1What ICH Q7 requires.
Section 11.4 of ICH Q7, Good Manufacturing Practice Guide for Active Pharmaceutical Ingredients, Step 4 of 10 November 2000, sets out what a certificate of analysis shows. It applies to intermediates and APIs, and FDA publishes it as guidance for industry.¹² Q7 says “authentic Certificates of Analysis should be issued for each batch of intermediate or API on request”, and sets what they show.¹
| Q7 section | What the certificate shows |
|---|---|
| 11.41 | The name of the intermediate or API, its grade where appropriate, the batch number and the date of release |
| 11.41 | The expiry date, on the label and the certificate, for material with one; the retest date, on the label and/or the certificate, for material with a retest date |
| 11.42 | Each test performed under compendial or customer requirements, with its acceptance limits and the numerical results obtained, where results are numerical |
| 11.43 | The date and signature of authorised personnel of the quality unit |
| 11.43 | The name, address and telephone number of the original manufacturer, or of the repacker or reprocessor that did the analysis, with a reference to the original manufacturer |
| 11.44 | For new certificates issued by repackers, agents or brokers: the laboratory that performed the analysis, the original manufacturer and a reference to the original batch certificate, “a copy of which should be attached” |
Agents, brokers, traders, distributors, repackers and relabellers are held to the same section 11.4 requirements (17.63), and for traceability should retain all authentic certificates of analysis, including the original manufacturer’s (17.20).¹
2WHO’s model certificate.
WHO publishes a model CoA for quality control laboratories and for trade in starting materials and finished products, first in 2002 and currently as Annex 4 of Technical Report Series No. 1010 (2018). It describes a CoA as listing “tests performed on a particular sample with the results obtained and the acceptance criteria applied, followed by an indication of whether or not the sample complies with the specification”.³ Its list covers:³
- the name and address of the issuing laboratory, a CoA identification number, and on each page the page number and total pages;
- who requested the analysis, the laboratory’s sample registration number, the date received and the quantity;
- the product name and description, such as dosage form, strength, grade and primary packaging, its batch number, expiry or retest date and date of manufacture if available;
- the original manufacturer’s name and address, and the repacker’s or trader’s where they supplied it;
- the specifications and test procedures used, with the acceptance limits;
- the results of all tests performed, in numerical form where applicable, compared with the limits, with tests done by subcontractors identified as such;
- any comments needed to interpret the results;
- a conclusion on whether the sample is within specification; and
- the date and signature of the head of the laboratory or another authorised person.
WHO adds that the format is at the issuing laboratory’s discretion, that the model “is intended to serve as an example and not to be prescriptive”, and that local legal requirements should also be considered. It says the guidance is designed mainly for quality control laboratories not related to manufacturers, since a manufacturer’s laboratory may hold some of the information in other quality system documents. A statement of measurement uncertainty is included where relevant or if the customer asks, and laboratories accredited to ISO/IEC 17025 should reference the accreditation.³
3Every result belongs on it.
A CoA reports results; it does not choose among them. FDA’s OOS guidance says that when an investigation finds no laboratory error, “all test results, both passing and suspect, should be reported”, including on certificates of analysis. When a contract laboratory’s investigation finds no assignable cause, “all test results should be reported to the customer on the certificate of analysis”.² MHRA’s OOS guidance says the same for all QC documents and any CoA.⁴
4When you can rely on a supplier’s CoA.
A CoA can reduce incoming testing, never remove it.
| What you must still do | When you can rely on the CoA | |
|---|---|---|
| US, 21 CFR 211.84(d) | At least one identity test on each component, using a specific identity test if one exists | When you establish “the reliability of the supplier’s analyses through appropriate validation of the supplier’s test results at appropriate intervals” |
| EU GMP Chapter 5, 5.35 to 5.36 | Identity testing of each batch according to Annex 8 | When outsourcing is justified, the supplier’s testing site is audited at risk-based intervals, the CoA is signed by a designated, qualified person, and a full analysis is repeated at risk-based intervals |
| ICH Q7, 7.30 to 7.31 | At least one identity test on each batch | When suppliers are evaluated, full analyses have been run on at least three batches, and full analysis is repeated at intervals to compare with the CoA |
Sources: 21 CFR 211.84; EU GMP Chapter 5; ICH Q7.⁵⁶¹
For containers and closures, US CGMP accepts a supplier’s “certificate of testing” with at least a visual identification by the manufacturer, which must still validate the supplier’s results at appropriate intervals.⁵ In the EU, the signature on a starting material CoA “assures that each batch has been checked for compliance with the agreed product specification”. If a full analysis finds a discrepancy, it is investigated, and acceptance of the supplier’s certificates “should be discontinued” until the measures are complete.⁶
5Building confidence in a CoA.
EMA’s GMP data integrity Q&A asks how a contract giver can build confidence in a CoA from a supplier. The recipient “should have knowledge of the systems and procedures implemented at the supplier for the generation of the CoA”, arrangements should ensure significant changes to those systems are notified, and those arrangements should be reviewed periodically. Because a CoA is summary data, reviewing data integrity at the supplier, for example during an on-site audit, “takes on even greater significance”.⁷
Within your own laboratory, EU GMP Chapter 6 expects test records to reference any certificates of analysis used, and testing reports or certificates of analysis to be readily available to quality control (6.7, 6.17).⁸
6How it runs in Seal.
When you issue certificates, Seal prepares the CoA from reviewed results, the applicable specification and a versioned template, so each value keeps its method, specification and reportable-value rule. A result still under review keeps the certificate in draft rather than being filled with an assumed value, and issue, delivery and amendment keep their own history.
When you receive them, Neil reads each supplier certificate and keeps every value with the words it came from, and code compares it with your limits, the ERP’s lot and expiry, and the results of earlier lots. Neil can also check a certificate of analysis against your material specification and flag mismatches or missing tests. Quality releases, holds or rejects the lot; Neil does not qualify the supplier or release the material.
References
- 1ICH Q7, Good Manufacturing Practice Guide for Active Pharmaceutical Ingredients, ICH, Step 4, 10 November 2000. https:/
/ database. ich. org/ sites/ default/ files/ Q7%20Guideline. pdf (read 6 November 2026) - 2Investigating Out-
of- Specification (OOS) Test Results for Pharmaceutical Production, Guidance for Industry, Revision 1, FDA, May 2022. https:/ / www. fda. gov/ media/ 158416/ download (read 6 November 2026) - 3Model certificate of analysis, WHO Technical Report Series No. 1010, Annex 4, WHO, 2018. https:/
/ cdn. who. int/ media/ docs/ default- source/ medicines/ norms- and- standards/ guidelines/ quality- control/ who- model- certificate- of- analysis. pdf (read 6 November 2026) - 4Out of Specification and Out of Trend Investigations, MHRA, October 2017, published on GOV.UK as Out-
of- specification investigations. https:/ / www. gov. uk/ government/ publications/ out- of- specification- investigations (read 6 November 2026) - 521 CFR 211.84, Testing and approval or rejection of components, drug product containers, and closures, eCFR. https:/
/ www. ecfr. gov/ current/ title- 21/ chapter- I/ subchapter- C/ part- 211/ subpart- E/ section- 211. 84 (read 6 November 2026) - 6EudraLex Volume 4, Part I, Chapter 5: Production, sections 5.35 and 5.36, European Commission, in operation from 1 March 2015. https:/
/ health. ec. europa. eu/ system/ files/ 2016- 11/ chapter_ 5_ 0. pdf (read 6 November 2026) - 7Guidance on good manufacturing practice and good distribution practice: questions and answers, Data integrity, question 20, EMA. https:/
/ www. ema. europa. eu/ en/ human- regulatory- overview/ research- development/ compliance- research- development/ good- manufacturing- practice/ guidance- good- manufacturing- practice- good- distribution- practice- questions- answers (read 6 November 2026) - 8EudraLex Volume 4, Part I, Chapter 6: Quality Control, European Commission, in operation from 1 October 2014. https:/
/ health. ec. europa. eu/ document/ download/ c74c8720- 27bf- 4252- 808f- d65a206a90bb_ en?filename=2014- 11_ vol4_ chapter_ 6. pdf (read 6 November 2026)
AQuestions and answers
Who should sign a certificate of analysis?
ICH Q7 says authorised personnel of the quality unit. EU GMP expects a starting material supplier’s CoA to be signed by a designated person with appropriate qualifications and experience. WHO’s model has the head of the laboratory or another authorised person sign and date it.
Can you release a material on the supplier’s CoA alone?
No. US CGMP, EU GMP and ICH Q7 all require at least an identity test on each batch or component by the manufacturer. ICH Q7 exempts some materials, such as processing aids and hazardous or highly toxic raw materials, where the manufacturer’s CoA shows they conform to specification, and the lack of on-site testing is justified and documented.
Does a CoA have to show numerical results?
Yes, where the test gives a number. ICH Q7 asks for the numerical results obtained, and WHO’s model asks for results in numerical form where applicable, compared with the acceptance limits. A bare “complies” is not enough for a numerical test.
How often should you verify a supplier’s CoA?
At intervals you justify by risk. ICH Q7 expects full analyses on at least three batches before you reduce in-house testing, then full analysis at appropriate intervals to compare with the certificates. EU GMP adds that a discrepancy suspends acceptance of that supplier’s certificates until it is resolved.
Should a CoA state measurement uncertainty?
Only where it is relevant to the result or the customer asks for it. WHO notes that pharmacopoeial limits already take uncertainty into account, and that neither pharmacopoeias nor regulators require the expanded uncertainty to be stated for compliance testing.