What this is
What is a certificate of analysis review?
What is a certificate of analysis review?
A certificate of analysis review checks the certificate supplied with a specific delivery against the material specification agreed with the supplier. It confirms the document itself is genuine and complete, then checks each reported result against the target and tolerance, before the material is released for use.
How is a certificate of analysis review different from a material specification record?
The specification is the standard, agreed once and updated when requirements change. The review is the check, carried out on every delivery that requires one, against the standard already in force. A certificate of analysis review with no specification to check against has nothing to verify.
Who carries out a certificate of analysis review?
The receiving inspector, at or shortly after delivery, before the material is used. Quality signs off the outcome, particularly where the certificate is rejected or the material is held, but the first read of the document happens at the point of receipt.
Scope
When is a certificate of analysis review required?
This review is one step in the Supplier Quality Assurance programme, and it depends entirely on a material specification record already existing to check against.
Use this template when
- A delivery has arrived for a material that requires a certificate of analysis under its specification
- A certificate has been received and needs checking before the material is released for use
- A previous review flagged a concern and a follow-up check is needed against the same or a related delivery
- Independent verification testing is due and its result needs comparing against the supplier's certificate
- A linked record needs this one to exist: links vendor, specification
Do not use it for
- Material Specification Record, which sets the tolerances, test methods and reporting requirements this review checks against, and is not where they should be defined or amended.
- Incoming inspection, which is the physical and organoleptic check of the delivered material itself, separate from checking the paperwork that accompanies it.
- Supplier Audit, which examines the supplier's site and laboratory arrangements rather than one delivery's certificate.
- Supplier Corrective Request, which is raised when this review, or a pattern across several reviews, shows the supplier's certificates cannot be relied on.
- Anything outside KnowQuality, which belongs in the workspace that owns that process
Compliance mapping
Which ISO 9001 cl.8.4.3 requirements does this satisfy?
ISO 9001 requires that externally provided material be verified against the requirements communicated to the supplier, and treats the release of nonconforming output as something to be controlled rather than discovered afterwards.
| Clause | Requirement | Where it lands |
|---|---|---|
| ISO 9001 cl.8.4.3 | Verify that externally provided product meets the requirements previously communicated to the external provider | Document check |
| ISO 9001 cl.8.6 | Verify at appropriate stages that product and service requirements have been met before release | Results against specification |
| ISO 9001 cl.8.7 | Identify and control output that does not conform to requirements, so it is not released unintentionally | Outcome |
| BRCGS Food Safety cl.3.5 | Specifications verified through a defined process, including certificate checks and periodic independent testing | Verification |
| Codex Alimentarius CXC 1-1969 | Incoming material accepted only where it meets the acceptance criteria specified for it | Header |
| ISO/IEC 17025 | Testing laboratories operate to a recognised competence standard, which is what accreditation is confirming | Document check |
What it does not cover
- Material Specification Record, which sets the target, tolerance, test method and reporting requirement this review checks a delivery against, and is written before the first order rather than at receipt.
- Incoming inspection, which is the physical check of the delivered material itself, beyond confirming its paperwork.
- Supplier Audit, which examines the supplier's site and the laboratory arrangements behind the certificates it issues.
- Supplier Corrective Request, which is the corrective action raised when a certificate, or a pattern of certificates, cannot be relied on.
- The hold record itself, which segregates and dispositions the physical stock once this review has decided a hold is needed.
Global
Certificate of Analysis Review requirements by country
Certificate verification sits inside food safety scheme and management system requirements rather than a standalone certification law, but the standard against accreditation is checked is genuinely international.
FSMA preventive controls (21 CFR 117) supply-chain program verification
Approved suppliers must be verified against the hazard identified for the material, with verification activities including certificate of analysis review and periodic testing.
Verification cannot be reduced to filing the certificate; the preventive control requires evidence that its content was actually checked.
BRCGS Global Standard for Food Safety
Specifications are verified through a documented process, including certificate review at a defined frequency and periodic independent testing to confirm they remain reliable.
An auditor examines whether independent verification testing has actually been carried out on schedule, not only whether the certificate review log is complete.
ISO 9001 cl.8.4 and ISO/IEC 17025
Externally provided material must be verified against communicated requirements, and the competence of the testing laboratory behind any certificate is itself a defined standard.
A certificate from a laboratory without accreditation to a recognised standard carries materially less evidential weight, whatever the numbers on it say.
How to complete it
How to complete a certificate of analysis review, step by step
The document check and the results table prompt for most of what a reviewer needs to look at. What decides whether the review is worth anything is how sceptically those prompts are actually answered.
An unaccredited laboratory or a test date that predates the batch invalidates the certificate regardless of how the reported results compare to specification. These checks exist precisely so a reviewer does not have to take the numbers on trust once they have failed.
A result within tolerance is not automatically a clean result. A parameter that lands at the same limit on every delivery, batch after batch, describes a certificate that is copied or rounded to fit, not a process producing genuine variation.
Testing only when a certificate already looks wrong only ever confirms what was already suspected. Testing on a genuine schedule, regardless of how the certificates read, is the only way to learn whether the certificates that look fine actually are.
A material released because releasing is the default needs the same reasoning trail as one that is held: what was checked, what it showed, and why that result supports the decision taken. An outcome recorded without that reasoning is not defensible after the fact, whichever way it went.
What auditors find
Most common certificate of analysis review findings
A certificate of analysis review almost always exists for deliveries that require one. The findings concern whether the document was genuinely interrogated, and whether the outcome actually followed from what was found.
| Finding | Clause | What fixes it |
|---|---|---|
| Certificate accepted from a laboratory that is not named, or not confirmed accredited. | ISO/IEC 17025 | Reject the certificate at the document check stage; do not proceed to comparing results against specification. |
| Material used or released before the certificate of analysis was actually reviewed. | ISO 9001 cl.8.6 | Hold material by default until the review is complete; treat use before review as a control failure, not a timing issue. |
| Reported results sit at the same limit across multiple consecutive deliveries. | BRCGS Food Safety cl.3.5 | Flag the pattern and schedule independent verification testing rather than accepting each certificate individually. |
| Independent verification testing never carried out, or carried out but never compared against the certificate. | BRCGS Food Safety cl.3.5 | Record the comparison explicitly; a verification test that is not compared against the certificate verifies nothing. |
| Batch number on the certificate does not match the delivery, and the discrepancy was not queried. | ISO 9001 cl.8.4.3 | Query any mismatch with the supplier before release; do not assume the certificate simply refers to the correct batch. |
| Product marked as affected but no hold record raised, or the reverse. | ISO 9001 cl.8.7 | Raise the hold record at the point affected product is identified, and reference it from the review rather than describing the hold in free text. |
Case in point
Case in point: the certificate that was always exactly on the limit
A snack manufacturer's water activity specification had a tolerance of 0.02 either side of target. For fourteen consecutive deliveries from one supplier, the certificate reported a result exactly at the upper edge of that tolerance. Each certificate individually passed the review: the laboratory was named and accredited, the batch matched, the result was within specification, and the marginal field was answered honestly as at the limit rather than comfortably within.
No single review raised a hold, because no single certificate failed. It took a new receiving inspector, working through the file for an unrelated audit, to notice that fourteen results identical to two decimal places looked less like a controlled process and more like a number that was never actually re-measured. Independent verification testing, requested for the first time in over a year, returned a result outside specification. The corrective action was not a stricter tolerance; it was scheduling independent testing regardless of how clean the certificates looked, because clean was exactly what a copied certificate would also show.
The template
The template, field by field
The form exactly as it installs. Every field, option, score and conditional rule is editable, and the links to other templates come with it.
5 sections
- Reference
- QUA-044
- Archetype
- Review
- Record ID
- COA-2026-000
- Scoring
- Pass or fail
- Direction
- High is good
- Singleton
- No
- Basis
- ISO 9001 cl.8.4.3
- Links
- Links Vendor, Spec
- Tags
- Supplier, Quality
- Sections
- 5
- Fields
- 38
- Follow up fields
- 5
- Repeating sections
- 1
- Links out
- 5
Header
11 fieldsReview ID*
Auto sequence. Format COA-2026-0000.
The record's own ID. Other templates point at this value.
Status*
Drives who this goes to next.
- Planned2 pts
- In progress2 pts
- Complete3 pts
- Deferred0 pts
- Open0 pts
- Closed3 pts
- Overdue0 pts
Date*
Completed By*
Supplier*
Vendor ID*
Format VEN-0000.
Links to FDN-005 Vendor ID
Material*
Supplier Batch*
Delivery Date*
Specification ID*
Links to QUA-043 Spec ID
Inspection ID
Links to QUA-011 Inspection ID
Document check
8 fieldsCOA Received*
- Yes3 pts
- No0 pts
Received Before Use*
- Yes3 pts
- No0 pts
Batch On COA Matches Delivery*
- Yes3 pts
- No0 pts
Issued By Named Laboratory*
- Yes3 pts
- No0 pts
Laboratory Accredited*
- Yes3 pts
- No0 pts
Signed Or Authorised*
- Yes3 pts
- No0 pts
All Specified Parameters Reported*
A COA that omits the parameter you care about is not a COA.
- Yes3 pts
- Partly1 pt
- No0 pts
Test Dates Plausible*
Results dated before the batch was made is a fraud indicator.
- Yes3 pts
- Questionable0 pts
Results against specification
Repeats5 fieldsParameter*
Specification*
Reported Result*
Within Specification*
- Yes3 pts
- Borderline1 pt
- No0 pts
Marginal
Results consistently at the same limit suggest a rounded or copied certificate.
- No, comfortably within3 pts
- Yes, at the limit1 pt
Verification
2 fieldsIndependent Verification Testing Done*
Periodic independent testing is how you find out whether the certificates are real.
- Yes3 pts
- Not this period1 pt
- Never0 pts
Verification Result Matches COA
- Yes3 pts
- Minor variance1 pt
- No0 pts
Outcome
12 fieldsCOA Acceptable*
- Yes3 pts
- No0 pts
Material Released*
- Yes3 pts
- No0 pts
Product Affected By The COA*
- No3 pts
- Yes0 pts
Quantity Affected
Hold ID
Raise the hold record, then enter its reference.
Links to QUA-003 Hold ID
Product Location
Where the affected product physically is right now.
SCAR Raised
SCAR ID
Links to QUA-042 SCAR ID
Reviewed By*
Signature*
Quality*
Second Signature*
QUA-044 · record IDs look like COA-2026-000 · Links Vendor, Spec
Open in KnowellaRun it with agents
From a document you fill in to a programme that runs itself
The review itself is a document check most people can do correctly. What fails is the follow-through: verification testing that never gets scheduled, and a pattern across deliveries that no single review is positioned to see.
Holds the review history against each supplier and material, and surfaces a pattern of marginal results that no single certificate of analysis review would flag on its own.
Tracks whether independent verification testing is actually being scheduled against its defined frequency, rather than only after a certificate is already in question.
Watches for material used or released ahead of a completed review, and raises the exception rather than letting the review record catch up afterwards.
This template lives in KnowQuality — quality and food safety. HACCP, nonconformance, traceability, laboratory and customer complaints.
Meet KnowQuality→Glossary
Certificate of Analysis Review definitions and key terms
- Certificate of analysis
- The document supplied with a delivery reporting the laboratory's results for the specified parameters against that specific batch.
- Accredited laboratory
- A laboratory assessed as competent to a recognised standard such as ISO/IEC 17025, which is what accreditation status on a certificate is confirming.
- Independent verification testing
- Testing commissioned separately from the supplier's own certificate, used periodically to confirm the certificates can be relied on.
- Marginal result
- A result within specification but sitting at the tolerance limit, which is treated as a distinct finding from a result comfortably inside it.
- Nonconforming output
- Material or a result that does not meet the requirements set for it, and which must be controlled rather than released by default.
FAQ
Frequently asked questions about certificate of analysis review
What should be checked before looking at the reported results?+
The certificate itself: that it was received before use, that it names an accredited laboratory, that the batch matches the delivery, that it is signed or authorised, and that the test dates are plausible for the batch described. A certificate failing any of these should not proceed to a results comparison.
What does it mean if a result is marginal but within specification?+
It passes the immediate check but is a finding worth tracking. A single marginal result may be nothing. A pattern of marginal results at the same limit across multiple deliveries suggests a certificate that is not reflecting genuine process variation.
How often should independent verification testing be done?+
On a defined schedule, not only when a certificate already looks questionable. Testing triggered solely by suspicion only ever confirms an existing concern; it never tells you whether the certificates that look entirely normal are also genuine.
What happens if a specified parameter is missing from the certificate?+
The certificate is incomplete against the specification and the review cannot be marked as satisfactorily complete on that basis alone. A certificate omitting the one parameter that matters most is not a certificate that has partially passed.
Should material be held automatically if the certificate fails the review?+
Yes. A missing or non-conforming certificate is meant to hold the material until resolved, not to be raised as a note while the material continues to be used. Reviewing after use converts the control into a record of what already happened.
When does a certificate of analysis review lead to a corrective request?+
When a single delivery is seriously nonconforming, or when a pattern across several reviews, such as repeated marginal results or a failed independent verification test, shows the supplier's certificates cannot be relied on as issued.
Keep going
Related templates and programmes
Industries this is written for
Programmes this belongs to
Used together in Allergen Management
Product and SKU Register
Holds every product and pack format you make, with its specification, allergens, shelf life and customer
Allergen Changeover Check
Confirms the line is clear of the previous allergen before the next product runs
Glass and Brittle Plastic Register
Lists every item of glass or hard plastic in production areas, with its location and condition
Label Verification Record
Verifies that the label on the line matches the specification for that product, covering allergens, claims, dates and barcodes
Artwork Approval Record
Records approval of new or amended artwork before it is printed, with each checker named
Rework Instruction Record
Sets out how a specific batch is to be reworked, what checks apply and who authorised it
More in Suppliers
Supplier Approval Record
Records the decision to approve a new supplier, with the evidence behind it
Supplier Questionnaire
Collects information about a supplier's systems, certifications and controls
Supplier Audit
Audits a supplier's site against your requirements
Supplier Scorecard
Scores a supplier on quality, delivery, responsiveness and cost over a period
Supplier Corrective Request
Asks a supplier to investigate and fix a problem with their material or service
Material Specification Record
Holds the agreed specification for each material you buy, including tolerances and test methods
Written and reviewed by
Siddarth Singh
Founder & Chief Executive Officer, Knowella
Certified Safety Professional and industrial and systems engineer with more than a decade inside food supply chain, freight and manufacturing operations. This page was written against the current text of the standards it cites, not against secondary summaries of them.
- Certified Safety Professional (CSP), Board of Certified Safety Professionals
- MBA, University of Chicago Booth School of Business
- MS and BS, The Ohio State University, Industrial and Systems Engineering
- Six Sigma Black Belt
Sources and last review. Reviewed 16 August 2026 against:
- ISO 9001:2015 clauses 8.4.3, 8.6 and 8.7
- BRCGS Global Standard for Food Safety, clause 3.5 (specification verification)
- Codex Alimentarius CXC 1-1969, General Principles of Food Hygiene
- ISO/IEC 17025, General requirements for the competence of testing and calibration laboratories
This page is general guidance, not legal advice. Confirm requirements with your jurisdiction’s regulator.