Was any test subcontracted, and is the performing laboratory identified? |
4. Read the method, unit and reporting limit
“AOAC,” “ISO method” or “in-house method” without a number/version may be too vague. Record the method reference, preparation/extraction where material, result unit and whether the method is accredited for that matrix.
| Term | Why the buyer needs it |
|---|---|
| LOD | Limit of detection: the lowest level the method can detect under stated conditions |
| LOQ | Limit of quantification: the level at which the result can be quantified with suitable performance |
| Result unit | mg/kg, µg/kg, ppm, %, cfu/g and other units are not interchangeable without conversion |
| Basis | Results may be reported as received, dry matter or on another basis |
| Uncertainty | Near-limit results may need the contract/regulator’s decision rule and measurement uncertainty treatment |
A report that says “ND” should identify what that means and the detection/quantification limit. “Not detected” does not mean absolute zero.
5. Compare with the correct limit—not a copied target
Use three columns in the buyer review: contractual limit, current destination legal limit and actual result. The tightest applicable requirement generally controls the commercial release, but obtain qualified advice for the jurisdiction.
For EU pesticide residues, the Commission explains that an MRL is the highest residue level legally tolerated when pesticides are correctly applied, and the searchable database supplies current product–pesticide values. Review the live EU MRL guidance and database at the time of contracting and release.
Do not use a universal “EU compliant” line
Ask which product code, analytes, limits, test method and report date support the statement. Similar commodities and processed forms may not map to the same legal entry.
6. Build a risk-based panel by commodity and market
The examples below are discussion starters, not prescribed panels:
- Rice: commercial grain parameters plus destination-relevant residues, contaminants and microbiology where risk/market requires.
- Spices: identity/purity and moisture, plus risk-based residues, mycotoxins, heavy metals, illegal colours/adulterants and microbiology.
- Pulses and grains: grade/defects and moisture, infestation, residues and commodity/origin-specific mycotoxin risks.
- Groundnuts and susceptible oilseeds: aflatoxin sampling and analysis require special attention because contamination may be unevenly distributed.
Covered US importers should align verification with their FSVP hazard and supplier evaluation. FDA states that the verification activity must provide adequate assurance that the foreign supplier produces food consistent with applicable US requirements; review the FDA FSVP guidance.
7. Use a controlled release workflow
- Freeze the approved specification and test plan before production.
- Define the lot and authorised sampling party.
- Take, seal and identify laboratory and retention samples.
- Check report identity and laboratory scope before reading “Pass/Fail.”
- Compare each result with the contract and current destination limit.
- Record reviewer, date, exceptions and release decision.
- If out of specification, preserve evidence and follow the agreed confirmatory/referee procedure—do not simply retest until a passing value appears.
Download-free COA review checklist
Approve only after confirming
- Correct supplier, product, lot, quantity and shipment
- Representative sampling and controlled chain of custody
- Current laboratory identity and applicable accreditation scope
- Named method/version, unit, basis, LOD/LOQ where relevant
- Correct contract and destination limits
- No unexplained alteration, missing page or inconsistent date
- Out-of-specification and near-limit results resolved under the agreed rule
- Authorised buyer release recorded before loading or document acceptance
Buyer questions
Should the supplier or buyer choose the laboratory?
Agree the rule in advance. Options include an approved laboratory list, an independent inspection company, buyer nomination, or a primary/referee arrangement. The key is current competence for the exact work and a controlled sample.
Can I accept a supplier’s internal COA?
It may support routine process control if the system is approved, but higher-risk parameters or first transactions may justify independent verification. The choice should follow the buyer’s risk assessment and destination rules.
What if the result is very close to the limit?
Do not invent a decision after seeing the result. Apply the contract/regulator’s decision rule, including measurement uncertainty where relevant, and use the agreed confirmatory process.
Editorial and regulatory note
Sources were reviewed on 16 August 2026. This guide explains procurement controls and is not laboratory, legal or regulatory advice. Confirm the applicable law, method and decision rule with competent professionals.