The law asks for one. It never says what makes it valid.
What do the statutes and FDA say?
Two statutes, one FDA policy and one state rule. Each requires the certificate; only California lists what is on it.
| Source | Its words | Applies to |
|---|---|---|
| 21 U.S.C. 353a(b)(1)(A)(iii) | Bulk drug substances "that are accompanied by valid certificates of analysis for each bulk drug substance". | A 503A pharmacy |
| 21 U.S.C. 353b(a)(2)(D) | "the bulk drug substances are each accompanied by a valid certificate of analysis." | A 503B outsourcing facility |
| FDA interim policy, 503A (January 2025) | The bulk drug substance "must be accompanied by a valid certificate of analysis (COA)" (p. 3); and "Original manufacturer means the entity that originally produced the bulk drug substance and not a subsequent packer, repacker, labeler, or distributor" (p. 13). | FDA's reading for 503A; its 503B policy says the same |
| 16 CCR 1736.9(d), California | A certificate "that includes the compendial name, the grade of the material, and the applicable compendial designations" must be received and evaluated before use, and one from a supplier "must provide the name and address of the manufacturer". | Sterile compounding in California |
The statutes name the certificate as one of three conditions on a bulk substance: it meets the monograph where one exists, its maker is registered with FDA, and it comes with a valid certificate. The elements below are what the rest of the sources add to the word valid.
23 elements, five groups. Each with the source it rests on.
What does a valid certificate carry?
Read top to bottom, this is a certificate's own content first, then what has to be checked outside it.
| Element | How a certificate shows it | Where it comes from |
|---|---|---|
| The lot and the substance 5 elements | ||
| One certificate for this lot | Titled a certificate of analysis, and printing the lot number that is on the container and the receiving record. | 21 U.S.C. 353a(b)(1)(A)(iii), 353b(a)(2)(D); ICH Q7 11.40 |
| The substance named exactly | The name with its salt and form, for example "Naltrexone Hydrochloride USP", so the 503A and 503B lists can be read for it. | ICH Q7 11.41; WHO model certificate |
| A grade fit for a drug | A pharmacopoeial or pharmaceutical grade, and never a food, technical or dietary supplement grade, or a statement such as "not for human use" or "research use only". | ICH Q7 11.41; FDA notice of August 27, 2026; 16 CCR 1736.9(d) and (e) |
| The batch number, and the maker's own on a reissued certificate | The lot number; on a distributor's certificate, the original manufacturer's batch number as well. | ICH Q7 11.41 and 17.61; WHO model certificate |
| A certificate number | An identification number for the certificate itself. | WHO model certificate |
| Dates and pages 4 elements | ||
| A date of release | The release date, or the date beside the signature. | ICH Q7 11.41 and 11.43 |
| An expiry or retest date | An expiry date, or a retest date where the substance carries one. | ICH Q7 11.41; FDA draft 503B CGMP guidance (2020) |
| A date of manufacture, where known | The date of manufacture; on a repacked lot, both the original date and the repack date, in a possible order. | WHO model certificate; IPEC certificate guide (paraphrased) |
| Every page | Each page numbered with the total, for example "Page 1 of 2", and every numbered page in the file. | WHO model certificate; IPEC certificate guide (paraphrased) |
| Who made it, tested it and signed it 5 elements | ||
| The original manufacturer named | The firm that made the final purified substance, not the seller, a distributor, a repacker or a firm that only milled or micronized it. | ICH Q7 11.43 and Q&A 17.4; FDA interim policies (January 2025); 16 CCR 1736.9(d) |
| Its address and telephone | The street address of the manufacturing site, and a telephone number in the maker's block. | ICH Q7 11.43 and 11.44; WHO model certificate; 16 CCR 1736.9(d) |
| A reissued certificate points back | On a certificate reissued by a repacker, agent or distributor: the laboratory that tested the lot, the original manufacturer, and a reference to the original batch certificate, with a copy of it attached. | ICH Q7 11.43, 11.44 and 17.63; WHO model certificate |
| Signed for the quality unit | A named, authorized signer from quality assurance or quality control, and a date, or an electronic signature traceable to a person. | ICH Q7 11.43 and its glossary; WHO model certificate |
| The testing laboratory | The laboratory's name and address, results a subcontractor produced marked as such, and any ISO/IEC 17025 accreditation referenced. | WHO model certificate; ICH Q7 11.44 |
| The results 6 elements | ||
| Each test, its limit and its result | A table of every test performed, its acceptance limit and its result as a figure where the test is numerical, not only "conforms". | ICH Q7 11.42; WHO model certificate |
| The method | A reference to the method or the compendium each test followed. | ICH Q7 11.42; WHO model certificate |
| A conclusion | A statement of whether the results are within the specification. | WHO model certificate |
| The monograph, where one exists | A statement that the lot meets the current USP or NF monograph, where one exists. | 21 U.S.C. 353a(b)(1)(A)(i)(I), 353b(a)(2)(B) |
| Published limits that apply whatever is printed | Residual solvents, elemental impurities (FDA says USP <232> and <233> replaced <231>), microbial counts and endotoxin, where they apply. | FDA guidance on elemental impurities (2018); ICH Q3C and Q3D |
| Diethylene and ethylene glycol, for high-risk excipients | For glycerin, propylene glycol and the other components FDA names, each at not more than 0.10%. | FDA guidance on DEG and EG testing (May 2023, Revision 1) |
| Outside the certificate, and across certificates 3 elements | ||
| The maker is registered with FDA | Not printed on the certificate: found in FDA's establishment registry under the name or FEI printed. Under the interim policies, every later manufacturer too. | 21 U.S.C. 353a(b)(1)(A)(ii), 353b(a)(2)(C); FDA interim policies (January 2025) |
| It agrees with every other certificate for the lot | The same values on every document that covers the same lot. | ICH Q7 11.40 and 17.20 |
| For a 503B: the facility's own checks | An identity test of its own on each lot, and the supplier's results confirmed at intervals, with the maker's name and location carried into the receiving record. | 21 CFR 211.84(d)(1) and (d)(2); 21 CFR 211.184(a) |
The IPEC excipient guide is paraphrased, not quoted, because its terms forbid reproduction. No USP text is reproduced. Where an element rests on guidance rather than a statute or regulation, the next section says what that means.
Binding, guidance or a model. Each weighs differently.
How much does each source weigh?
Not every element binds every pharmacy. The source decides.
The statutes and regulations bind. 21 U.S.C. 353a and 353b, and for an outsourcing facility 21 CFR 211.84 and 211.184. A 503A pharmacy is exempt from the drug CGMP adulteration provision, so Part 211 binds a 503B, not a 503A.
FDA guidance is how FDA reads the word. The interim policies, the draft 503B CGMP guidance and FDA's notices. FDA's guidance says of itself that it contains nonbinding recommendations; it is still the reading an inspector brings.
ICH Q7 is FDA guidance too. FDA publishes it as its guidance for industry on active pharmaceutical ingredients, and its section 17 covers agents, brokers, distributors and repackers, so its section 11.4 on certificates reaches the certificate a supplier hands on.
The WHO model and the IPEC guide are models. Persuasive, widely used, and binding on no one. Page numbering and a certificate number come from them.
A state can add its own. California's sterile rule is the only enumerated list in a regulation. Other states may differ; read your own board's rule.
Ten questions for one certificate. An answer or a named gap.
How do you check a certificate against this standard?
Ask each question of the certificate in your hand. A certificate meets the standard when each has an answer, or the gap is named and asked of the supplier.
- The lot
Does it print the lot number on the container, and name the substance with its salt and form?
- The grade
Does it state a grade fit for a drug, with no restriction on human or drug use?
- The maker
Does it name the original manufacturer, with an address and a telephone, and not only the seller?
- The registration
Is that maker registered with FDA under the name or FEI printed?
- The dates
Does it carry a release date and an expiry or retest date that has not passed?
- The pages
Is every page it numbers in the file?
- The signature
Is it signed and dated by a named person for the quality unit?
- The results
Does each test show its limit, its method and its result as a figure?
- The monograph
Where a USP or NF monograph exists, does it say the lot meets it?
- The chain
If a distributor or repacker issued it, does it point to the original certificate, and is that certificate on file?
Veritura's own certificate read follows this list; the methodology names each check it runs and what it does not.
Free to copy, share and adapt. With credit.
May I reuse this standard?
Yes. This standard is published under the Creative Commons Attribution 4.0 International licence (CC BY 4.0).
Anyone may copy, share and adapt it, in any medium, including commercially, provided they credit "Veritura, Valid Certificate of Analysis Standard VTR-COA-20261021", link to this page and the licence, and say if they changed it. The licence text is at creativecommons.org/licenses/by/4.0. The statutes, regulations and FDA documents it quotes are US government works; the ICH and WHO texts keep their own terms.
Version 1, October 21, 2026. A new version follows new FDA guidance or a change in the sources, with the changes listed here.
Documentation evidence only. This standard describes what a certificate carries. It does not say a substance may be compounded, test material, grade a medicine or replace the pharmacist's judgment.
Read your own certificate against it.
Drop a certificate on the tools page with no account. Nothing you upload is kept.