Reading a third-party test report

A legitimate certificate of analysis (COA) is a short, technical document produced by a testing laboratory to report the result of a specific assay run on a specific physical sample. It is not marketing material, and it is not a general assurance of quality. A real COA is attached to one batch or lot of one product, run on a named instrument, against a named reference standard, on a named date, by a named analyst, and issued under a laboratory's formal quality system.

Most "COAs" circulated in the research peptide market are not that. They are a single purity number in a decorated PDF. The difference matters because a real COA tells you what the supplier shipped; a decorative COA tells you what the supplier wants you to believe they shipped.

A legitimate COA will have most or all of the following on its face, typically in a header block and a results table:

• Lab name and contact information — on the lab's own letterhead, with a physical address, phone number, and email that belong to the laboratory (not to the supplier).
• Accreditation status — CLIA number for clinical labs, ISO/IEC 17025 accreditation number for analytical testing labs, or an equivalent national accreditation. A lab that claims accreditation without a number is claiming nothing.
• Report date and sample-receipt date — the date the lab received the sample and the date the report was issued. Both.
• Unique report identifier — a report or certificate number that the lab can look up in its LIMS (laboratory information management system) when a reader calls to verify.
• Client identification — typically the supplier's name, the product name as submitted by the client, and the supplier's batch or lot number.
• Sample description — physical state (lyophilized powder, solution), quantity received, storage condition on arrival.
• Method identifier — the name and version of the analytical method used. For purity testing of peptides this will typically be a reversed-phase HPLC-UV method; for identity, an LC-MS method. The method string should reference a specific standard operating procedure by number.
• Instrument identifier — the specific HPLC or LC-MS instrument, by serial number or internal asset tag, used to run the assay. Real labs track instrument-level results for QC purposes.
• Reference standard used — the analytical standard against which the sample was compared, with its lot number and source. Without a reference standard, a purity number has no meaning.
• Raw-data appendix — a chromatogram for HPLC purity, a mass spectrum for LC-MS identity, an endotoxin curve for LAL, etc. The table in the front is a summary; the evidence is in the appendix.
• Analyst signature and release authority — the name of the analyst who performed the assay and the name of the QA reviewer who approved release. Typically both, typically separate individuals.

Missing any one of these fields is not automatic disqualification — some labs report on older templates — but the absence of most of them means the document is not being produced to any recognizable quality standard.

Fabricated or dressed-up COAs tend to share a set of visual and structural tells. Taken individually, any of these can appear on a real document from a small lab; taken together, they are a pattern.

• No lab letterhead. The document looks like a template exported from a word processor. The "lab" name appears as plain text rather than as part of a designed header with address, phone, email, and accreditation number.
• A single purity number with no method context. "Purity: 99.5%." Against what reference? Measured how? On which instrument? Over what time window? A real report answers these in the first half of the page.
• No raw data. A purity claim without a chromatogram, or an identity claim without a mass spectrum, is a claim about a number, not a measurement. The back pages are where the evidence actually lives.
• Identical-looking reports across batches. Download three COAs from the same supplier for three different batches or lots. If the peak shapes, retention times, and baseline noise in the chromatograms are pixel-identical, one chromatogram is being reused and the "batches" were never actually tested.
• Suspicious precision that repeats. If every batch a supplier has ever shipped reports exactly 99.7% purity — or every batch is precisely 99.2%, 99.5%, 99.8% cycling through — the number is being chosen, not measured. Real assay results fluctuate around the batch mean.
• Mismatched dates. The report is dated two years after production. The report is dated before production. The sample-receipt date is after the report-issue date. Any inconsistency between production, receipt, and report dates is a sign either of template reuse or of a COA generated for a different sample entirely.
• The lab is the supplier. The "third-party laboratory" turns out to share a phone number, address, or parent company with the supplier itself. This is not third-party testing.
• Lab name with no web presence. A laboratory issuing certificates of analysis is a business. It has a website, a listed phone number, and a mailing address. A lab name that returns no search results, or only returns the supplier page that links to it, is not a real lab.
• Wrong units or impossible numbers. Endotoxin reported in "ng/mL" without a dilution factor; purity reported with four decimal places when the method resolves to one; mass-accuracy in parts per million tighter than the instrument can physically deliver. Any of these is a tell that the number was typed rather than measured.

Three cross-checks are cheap and effective.

1. Call the lab. A real analytical lab will confirm a report number over the phone, or at minimum confirm that a report with that number exists in their system. Many will not share the result over the phone for client-confidentiality reasons, but they will confirm existence. A phone number that does not connect, or a laboratory that denies ever having issued the document, is a terminal finding.
2. Verify the analyst. LinkedIn, the lab's staff page, or the lab's accreditation filing will usually confirm whether a named analyst is a real person employed at the lab. A signature from an analyst who cannot be verified to exist is not evidence.
3. Check the report ID in the lab's system. Many ISO 17025 laboratories offer a verification portal where a client or third party can enter a certificate number and retrieve the report from the lab's own servers. A supplier-hosted PDF that does not match the lab-hosted copy is an altered document.

These checks do not require chemistry expertise. They require ten minutes and a phone. A supplier whose COA does not survive them has given you your answer.

If you only have time to check for a few things, check these, in this order.

• Red flag 1 — same chromatogram, different batches. Overlay two purity chromatograms from two different lot numbers in a PDF viewer (tile the pages, or use Acrobat's compare tool). Peak position, peak width, baseline noise, and minor impurity peaks should vary between batches. If they are pixel-identical, the COA library is a photocopy. This is the single strongest indicator of COA fraud and it is visually obvious once you look.
• Red flag 2 — purity values clustering at suspicious precision. Pull ten COAs from the same supplier across six months. Tabulate the purity numbers. Real results scatter. Fake results bunch, often at a marketable threshold (every result is 99.5% or higher, none ever lands at 98.7%).
• Red flag 3 — no method or instrument named. A number without a method is an assertion. A number without a named instrument means the supplier does not know, or does not want you to know, which machine produced it.
• Red flag 4 — dates that do not line up. Production date after report date. Report issued on a Sunday. Sample received before it was manufactured. Any temporal impossibility means the COA is not attached to the product.
• Red flag 5 — a laboratory with no verifiable existence. Phone disconnected, no accreditation record, no staff, no address that resolves on a map. A laboratory exists in the physical world before it exists on a PDF.
• Red flag 6 — a single "purity" line for a peptide. A peptide COA should cover identity (by LC-MS, typically with mass accuracy better than a few parts per million and an observed-versus-theoretical mass comparison), purity (by HPLC with method and column), and content (by quantitative amino acid analysis or by nitrogen content, depending on the lab). A supplier that reports only purity has skipped the identity and content questions that matter most.
• Red flag 7 — endotoxin and sterility omitted. For any research peptide a study might inject into an animal, a bacterial endotoxin (LAL) result and a sterility result belong on the COA. Their absence does not imply contamination; it implies the supplier has not tested for it.

A description of what the eye should be scanning for when a real COA is in front of it.

• Top of page 1. Laboratory letterhead with the lab's designed logo, a physical address that resolves on a map, a main phone line, a general email, and the accreditation number displayed as a block with the accrediting body's name (e.g., "ISO/IEC 17025:2017 accredited by A2LA, Cert. No. XXXX.XX").
• Report header block. Certificate number, report date, sample-receipt date, client name, client sample identification, and the lab's internal sample ID — distinct from the client's batch number so the lab can track the sample independently of the client's labeling.
• Sample and method table. One row per assay run. Each row names the parameter tested (e.g., "Purity, RP-HPLC-UV, 214 nm"), the method SOP number, the instrument identifier, the reference standard and its lot, the result, the acceptance limit, and pass/fail.
• Results narrative. One to three paragraphs in plain language stating what was received, what was tested, and what the result was. No marketing language.
• Analyst and QA sign-off. Printed name and signature of the analyst; printed name and signature of the QA approver; date of release. A wet or digital signature tied to a specific human, not a rubber-stamped "Lab Director."
• Appendix — the actual data. The HPLC chromatogram with time axis in minutes, absorbance axis labeled with the detection wavelength, retention times called out on the main peak, and impurity peaks numbered with their percent-area values. The LC-MS total ion chromatogram and the deconvoluted mass spectrum showing the observed monoisotopic mass versus the theoretical value for the peptide sequence. Endotoxin results reported in EU/mg with the LAL method (gel-clot, kinetic turbidimetric, or chromogenic) identified. Each page of the appendix carries the certificate number at the top so pages cannot be swapped between reports.

That is a real COA. If the document you are reading has a logo, a single purity number, and a signature that does not appear anywhere else on the internet, you are looking at something else — usually a marketing artifact dressed up to look like a lab report.