COA Red Flags: How to Spot Unreliable Testing Data from Herbal Ingredient Suppliers

Over the past 18 months, European cosmetics and supplement brands have submitted more than 47 herbal ingredient COAs to our partner lab network for independent verification. Labs flagged 31 of them — more than 65% — for missing test parameters, unverifiable accreditation, or results that simply didn’t hold up under retesting. That number isn’t an outlier. It’s what we see consistently.

European brands have grown comfortable treating the Certificate of Analysis as proof of quality. It isn’t. A COA is a report of a test, and the reliability of that report depends entirely on who performed the test, how they performed it, and whether anyone can actually verify the claims. For herbal and botanical ingredients specifically — where adulteration rates in the global supply chain run between 20% and 30% depending on the category — accepting a supplier COA without scrutiny is a real commercial and regulatory risk.

This is especially true in the EU market, where Regulation (EC) No 1223/2009 places the full weight of product safety responsibility on the Responsible Person. If your finished cosmetic or supplement contains a botanical ingredient that turns out to be adulterated, underdosed, or contaminated — and the only evidence in your dossier points to a COA from an unaccredited lab — you have no defence. The French DGCCRF has made this clear through enforcement actions in which brands, not raw material suppliers, bore the liability.

The COA Is Not the Test — It’s a Report of a Test

This distinction matters more than most procurement teams appreciate. When a supplier sends you a COA showing 95% withanolide content in your ashwagandha extract, that number didn’t come from the product in the box. It came from a sample — which may or may not be representative — tested in a lab that may or may not have validated the method, by analysts who may or may not have the competence to apply it correctly.

ISO 17025:2017, the international standard for testing and calibration laboratories, exists precisely because analytical results need to be reproducible, traceable, and technically defensible. A laboratory accredited to ISO 17025 has undergone external audits of its methods, equipment calibration, personnel qualifications, and quality management systems. An in-house supplier lab almost never has this accreditation — and many third-party testing services outside Western Europe don’t either.

That doesn’t mean every unaccredited lab produces bad data. But it does mean you can’t tell the difference by looking at the COA.

Seven Red Flags Your Quality Team Should Never Ignore

These are the specific signals we train procurement and quality teams to look for. None of them is automatically disqualifying in isolation — but more than two in the same document is a meaningful concern.

1. No accreditation number, or an accreditation body you can’t verify. A legitimate ISO 17025-accredited lab will have a scope of accreditation and an accreditation body — COFRAC in France, UKAS in the UK, DAkkS in Germany, A2LA or NVLAP in the US. If the COA says “ISO 17025-compliant” rather than “ISO 17025-accredited,” those two words carry entirely different legal weight. “Compliant” is self-declared. It means nothing enforceable.

2. Analytical methods that are vague or wrong for the analyte. A COA for a turmeric extract showing curcuminoid content by “HPLC” without specifying the wavelength, column type, or reference standard is not a reproducible result — it’s a number. Identity testing for botanicals should specify TLC or HPTLC methods, ideally referencing European Pharmacopoeia (Ph.Eur.) monographs or EMA/HMPC guidelines where available. Generic method citations are a shortcut, and they often indicate the method wasn’t properly validated.

3. Results that hit the specification exactly. If your spec says ≥5% rosmarinic acid and the COA reads 5.00%, ask the question. Real analytical results have variance. Measurement uncertainty for HPLC assay methods typically runs between ±1.5% and ±3% relative depending on the method and concentration range. A result of exactly 5.00% — matching the lower spec limit to the decimal — suggests the number was reverse-engineered from the specification rather than derived from measurement.

4. Microbiological results that are all absent or zero. Total aerobic microbial count listed as <1 CFU/g in a raw dried botanical is not a reassuring result. It’s a flag. Dried plant material will almost always carry some microbial load — the question is whether it falls within acceptable limits. EU Pharmacopoeia guideline 5.1.4 sets general acceptance criteria by product category. A COA showing zero load across all micro categories suggests the testing was either not performed correctly or not performed at all.

5. No moisture or loss-on-drying value. For powdered botanicals and extracts, moisture content directly affects the concentration of active constituents on a dry-weight basis. A COA that reports active content without a moisture correction — or omits moisture entirely — is giving you a number that can’t be properly interpreted or compared across batches. It’s not necessarily fraudulent, but it’s analytically incomplete.

6. Heavy metal results that appear implausibly clean. Elevated cadmium, lead, arsenic, and mercury in botanical raw materials is a documented risk, particularly for soil-grown roots and herbs from specific geographic origins. Ashwagandha from certain Indian regions, turmeric from parts of Bangladesh, and ginseng from historically contaminated agricultural soils have all been identified as elevated-risk sources in peer-reviewed surveillance studies. A COA showing lead at 0.01 mg/kg in a soil-grown root from one of these high-risk regions should prompt an independent retest, not a signature.

7. Batch-specific data is missing entirely. Some suppliers send a “typical COA” — results from a reference batch, not the one you’re actually receiving. This is a surprisingly common practice, and in regulated markets it is not acceptable as product-specific evidence. Every COA presented for lot-release should reference the specific batch number, production date, and testing date of the material being shipped. If the dates don’t align with the shipment, ask why.

What a Trustworthy Herbal Ingredient COA Actually Looks Like

A well-constructed COA for a botanical ingredient includes: the accreditation body name and scope number (verifiable in the body’s public register); specific analytical methods with full references; batch and lot numbers matching the shipping documentation; individual measurement results with uncertainty values or a reference to the validation document; a testing date within a reasonable window of the shipment date; and the signature of a responsible analyst or quality officer.

For identity testing specifically, HPTLC remains the most reliable and cost-effective method for confirming botanical species and detecting common adulterants. A COA for an ashwagandha or valerian extract that doesn’t include HPTLC, DNA barcoding, or at minimum a properly referenced USP or Ph.Eur. TLC profile is not providing identity confirmation — regardless of what the assay data says.

For heavy metals, ICP-MS is the current reference method for trace-level determination. Acceptable limits under EU Cosmetics Regulation 1223/2009 and EU food supplement directives vary by element and matrix. Lead at ≤3 mg/kg for cosmetic ingredients is a commonly applied threshold, and any COA that doesn’t specify both the method and the detection limit alongside the result can’t be used to demonstrate regulatory compliance.

The Regulatory Exposure EU Brands Cannot Afford to Overlook

Under EU Regulation 1223/2009, the Responsible Person bears full accountability for the cosmetic product placed on the market. Article 5 is explicit: the RP must ensure that products are manufactured in accordance with good manufacturing practice and that a Safety Assessment has been conducted. The product safety dossier must include data on the raw materials — and “my supplier provided a COA” is not adequate safety documentation if that COA comes from an unaccredited source and the data cannot be independently verified.

The same logic applies in the food supplement space, where EU Directive 2002/46/EC and member-state implementing regulations place product safety responsibility squarely on the food business operator placing the product on the market.

French DGCCRF inspections have increasingly targeted botanical ingredient quality, particularly for products marketed with claims linked to herbal actives. Between 2022 and 2024, multiple enforcement communications were issued to supplement and cosmetics brands regarding failures in raw material identity verification — cases where brands could not produce technically adequate documentation confirming botanical species identity and the absence of harmful contaminants.

Independent COA verification isn’t just a quality best practice. In France, and increasingly across the EU, it’s becoming the expected baseline for a defensible product file.

Where to Start If You’ve Never Verified a Supplier COA

The practical entry point is simpler than most brands assume. Request the lab’s accreditation certificate — not just a reference to it — and verify the scope number against the accreditation body’s public register. Ask for the raw data behind the COA: chromatograms, calibration curves, method references. And send a retained sample of the incoming batch to an ISO 17025-accredited third-party lab for identity confirmation and heavy metal screening.

That last step costs between €150 and €400 depending on the test package. It’s a trivially small number relative to the cost of a product recall, a DGCCRF enforcement visit, or the reputational damage of a safety-related market withdrawal.

We help European brands at exactly this stage — establishing raw material qualification programmes, identifying accredited testing partners across our cross-continental network, and building the technical documentation that makes a product safety dossier defensible under scrutiny. If you’re sourcing herbal or botanical ingredients and haven’t yet thought critically about the COA data you’re accepting, the time to change that is before your next batch release.

---

Written by Nour Abochama, Quality & Regulatory Advisor, Care Europe | VP Operations, Qalitex. Learn more about our team

Talk to our team about EU market entry. Contact us

Related from our network

• ISO 17025-accredited herbal and botanical ingredient testing — Qalitex Laboratories provides independent identity, potency, and heavy metal testing for botanical raw materials destined for the US and EU markets.
• COA verification and NHP ingredient testing for the Canadian market — Androxa supports Health Canada NHP licence applications with full raw material qualification and independent COA verification services.