Supplier Data Quality: Getting Clean Certificates of Analysis Into Your Systems

Why the Certificate of Analysis Is a Data Problem

A certificate of analysis is a short document. It names a material, identifies a batch, lists the tests performed against a specification, reports the results, and carries the signature of someone in the supplier’s quality unit. For a drug product manufacturer, it is often the only evidence of most of the quality attributes of an incoming material. Your own laboratory may run an identity test and a handful of other checks. The rest of what you know about that lot comes from the supplier’s numbers.

That makes the CoA a data source, not just a record. The values on it feed your enterprise resource planning (ERP) system, your laboratory information management system (LIMS), and sometimes your manufacturing execution system (MES). They support the quality unit’s decision to release a lot for use. They may be trended to detect drift in a supplier’s process. If the supplier is on a reduced testing program, they substitute for tests you would otherwise run yourself.

Most companies still receive CoAs as PDF files attached to emails or uploaded to a supplier portal. Someone in incoming quality or the warehouse opens the file, reads the values, and types them into a system, or simply checks a box that says the CoA was reviewed. Each of those steps is a place where the data can go wrong. The supplier may have issued the wrong document. The document may be missing information. The person reading it may transcribe a value incorrectly. The system may accept a result that does not match the specification version your site uses.

A Feed From a Party You Do Not Control

Internal data quality problems are hard enough, but at least you own the processes that create the data. With a CoA, the data is created in someone else’s laboratory, under someone else’s procedures, often on a different LIMS, sometimes after passing through a distributor who reissues the certificate on its own letterhead. You cannot inspect every step. What you can do is define what a good CoA looks like, check each one against that definition when it arrives, confirm periodically that the supplier’s numbers match your own testing, and write the expectations into an agreement the supplier signs.

That is the thread running through this article. The regulations describe the minimum. The practical work is turning those requirements into a data quality discipline that holds up across hundreds of materials and dozens of suppliers.

What the Rules Require Before You Trust a Supplier CoA

Every major GMP framework allows some reliance on a supplier’s CoA, and every one attaches conditions. Senior leaders do not need to memorize the clauses, but they should know that the conditions are consistent across regions and that inspectors check them.

United States: 21 CFR 211.84

The US drug CGMP regulation at 21 CFR 211.84 governs testing and approval or rejection of components, containers, and closures. Section 211.84(d)(1) requires at least one test to verify the identity of each component, using a specific identity test if one exists. Section 211.84(d)(2) requires each component to be tested for conformity with its written specifications for purity, strength, and quality, and then provides the exception that makes supplier CoAs usable. In the regulation’s words, “a report of analysis may be accepted from the supplier of a component, provided that at least one specific identity test is conducted on such component by the manufacturer, and provided that the manufacturer establishes the reliability of the supplier’s analyses through appropriate validation of the supplier’s test results at appropriate intervals.”¹

Two conditions matter. The identity test is not optional, and the reliability of the supplier’s results has to be established and then rechecked. FDA’s question and answer page on the control of components restates the same requirement when it explains who is responsible for testing active pharmaceutical ingredients received from a supplier.² Section 211.84(b) adds that sampling should account for, among other factors, the past quality history of the supplier.¹

ICH Q7 for Active Pharmaceutical Ingredients

ICH Q7, the GMP guide for active pharmaceutical ingredients, says at section 7.30 that at least one identity test should be run on each batch of incoming material, and that “A supplier’s Certificate of Analysis can be used in place of performing other tests, provided that the manufacturer has a system in place to evaluate suppliers.” Section 7.31 is more specific: “Full analyses should be conducted on at least three batches before reducing in-house testing.” It adds that full analysis should still be performed at appropriate intervals and compared with the CoAs, and that “Reliability of Certificates of Analysis should be checked at regular intervals.”³

ICH Q7 also sets content expectations for the CoAs that API manufacturers issue. Section 11.4 asks for the material name and grade, batch number, release date, expiry or retest date, each test performed with its acceptance limits, and numerical results where the test is numerical. Certificates should be dated and signed by the quality unit and should show the original manufacturer’s name, address, and telephone number. When a repacker, agent, or broker issues a new certificate, it should identify the laboratory that performed the analysis, refer to the original manufacturer and the original batch certificate, and attach a copy of that original.³ Those content rules are, in effect, a data specification for the CoA.

Health Canada, the EU, and PIC/S

Health Canada’s GMP guide for drug products (GUI-0001) is the most explicit about reduced testing. Its interpretation of the raw material testing regulations describes a vendor certification program that includes full confirmatory testing of the first three lots of each raw material from a vendor and after any significant change to the manufacturing process, full confirmatory testing of at least one lot per year of a raw material from each vendor, and, where several raw materials come from the same vendor, confirmatory testing of each material at least once every five years. The written agreement with the vendor must require that the CoA present actual numerical results and refer to the batch number, the raw material specifications, and the validated test methods used. Specific identity testing is still required on all lots received on site.⁶

For excipients in the EU, the 2015 Commission guidelines on formalized risk assessment, which PIC/S later adopted as PI 045-1, require the manufacturing authorization holder to classify each excipient and each excipient manufacturer by risk. The risk factors include supply chain complexity and known quality defects or fraudulent adulteration related to the excipient. The resulting control strategy may combine audit, document retrieval, and testing, and it should be reviewed over time using measures such as the number and severity of defects in batches received and trend analysis of excipient quality.⁹

The Common Errors That Make CoA Data Unreliable

Industry guidance on CoAs is largely a list of problems someone has already had. Reading the IPEC Certificate of Analysis Guide for pharmaceutical excipients, ICH Q7 section 11.4, and FDA’s diethylene glycol guidance side by side, the same categories of defect come up again and again.^3,4,8 We group them below by where they break the data.

Origin and Identity Errors

The most dangerous CoA errors are the ones that hide where a material came from. FDA’s guidance on testing high-risk components for diethylene glycol (DEG) and ethylene glycol (EG) describes a pattern from past poisoning outbreaks: the CoA the drug manufacturer received was often a copy on a distributor’s letterhead rather than the one issued by the original glycerin manufacturer, and the chain of custody was not apparent from the document. The guidance also notes a 2022 case in which the appearance of a propylene glycol label and CoA suggested the container’s contents might differ from what the label and CoA stated.⁴

The IPEC guide addresses this directly. It recommends that the original manufacturer and manufacturing site be identified when they differ from the supplier, so that the user can confirm a change of manufacturing location has not occurred without their knowledge.⁸ When your receiving system stores only a supplier name and not the original manufacturing site, you lose the ability to detect that kind of change at all.

Linkage Errors

A CoA is only useful if it is tied to the right batch and the right specification. Common failures include a batch number on the CoA that does not match the container label, a CoA covering a parent batch when the delivery was a repacked portion, and results reported against the supplier’s sales specification when your site tests against a different or tighter internal specification. The IPEC guide suggests, as best practice, that the CoA reference the user’s current specification number and version or issue date.⁸ Do not assume a supplier will do this unless you ask, which is one reason the quality agreement matters.

Content and Format Errors

Some CoA defects are about what is missing or how it is expressed:

• Pass or conforms statements instead of values. The IPEC guide recommends reporting actual data rather than nonspecific pass or conforms statements, unless the test is qualitative or the specification itself is written that way. Health Canada requires actual numerical results on CoAs used in a vendor certification program.^6,8 A “conforms” entry cannot be trended and cannot be compared with your own result.
• Test basis not stated. Suppliers may report a value from in-process testing, from continuous or periodic monitoring, or from a skip-lot program instead of from testing the finished batch. The IPEC guide says this should be indicated on the CoA and the technique described.⁸ If your system records every value as if it came from full batch testing, you are overstating what you know.
• Ambiguous dates. The IPEC guide recommends an alphabetic month and a four-digit year to prevent misreading. A date written as 03/04/2026 means different things in the US and in Europe, and an expiry or retest date misread by a month is a release error waiting to happen.⁸
• Confused retest and expiry dates. An expiry date cannot be extended; a retest date can be, based on appropriate testing. The IPEC guide notes that a recommended retest date should not equal or exceed the expiration date.⁸ Systems that store only one date field blur the distinction.
• Missing pages. The IPEC guide recommends numbering all pages with the total page count, so the user can confirm the whole certificate is present.⁸
• Unclear approval. ICH Q7 asks for CoAs dated and signed by authorized quality unit personnel. For electronically generated CoAs without a handwritten signature, the IPEC guide asks for a statement with traceability to the signatory and for ALCOA+ controls in the generating system, including access control and time-stamped audit trails.^3,8

Transcription and Handling Errors on Your Side

Not every CoA error starts at the supplier. When a person reads a PDF and types values into a LIMS, units can be dropped, decimal places moved, and results entered against the wrong test or the wrong lot. When the practice is to attach the PDF and record only “CoA reviewed,” there is no structured data at all, which means no trending and no automated comparison with your own results. ASTM’s standard guide for raw material electronic data transfer names this problem in its statement of significance: structured transfer is meant to avoid “data recapture, human interaction, and transcription errors.”¹⁴

PDF Versus Structured CoAs

The format question comes up in almost every discussion of CoA data quality. Should you push suppliers toward structured, machine-readable CoAs, or is a well-controlled PDF process good enough? The answer depends on volume, risk, and what you want the data to do, but it helps to be clear about what each format can and cannot fix.

Where the Industry Stands

BioPhorum, the biopharmaceutical manufacturing consortium, published a paper on digital certificates of analysis in February 2024. It describes digital exchange of CoAs and related data as generally at a low level of maturity across the pharmaceutical industry, identifies 11 distinct use cases from raw materials to finished product, and notes that ASTM E3077-17, a standard for exchanging raw material CoA data, has seen limited adoption.¹¹ A companion BioPhorum article describes the current state as point-to-point solutions between individual sponsors and suppliers, where data and data structures differ by source and change over time, and calls for a common approach built on a shared data model, data dictionary, and controlled vocabularies.¹²

A 2025 BioPhorum piece in Pharmaceutical Online sets out the practical direction: a common logical data model that can be carried in several formats (PDF, CSV, XML, or JSON) so that partners at different levels of digital maturity can take part, with design choices made so the data can support secondary uses such as predictive analytics.¹³ ASTM has since revised the standard. E3077-25 defines an XML format with an XML schema definition, covers data content including taxonomy and nomenclature, and allows digital signatures as part of the transfer. The guide notes that data not conforming to its schema is not guaranteed to be interoperable.¹⁴

What Structured Data Fixes and What It Does Not

Structured CoAs remove the transcription step and make completeness checks automatic. If a required field is missing, the file can be rejected before anyone looks at it. If a result falls outside your specification, the system can flag it. If the supplier’s site identifier changes, you can see it. Those are real gains, and they grow with the number of lots you receive.

Structured data does not make the supplier’s results more reliable. The regulations tie reliance on a CoA to your own verification of the supplier’s analyses, not to the file format. A structured CoA from an unqualified supplier is no more trustworthy than a PDF from the same supplier. It is also worth remembering that structured exchange moves a new set of problems onto your side: mapping supplier test names to your test codes, handling unit conversions, and keeping those mappings under change control. If your own material and test master data are inconsistent, a structured feed will expose that quickly.

A Practical Middle Path

Most pharma and biotech companies will run a mixed estate for years. A sensible approach is to prioritize structured exchange for high-volume materials, high-risk components, and suppliers already able to send data, while tightening the PDF process for everyone else. Tightening means a fixed set of required CoA fields, a checklist or form that captures values as data at receipt rather than attaching the PDF alone, and second-person verification for high-risk materials. Some companies use document extraction tools to pull values from PDFs. If you do, treat the extraction step as part of a GxP process: validate it for the intended use, keep the source PDF as the original record, and confirm extracted values against the source until you have evidence the extraction is reliable for each supplier’s layout.

Verification at Receipt: A Practical Check Sequence

Verification at receipt is where certificate of analysis data quality is won or lost for each lot. The IPEC guide is direct on this point: the medicinal product manufacturer needs to review the CoA for every batch received.⁸ The review is not a glance at the signature. The sequence below turns the regulatory and industry expectations into steps an incoming quality team can follow and a system can support.

High-Risk Components Need a Different Default

FDA’s DEG and EG guidance applies to glycerin, propylene glycol, maltitol solution, hydrogenated starch hydrolysate, sorbitol solution, and other high-risk components. It explains that the infrared absorption test in the USP glycerin monograph identifies glycerin but cannot detect or quantify DEG or EG, while the gas chromatography test in the same monograph quantifies them down to the safety limit of not more than 0.10 percent. Representative samples of each shipment of each lot must be tested and meet that limit before use, and FDA recommends testing samples from all containers because contamination has varied widely from container to container.⁴ For these components, no CoA, however complete or well formatted, replaces your own test.

The World Health Organization’s January 2023 call to action after the contaminated syrup deaths made similar points to manufacturers: buy pharmaceutical grade excipients only from qualified suppliers, test supplies comprehensively on receipt and before use, and keep full records for traceability.⁵

Where Receipt Verification Fails in Practice

FDA warning letters show how often the basics are missed. In January 2024, FDA cited an over-the-counter drug manufacturer for failing to test incoming components for identity and for relying on suppliers’ CoAs without establishing the reliability of the suppliers’ test analyses at appropriate intervals. The agency asked the firm to describe how it would establish supplier reliability through initial validation and periodic revalidation, and to commit to at least one specific identity test for each incoming component batch.¹⁵ A July 2025 letter to a maker of hand sanitizer and other topical products cited the same two failures, noting inadequate identity testing of incoming components such as ethanol and glycerin, and asked for a summary of results from testing all components to evaluate the reliability of the CoA from each component manufacturer.¹⁶ A December 2025 letter to another OTC manufacturer again cited reliance on supplier CoAs without establishing reliability and inadequate identity testing of a high-risk component whose USP identity test includes a limit test; FDA redacted the name of that component in the published letter.¹⁷

All three recipients made over-the-counter products, not prescription biologics or small-molecule APIs. The requirement they missed applies equally to every finished drug manufacturer under Part 211, which is why we use them here. They show the failure mode in its simplest form.

Reduced Testing Programs Depend on CoA Reliability

Reduced testing is where CoA data quality has the most direct effect on operations. Running full compendial testing on every lot of every material is slow and uses laboratory capacity that most sites do not have. A reduced testing program lets you test identity and a small set of attributes in house and accept the remaining results from the supplier’s CoA. It is a normal, accepted practice. It also means that for most attributes, the CoA is the only data you have.

What Qualifies a Material for Reduced Testing

Christian Rack’s article in Pharmaceutical Technology describes the established approach: reduced testing requires an audited, qualified, and risk-classified manufacturer, and it cannot start before the product has a marketing authorization. He cites ICH Q7’s three-batch expectation, describes annual full testing of each starting material as common industry practice, and notes Health Canada’s rotational option for suppliers of several materials.⁷ The IPEC CoA guide makes the same link from the excipient side: CoA data can support release under a reduced testing program only if the excipient manufacturer is fully qualified.⁸

Put together, the entry criteria for a material and supplier to move onto reduced testing usually look like this:

• The supplier and original manufacturing site are approved through your supplier qualification process, including an audit or equivalent assessment proportionate to risk.
• Full testing has been performed on an initial set of lots (at least three under ICH Q7 and Health Canada) and the results agree with the supplier’s CoAs within defined limits.
• The supplier’s CoAs meet your content requirements, including numerical results and original manufacturer identification.
• A quality agreement is in place covering CoA content, change notification, and investigation of discrepancies.
• The material is not in a category where your own full testing is required regardless, such as the high-risk components covered by FDA’s DEG and EG guidance for the tests that guidance addresses.

Defining Agreement Between Your Results and Theirs

The phrase “validation of the supplier’s test results” in 211.84(d)(2) is often reduced in practice to “we ran full testing and everything passed.” That is weaker than it sounds. Two results can both pass the specification and still disagree enough to suggest a method, calibration, or sampling problem at the supplier. Rack recommends defining the accepted differences between your internal results and the supplier’s CoA results before the comparison is made.⁷ Those limits should reflect the precision of the methods involved and the risk of the attribute. They should be written down, applied consistently, and captured in a form that can be trended.

When a difference falls outside the accepted range, the investigation should start at your own laboratory. Rack describes the usual sequence: the drug manufacturer investigates first, and if it does not find the root cause, the investigation extends to the supplier.⁷ Only after that should the outcome feed a decision about the supplier’s reduced testing status.

Keeping the Program Honest Over Time

Reduced testing programs erode when the periodic confirmatory tests are scheduled by memory. Health Canada’s framework (first three lots, one lot per year per vendor, each material at least every five years for multi-material vendors) is a useful model even outside Canada because it is concrete enough to encode in a system.⁶ Build the schedule into your LIMS or quality management system so that the next confirmatory test is triggered automatically, and so that an overdue test blocks further reduced testing for that material and supplier until it is done.

Supplier Data Quality Agreements

A quality agreement defines which party is responsible for which quality activities and how quality issues will be resolved. The IPEC Quality Agreement Guide for excipients, updated in 2024, describes quality agreements as legally binding documents negotiated between customers and suppliers, and states that they cannot replace supplier qualification elements such as an audit.¹⁸ Its template lists the IPEC CoA guide among the reference documents that support the responsibility table, and it provides for attaching an example CoA to the agreement.

Most quality agreements cover CoAs in a sentence or two: the supplier will provide a CoA with each batch. For a company that relies on CoA data for release and reduced testing, that is not enough. We find it useful to treat the CoA section of the quality agreement as a data quality agreement in its own right.

What the CoA Section Should Specify

Distributors and Repackers

Distributors deserve their own attention. ICH Q7 section 17.6 expects agents, brokers, traders, distributors, repackers, and relabelers to pass on quality information from the original manufacturer, provide the name of the original manufacturer and the batch numbers supplied, and meet the section 11.4 CoA expectations.³ The IPEC CoA guide notes that an additional CoA should be issued when a distributor performs additional testing, and that repackaging requires both the original manufacture date and the dates of later steps for full traceability.⁸ Write those expectations into the agreement with the distributor, and confirm on receipt that they were met.

Keeping the Agreement Connected to the Data

A quality agreement that is filed in a document management system and never checked against actual CoAs does little. The practical link is simple: the required fields listed in the agreement should be the same fields your receipt checklist or structured intake validates. When the agreement changes, the checklist changes under the same change control. When a supplier repeatedly misses a clause, the defect log from receipt gives you the evidence to raise it at the next business review.

Measuring and Governing CoA Data Quality Over Time

The EU excipient guidelines, as adopted by PIC/S, expect ongoing risk review of excipient suppliers through measures such as the number of defects in batches received, the type and severity of those defects, monitoring and trend analysis of excipient quality, observed changes at the manufacturer, and re-audits.⁹ WHO’s GMP guidance for excipient manufacturers, updated in 2024, expects test results to be incorporated into a certificate of analysis and a record of analysis kept for traceability.¹⁰ Both sides of the relationship are expected to produce and use evidence. A small set of measures lets you do this without building a large program.

Who Owns CoA Data Quality

CoA data quality tends to fall between functions. Supplier quality owns the supplier relationship and the quality agreement. Incoming quality control owns receipt and testing. Procurement owns the commercial relationship and often the supplier portal. IT owns the LIMS and ERP. Each group sees part of the problem. We recommend naming one owner for CoA data quality, usually in supplier quality, with a clear definition of the required fields, the receipt checks, the defect categories, and the measures above. That owner does not do all the work, but does hold the definitions and reports on them.

Connecting CoA Data to Supplier Review

Supplier performance reviews usually focus on delivery performance, complaints, and audit findings. Add CoA measures to that review. A supplier with good delivery performance and frequent CoA corrections is a supplier whose data you should rely on less. Conversely, a supplier with a long record of complete CoAs and strong confirmatory agreement is a good candidate for structured data exchange, because the data is worth automating. This is where supplier quality and data governance meet: the same evidence supports a GMP decision about reduced testing and an investment decision about digital integration.

Preparing CoA Data for Wider Use

BioPhorum’s work stresses designing CoA data exchange so the data can serve secondary uses such as predictive analytics, not only lot release.¹³ Many companies want to use supplier data to understand how raw material variability affects process performance and product quality. That analysis is only as good as the CoA data behind it. Values that were never captured, results stored as “conforms,” test names that differ by supplier, and missing original manufacturer information all limit what can be learned later. Receipt is the easiest point at which to get CoA data right.

Conclusion

Certificate of analysis data quality is not a new requirement. The US regulation, ICH Q7, Health Canada’s guide, and the EU excipient guidelines have asked for the same things for years: test identity yourself, prove the supplier’s numbers are reliable before you depend on them, keep proving it, and know where your materials came from. What has changed is how much depends on the data. CoA values now feed release decisions, reduced testing programs, supplier reviews, and the process analytics that many companies hope to build. The DEG and EG history and the steady flow of warning letters show what happens when a CoA is trusted without that work. The practical path is clear: define a complete CoA as a set of fields, check every one on receipt, capture the values as data, schedule confirmatory testing in your systems, write the expectations into the quality agreement, and measure supplier performance on data as well as delivery.

Sakara Digital works with pharma and biotech organizations on the supplier quality and data management work that makes incoming material data reliable, from defining CoA data requirements and receipt checks to planning structured data exchange with key suppliers. If you are reviewing a reduced testing program or trying to get more value from the supplier data you already receive, we are glad to talk through where to start.

For Further Reading