What a Certificate of Analysis should tell a formulator — and what it shouldn’t hide

A Certificate of Analysis is not a marketing asset. It is the document a quality team uses to decide whether a material can be qualified — and if it is written to impress rather than to inform, it fails at the only job it has.

The test of a good one is narrow: is it comparable? A result you cannot compare to anything is not evidence, it is decoration.

A limit without a method is not a specification

This is the part most often missing. A real release specification pairs every test with both a limit and the method it was determined by. Cannabinoid content by HPLC-DAD. Total terpenes by GC-FID. Residual solvents against USP <467> — under 5,000 ppm for class 2 solvents such as ethanol, isopropanol and heptane, under 3,000 ppm for class 3 including methanol, aligned to ICH Q3C. Heavy metals — arsenic, cadmium, lead, mercury — by ICP-MS against USP <232>/<233>.

Two suppliers can report the same number against different methods and mean different things by it.

That is why the method reference is not administrative detail. It is what makes one supplier's number and another's the same kind of fact.

What a complete specification covers

Beyond potency, a release specification for an extract should address microbiological limits — total aerobic count, yeast and mould, bile-tolerant gram-negative bacteria, and absence of E. coli, Salmonella, S. aureus and P. aeruginosa — against pharmacopoeial methods such as USP <61>/<62> and their European Pharmacopoeia equivalents. It should cover mycotoxins: aflatoxin B1, total aflatoxins, ochratoxin A. And pesticides, against limits set by Health Canada rather than by the supplier.

Note that several of those limits differ by intended route — an inhalation limit is not an ingestion limit. A specification that quotes one number without saying which it applies to has left out the part you needed.

Reading the gaps

The more useful skill is noticing what is absent. A document that reports potency but is silent on residual solvents is not telling you solvents were absent — it is telling you they were outside its scope. A certificate issued per shipment rather than per batch cannot support a batch-level investigation months later, when you need to know what a specific lot did.

None of that necessarily indicates a problem. It indicates a question worth asking before the material is on your line rather than after.

The clause that matters at audit

A specification should also say what happens when it changes. Methods and validation summaries are the kind of thing provided during an audit under a quality agreement, and any change to a method, a validation or a testing laboratory should trigger notification under change control.

That is the difference between a supplier who has documented their testing and one who has committed to it. The first tells you what they found; the second tells you what they will do if how they find it ever changes.

Why we issue one on every batch

Because the alternative pushes verification back onto you. If a claim about an input can only be checked by re-testing it yourself, the claim isn't doing any work. Batch-level documentation, with methods stated, is what turns a purity commitment from something you read into something you can qualify against.