A certificate of analysis (CoA) summarises the quality control testing of one batch or lot. It identifies the product or material, the batch number, the specification and its version, each test performed with its acceptance criterion and result, a conclusion, and the signature of the person authorised to approve it.
CoAs flow in two directions. Suppliers send a CoA with each lot of raw material or packaging they deliver. Manufacturers and contract laboratories issue CoAs for the materials, intermediates and finished products they test.
Why it matters in GMP
A CoA is only as reliable as the data behind it. Under 21 CFR 211.84(d)(2), a manufacturer may accept a supplier’s report of analysis instead of full testing only if at least one specific identity test is performed and the supplier’s results are periodically verified. For finished products, the CoA must reflect approved results from the actual records — never retyped figures — and is a key piece of evidence for batch release.
- Generate the CoA from approved results, not from a separate document.
- Release it only after review and approval, with the specification version shown.
- Store supplier CoAs securely and link them to the lot they belong to.
How Swat iQua Suite handles it
In Swat iQua Suite the certificate of analysis is printed from the approved sample record, so it shows the same results and specification version the reviewer and approver signed off. For contract labs, a send-to-client gate controls release, a CoA-released email can be sent, and portal users can download the CoA only after release. Supplier CoAs received with goods are stored privately with a SHA-256 integrity check, and identity testing is always required.