The expensive mistake is not forgetting to ask for a supplier certificate of analysis. It is asking for one, filing it, and stopping there. That shortcut bills you later, in a batch you cannot release without another round of testing, in a supplier file that cannot answer the first question a quality reviewer asks, and in the rework that follows when the gap surfaces during an audit or a customer questionnaire.
For a US brand buying ingredients or finished product from dietary supplement manufacturers, the thing to request is therefore not a single PDF but a small package: the COA, plus the record showing how its results were confirmed and who approved that qualification. Under 21 CFR 111.75(a)(2), reliance on a supplier COA is conditional, and it never absorbs your own identity testing of a dietary ingredient.
What a Supplier COA Actually Proves
A supplier certificate of analysis is a results document for one material: it includes a description of the test or examination method or methods used, the limits of those tests or examinations, and the actual results obtained under 21 CFR 111.75(a)(2)(ii)(B).
What it does not prove matters just as much. A COA on its own does not show that you qualified the supplier, because qualification means establishing the reliability of that certificate by confirming the results of the supplier's tests or examinations. Nor does it discharge your identity testing obligation for a dietary ingredient. Common mistake at this stage: reading a pass result as a release decision. The consequence is a file that cannot support reliance, which was the whole reason for asking.
COA Versus the Supplier Qualification Record
The two documents get confused because they arrive in the same email thread. The COA is the input; the qualification record is the audit trail that lets the COA do any work. The sequence is specific: you first qualify the supplier by establishing the reliability of the supplier's COA through confirmation of the results of the supplier's tests or examinations, you maintain documentation of how you qualified that supplier, and your quality control personnel review and approve the documentation setting forth the basis for that qualification.
The obvious objection is that a COA is already a quality document, so a second file is duplicate paperwork. It reads that way until someone asks, months later, why you believed the result. Confirmation is the step that turns a supplier's claim into a basis you can rely on, and documentation is what makes that step visible to a reviewer who was not in the room. The easy error is treating the COA as the qualification record itself. Keep the qualification documentation separate and identifiable, so a reviewer can find the basis instead of reconstructing it.
Why Identity Testing Still Belongs to You
21 CFR 111.75(a)(1)(i) requires at least one appropriate test or examination to verify the identity of any component that is a dietary ingredient, unless you petition the agency and it exempts you from that testing. That obligation has its own purpose, and the COA-reliance provision does not absorb it: reliance is conditional and covers applicable non-identity specifications.
This is where a pass result does real damage. Substitute a supplier's identity result for your own required test and the incoming ingredient has no compliant identity basis; a certificate saying otherwise does not fix it. The practical division of labor is to use the COA for what it can support and keep identity testing in your own plan. If a manufacturer's paperwork blurs that line, ask which item they consider theirs and which they consider yours.
What to Request in the COA Itself
Ask for three things.
The COA should include a description of the test or examination method used, the limits of those tests or examinations, and the actual results, because without all three you cannot confirm a result against a method and a limit, and a confirmation you cannot perform leaves the supplier's reliability unestablished.
Accepting a COA that reports only pass or fail is the trap here: the document looks complete and supports nothing. Return it and ask for the method, the limit, and the measured result for each specification you intend to rely on.
How Often to Re-Confirm a Supplier COA
The rule requires you to periodically re-confirm the supplier's certificate of analysis, and this passage sets no interval. The honest answer is that the schedule is a documented decision you make and own, not a number you look up. Ask the manufacturer what its re-confirmation schedule is and for the record showing the last confirmation happened; if the schedule is undefined, log that as a documentation gap rather than assuming the certificate stays reliable.
A skeptic would say re-confirmation is paperwork with no product benefit. The response is that the certificate's reliability is the thing being relied on, so if nothing shows it is current, you cannot demonstrate the basis for release when a reviewer asks. Qualifying once and never revisiting is the quiet mistake; the file stays open and the basis goes stale. Keep the re-confirmation record inside the qualification file so the two are read together.
Who Must Approve the Qualification File
Quality control personnel must review and approve the documentation setting forth the basis for qualification and re-qualification of any supplier. That is an approval role, not a filing role. The usual mistake is letting procurement own the approval because procurement owns the supplier relationship; the result is a file that lacks the required QC sign-off however solid the testing behind it. Let procurement collect the COA and the records, then route the qualification basis to QC for approval before anyone relies on it.
The Supplier COA Request Checklist
Turn the request into a checklist so nothing depends on memory: a COA with method, limits, and actual results for each specification; the record showing how the supplier's COA reliability was confirmed; the documentation of how the supplier was qualified; the QC review and approval of that basis; and the periodic re-confirmation record. Add the item that is easiest to miss, the identity test method and result the supplier used, requested as information while your own required identity test stays separate.
This is a request list you can hand to dietary supplement manufacturers and to your QC team, not a claim that any particular supplier meets it and not a legal opinion on exemption routes. Supplier audits, pricing, lead times and finished-product efficacy sit outside what these records can tell you.
So the fit is narrow. This is not for a brand that wants one PDF to file and forget. It is for a team that will keep the qualification record, route it to QC for approval, and re-confirm the COA on a stated schedule, because that file is what answers questions instead of creating them.
