A Certificate of Analysis (COA) is the single most important quality document in the supplement ingredient supply chain. It tells you exactly what's in the batch you're buying — and what's not. Yet many procurement professionals and QA teams admit they don't fully understand how to interpret one.
If you're sourcing food-grade magnesium citrate or magnesium glycinate, knowing how to read a COA is an essential skill. A well-executed COA review can mean the difference between receiving a clean, compliant batch and discovering a problem only after your product reaches the market. This guide walks through every section of a typical COA, explains what the numbers mean, and highlights the red flags you should never ignore.
New to supplier evaluation? Start with our Supplier Evaluation Guide, which covers certifications, testing standards, and the procurement workflow. Then come back here to master the COA.
1. Header Information
Every COA begins with a header block that identifies the product, the batch, and the manufacturer. This section tells you what you're looking at and whether it's the right document for your order.
Header Fields to Verify
- Product name — Must match your purchase order exactly (e.g., "Magnesium Citrate, Food Grade, Anhydrous")
- Batch / lot number — Must correspond to the specific batch you're receiving, not a generic sample
- Manufacture date — Confirms product freshness; check against shelf life claims
- Expiry / re-test date — Typically 24 months from manufacture for magnesium citrate and glycinate
- Manufacturer name & address — Must match the supplier you've vetted; watch for third-party brokers presenting another manufacturer's COA as their own
- Specification reference — Should cite a recognized standard (USP, FCC, or in-house spec with version number)
2. Assay / Potency
The assay confirms the magnesium content of the batch. This is the most fundamental quality measurement — it tells you whether the product contains the amount of active ingredient it claims.
How to Read the Assay
The COA will show three values: the specification (what's expected), the result (what was measured), and a pass/fail status.
- Magnesium citrate — Typical assay: ≥98.0% on anhydrous basis; elemental Mg content ~11–16% depending on hydration form
- Magnesium glycinate — Typical assay: ≥98.0%; elemental Mg content ~14%
- Acceptable variance — Results within ±2% of specification are generally acceptable; anything outside this range warrants investigation
- Method — Look for a recognized compendial method reference (USP <291> for magnesium determination, or titration per FCC)
Does the assay match the spec sheet your supplier provided? If the result is 95% but your specification requires ≥98%, the batch should be rejected — no exceptions.
3. Heavy Metals
Heavy metal testing is the most safety-critical section of the COA. Mineral-based ingredients like magnesium are particularly susceptible to contamination because they're derived from naturally occurring mineral deposits. Here's what to look for:
| Heavy Metal | Typical Spec Limit | Regulatory Reference |
|---|---|---|
| Lead (Pb) | ≤ 1.0 ppm (ideally ≤ 0.5 ppm) | USP <232>, FCC, California Prop 65 |
| Arsenic (As) | ≤ 1.0 ppm (ideally ≤ 0.5 ppm) | USP <232>, FCC |
| Cadmium (Cd) | ≤ 0.5 ppm | USP <232>, FCC |
| Mercury (Hg) | ≤ 0.1 ppm | USP <232>, FCC |
What to Check
- Actual values vs. "Conforms" — Some COAs list "Conforms" without showing the actual measured value. Always request the quantitative result, not just a pass/fail
- Method — ICP-MS (Inductively Coupled Plasma Mass Spectrometry) is the gold standard for heavy metal analysis. Be cautious of older methods like AAS, which have higher detection limits
- Trend across batches — If batch-to-batch heavy metal values are creeping upward, it may indicate a change in raw material sourcing or ore quality at the supplier's end
- California Prop 65 — If you sell in California, ensure lead levels meet the stricter Prop 65 limit (0.5 µg/day exposure), which may require lower ppm values than USP
4. Microbiological Testing
Microbiological testing confirms the product is free from harmful pathogens and within acceptable limits for microbial load. For food-grade magnesium, this section typically includes:
| Test | Typical Spec Limit |
|---|---|
| Total Aerobic Microbial Count (TAMC) | ≤ 1,000 CFU/g |
| Total Yeasts & Molds (TYMC) | ≤ 100 CFU/g |
| Escherichia coli | Absent in 10 g |
| Salmonella spp. | Absent in 25 g |
| Staphylococcus aureus | Absent in 1 g |
| Pseudomonas aeruginosa | Absent in 1 g |
If any pathogen is detected — even at low levels — the batch should be rejected outright. Microbial contamination in a food-grade ingredient is non-negotiable.
5. Physical Properties
Beyond chemistry and microbiology, the COA should report physical characteristics that affect how the ingredient behaves in your formulation:
Physical Parameters
- Appearance — Should match the expected description (white crystalline powder). Discoloration, off-odors, or visible contamination are immediate red flags
- Particle size distribution — Reported as D10, D50, D90 values. For drink powders: D50 of 50–100 µm. For tablets/capsules: D50 of 100–200 µm. Ensure it matches your formulation requirements
- Moisture content — Typically ≤10% for magnesium citrate; ≤5% for glycinate. High moisture indicates poor drying and risks microbial growth or clumping
- Bulk density — Important for capsule filling and packaging calculations. Low bulk density means you need more volume per dose
- pH (in solution) — For magnesium citrate, a 5% solution typically has pH 5.0–7.0. Out-of-range pH may indicate impurities or incorrect composition
- Identification test — Confirms the chemical identity of the material (e.g., positive for magnesium and citrate/glycinate ions)
For a deeper understanding of how physical properties affect your product, see our article on Magnesium in Food & Beverage Fortification.
6. Red Flags: When to Reject a COA
A COA review isn't just about checking that values are within spec. It's also about spotting warning signs that the document itself — or the batch it represents — may not be trustworthy:
Missing sections: A COA without heavy metal or microbiological data is incomplete. Don't accept "available upon request" — these results must be on the document.
"Conforms" without values: If the COA says "Conforms" but doesn't list the actual measured result, request the quantitative data. A reliable lab always reports numbers.
Unsigned or undated: A valid COA must be signed and dated by a qualified QA/QC representative. No signature = no accountability.
Batch number doesn't match: If the COA batch number doesn't match the batch number on your packaging or packing list, the document may be from a different production run.
Results exactly at the limit: If every single result is suspiciously close to the specification limit, it may indicate the supplier is "cooking" results or that the process has no margin of safety.
Unrecognized testing lab: If the testing was done by an in-house lab with no accreditation, request third-party verification. Look for ISO 17025 accreditation on external lab reports.
COA older than the batch: If the COA date is before the manufacture date, the document was fabricated. This happens more often than you'd expect.
7. Building a COA Review Workflow
To make COA review efficient and consistent, establish a standardized workflow within your QA team:
- Create a COA checklist — Based on this guide, develop a checklist tailored to your specifications and regulatory requirements
- Review before payment — Never release payment before the COA is reviewed and the batch is accepted
- Maintain a COA archive — Keep every COA on file for the shelf life of the product plus a minimum of 2 years for traceability
- Trend analysis — Track key parameters (assay, heavy metals, moisture) across batches to identify quality drift before it becomes a problem
- Third-party verification — For high-volume or high-risk ingredients, periodically send a sample to an independent lab for confirmatory testing
A disciplined COA review process is the backbone of ingredient quality management. It catches problems early, protects your brand, and builds a data-driven relationship with your supplier.
Disclaimer: The regulatory limits and specification values cited in this article are illustrative examples based on common industry standards (USP, FCC). Always verify current applicable standards for your specific product, market, and regulatory jurisdiction. Consult with your regulatory affairs team for definitive guidance.
Leave A Comment