Reading a certificate of analysis and verifying one are different jobs. Reading asks what the document says. Verifying asks where it came from: whether the laboratory named on it issued it, and whether it describes the lot printed on the vial. A fabricated or recycled certificate can be complete and consistent, so that question cannot be settled from the page. For reading, start with how to read a peptide COA or the field-by-field reference, reading a certificate of analysis line by line.
The checks in order
Seven checks, in the order worth doing them. The first five need only the document, the vial, the packing slip and a browser. The sixth depends on what the laboratory is able to tell someone who is not its client. The comparison table below covers the first three, and steps four to seven each have a section of their own.
| Step | Check | What to do |
|---|---|---|
| 1 | Product and lot | Match the product name and lot number on the certificate to the vial label and the packing slip. |
| 2 | Laboratory and report number | Note the laboratory's name and the report or certificate number exactly as printed. |
| 3 | Dates and methods | Note the received and issued dates and the test method for each result, ready to compare with what the laboratory holds. |
| 4 | Verification link or code | If the document carries one, reach the laboratory's own site independently and enter it there, not through the link on the document. |
| 5 | Laboratory identity | Look the laboratory up in its accreditation body's directory and check that the scope covers the test. |
| 6 | Laboratory, then supplier | Where there is no public lookup, or it leaves the question open, ask the laboratory whether it can confirm the report exists and matches. It may confirm only limited facts, need its client's consent, or decline; if so, ask the supplier to arrange confirmation through whoever commissioned the test. |
| 7 | Record | Write down who was contacted, when, and what was and was not confirmed. |
The verification checks in order. A mismatch at any step is a reason to ask, not proof of a problem.
What a laboratory report gives you to check
A laboratory report carries identifiers that exist somewhere other than on the page. ISO/IEC 17025 is the international standard for the competence of testing and calibration laboratories. An accreditation body's published summary of its reporting requirements lists, among other items, the laboratory's name and address, a unique identification for the report, the name of the customer, the method used, an unambiguous identification of the item tested and the date of issue. The customer field matters most here: it names the laboratory's client, the party that can agree to the laboratory discussing the report.
What to compare, and against what
| Element on the certificate | Compare it against | What a mismatch can mean |
|---|---|---|
| Laboratory name | The laboratory's own website, found independently, and an accreditation body's directory | The issuer is not yet identified |
| Report or certificate number | The laboratory's public lookup, if it has one, or its written reply, if it gives one | A mistyped number, an incomplete lookup, or a number the laboratory did not issue |
| Lot number | The vial label and packing slip, and the laboratory's record where it shows or confirms it | A copying error, or a document for other material |
| Verification code, where used | The laboratory's own site, with the code typed in by hand | A mistyped code, or one that belongs to another report |
| Dates received and issued | The laboratory's record, where it shows or confirms it | An amended report, or a copy that differs from the one issued |
| Test method | The laboratory's record, where it shows or confirms it, and its accreditation scope | A copy that differs from the report issued, or a test outside the accreditation |
| Sample identity as recorded | The product name and strength on your label | A report for a different product or strength |
Each element is checked against a source other than the certificate. A mismatch is a reason to ask, not proof.
Typing errors, incomplete lookups and amended reports all produce mismatches. The same summary of ISO/IEC 17025 provides for amendments: a further report is issued, identified as amended, and refers to the original. Remember too that a PDF on a supplier's website is a copy, not a document obtained from the laboratory.
Verification links, QR codes and lookup pages
Some laboratories print a verification code, a web link or a QR code on their reports and offer a page where the code can be entered. Arrangements differ. Where a lookup exists, it may show the laboratory's record, or only enough of it to compare with the copy in hand.
A link printed on a document, QR code included, goes wherever the person who made the document pointed it. A convincing page establishes little unless it is on the laboratory's own domain.
So do not start from the link. Find the laboratory's website independently, through an accreditation body's directory or a search on its name, and enter the code there. The Federal Trade Commission's consumer alert on QR codes concerns unexpected codes and messages, not certificates, but its advice applies by analogy: inspect the URL for misspellings or a switched letter, and contact a company through a phone number or website you know is real.
Check that the laboratory is real and accredited for the test
Accreditation bodies assess testing laboratories against ISO/IEC 17025 and publish who they have accredited. The International Laboratory Accreditation Cooperation (ILAC) describes its signatory search and the bodies' directories as a way to locate laboratories accredited for the specific tests required. Directories differ in how they are searched. The A2LA directory, for one, can be searched by organization name and certificate number.
- Find the accreditation body named on the certificate, or ask the supplier which body accredits the laboratory.
- Confirm the body is recognized for testing. ILAC's Signatory Search lists the bodies that have signed its Mutual Recognition Arrangement and the scope of each one's recognition. Testing, calibration, medical testing and inspection are listed separately, so look for testing under ISO/IEC 17025. Many listings link to the body's directory of accredited facilities.
- Search that directory for the laboratory and confirm that the name and address agree with the certificate.
- Open the laboratory's scope and look for the test and method the certificate reports.
Third-party testing and ISO/IEC 17025 explains what a scope covers and what accreditation does and does not establish.
If the laboratory is not accredited for that test
The directory steps can come back empty in two ways: the laboratory is listed but its scope does not show the test, or the certificate names no accreditation body and the laboratory is in no directory you can find. Neither shows that the certificate is false or the result wrong. It means you have found no accreditation body's assessment covering that test.
Ask the supplier which body, if any, accredits the laboratory for the method reported, and record the answer. An unaccredited laboratory can still be asked whether it issued the report.
What to ask the laboratory
Where there is no public lookup, you can write to the laboratory using contact details from its own website. Keep the request narrow.
- Does a report with this number exist in your records?
- Does it refer to this lot number and this sample description?
- Do the received and issued dates on my copy agree with yours?
- If you cannot answer without your client's consent, how should that consent reach you?
Be realistic about the answer. The laboratory's client is whoever commissioned the test, which may be neither the buyer nor the supplier. ISO/IEC 17025 requires laboratories to keep customer information confidential. As an accreditation body's summary of the standard describes it, the exceptions are information the customer makes public or agrees may be made public, and release that the law requires or a contractual arrangement authorizes. A laboratory may therefore confirm only that a report with that number exists and matches, may ask for its client's consent first, or may decline to answer at all.
A request for consent or a refusal is not evidence against the certificate. It moves the question to the supplier, who can give consent if it is the laboratory's client, or can ask the party that is.
If the laboratory says it has no record
A lookup that returns nothing has confirmed nothing either way: check each character, then write to the laboratory. A written reply that the laboratory holds no report under that number, or that its record differs from your copy, is more serious. It is still a question before it is a conclusion, because a wrongly copied number or an amended report would draw the same reply.
Stop using the lot, keep the vial, label and packaging, and put the question to the supplier in writing, quoting the laboratory's reply. Record the exchange. Counterfeit and mislabeled material covers what follows if the answer does not resolve it, including independent identity testing.
What to ask the supplier
- Which laboratory issued this report, under which report number, and who is named on it as the customer?
- Can I have the laboratory's original document, not a summary or a reformatted copy?
- Does the laboratory offer a lookup for this report, and what is the code?
- Are you the laboratory's client for this report? If so, will you authorize the laboratory in writing to confirm it to me? If not, will you ask the party that is?
The customer named on a report may be a manufacturer or distributor further up the chain. A supplier in that position cannot give consent itself, and should be able to explain how the lot on the report relates to the lot on the vial.
Signs the document may not belong to the lot in hand
The warning signs visible on the page, such as a reused certificate, identical values across lots and no issuing laboratory, are listed under red flags in how to read a peptide COA. One limit is specific to provenance and applies even to a confirmed report. In the summary of ISO/IEC 17025 cited here, a report states that the results relate only to the item tested, and information supplied by the customer, which can include the lot designation, is clearly identified. The laboratory can speak to what it received and measured, not to your vial.
What the Restate lookup does, and what it cannot do
Restate's lookup at /coa/verify accepts a lot number, a certificate ID or a product name, and ignores case, spaces and punctuation. An exact match on a lot number or certificate ID returns a result marked Verified, with a link to the certificate page. A product name, or three or more characters found in one, returns the certificates on file for that product, to compare with the lot printed on the vial. A partly typed lot number or certificate ID never returns a verification. It returns either the certificates for a product whose name contains those characters, or possibilities under the heading No exact match.
If nothing matches, the lookup states that no certificate is currently published for that entry. That is documentation not found, never a failed test: in the page's words, a statement about the library, not about the lot. Verified is equally narrow: a certificate is on file and matches the lot number or certificate ID entered. The lookup does not promise that any given vial's lot is on file. The full library is at /coa.
Any supplier's lookup, this one included, shows what the supplier holds on file under a lot number. It is not independent verification. Each Restate certificate page names the testing laboratory, gives the laboratory's verification code and links the original laboratory record. The pages also state where Restate stands: the laboratory tested the lot for the source manufacturer that supplies Restate, the lot number is the one that manufacturer assigned, and Restate did not perform or commission the test. Restate is therefore not the laboratory's client. The linked original is a PDF copy hosted on the source manufacturer's website, so the independent check is the same as for any certificate: reach the laboratory's website yourself and enter the code there.
A worked walk-through with an invented example
Everything in this example is invented. Lot EX-0001, Example Analytical Laboratory and certificate EAL-00000 do not exist, and the laboratory's replies are made up to show the reasoning.
- Lot against vial. The certificate says EX-0001 and so does the label. Had they differed, the question would go to the supplier first.
- Find the laboratory. A search for Example Analytical Laboratory, made without the link on the certificate, finds its website, and the certificate's link points to the same domain. Had it pointed elsewhere, the document would stay unconfirmed until that was explained.
- Check the accreditation. The body named on the certificate is an ILAC signatory for testing, its directory lists the laboratory at the same address, and the scope shows the purity method reported. An absent method would be a question for the supplier, not a conclusion.
- Check the customer. The report names a manufacturer, not the supplier. Consent, if needed, has to come from that manufacturer.
The last check depends on whether the laboratory offers a public lookup.
- If it does, entering EAL-00000 on the laboratory's own site shows a record whose lot, sample description, dates and method agree with the copy in hand. A blank result would call for a character check and a written inquiry. A difference would be for the supplier to explain before the certificate is relied on.
- If it does not, a written inquiry goes to the address on the laboratory's website. Here the laboratory replies that it needs its client's consent. The supplier is asked to obtain that from the manufacturer, and the certificate is recorded as unconfirmed unless and until the laboratory confirms it.
What to record afterwards
File a short note with the lot record, so the check does not have to be repeated.
- The lot number, the report number and the verification code checked.
- Who was contacted at the laboratory and at the supplier, by what route and on what date.
- What was confirmed, in the words used, and what was declined or left unanswered.
- The accreditation body and the date its scope was viewed, with saved copies of any lookup result and written replies.
Records to keep for research purchases covers where this note sits among the other documents for a lot.