How to Read a UDCA COA: What Each Line Actually Proves
Share
A certificate of analysis is the document you will look at more often than any other in this trade, and it is the one most often read wrongly. The mistake is treating it as a promise. A COA is not a promise and it is not a specification. It is a record of what was done to one specific batch, signed by whoever did it. Nine lines carry the weight. Once you know which nine, you can tell a real certificate from a decorated one in about ten minutes.
Everything below comes from ICH Q7, the GMP guide for active pharmaceutical ingredients, section 11.4, which is the closest thing this industry has to a definition of what a certificate must contain.
What a certificate is not
Three things get confused with each other, and the confusion causes real arguments at goods-in.
- The specification is the list of tests and limits you and your supplier agreed on. It is a plan.
- The certificate of analysis is the measured result of those tests on one batch. It is a record.
- The batch record is the internal manufacturing documentation. You will almost never see it.
A supplier whose specification looks strong but whose certificate omits the acceptance limits has given you a plan with no evidence attached. That is a common arrangement in this part of the market, and it is why the limits are the first thing you should check for.
Who issues it is part of what it says. In the ordinary case the certificate is written by the production site itself: the maker's own quality unit reporting on the maker's own batch, signed by a named person at that site. That is what the document is — a self-declaration, not independent verification. Nothing on it was measured by a party with no stake in the result. This is not a weakness to be apologised for. It is precisely why line 7 and line 8 carry more weight than the nine numbers above them, and why line 9 exists at all once a certificate is issued further down the chain. Evidence that does not come from the maker is a different document from a different party — a third-party laboratory report, which is read on its own terms. The two are not interchangeable, and a supplier who presents its own certificate as though it were independent testing has blurred a line an inspector will not blur.
The nine lines, in the order I would read them
ICH Q7 does not number them, so this ordering is mine. It runs from the things that are cheap to check to the things that decide whether the document is worth anything.
| # | Line | What it proves | What it does not prove |
|---|---|---|---|
| 1 | Name of the substance, and grade where applicable | The document is about the material you ordered | That the material matches the name |
| 2 | Batch number | Traceability to one production lot | That the lot is homogeneous |
| 3 | Date of release | When the quality unit signed it off | When it was made |
| 4 | Each test performed, with the acceptance limit | The limit is stated, so the result can be judged | That the limit is the right one for your market |
| 5 | The numerical result obtained | A measurement was made and recorded | By which method, or with what uncertainty |
| 6 | Re-test date or expiry date | How long the data support the material | How it was stored before it reached you |
| 7 | Signature of authorised quality personnel | A named person took responsibility | That the signature is genuine |
| 8 | Name, address and telephone number of the original producer | Who actually made it | Anything at all, if this line is blank |
| 9 | For repackers, brokers and agents: the laboratory identity plus a reference to the original batch certificate | Who analysed it, and what the original said | That the original certificate is attached, unless it is |
Lines 1 to 6 are the ones people read. Lines 7 to 9 are the ones that decide the document's value, and they are the ones most often thin.
Why the issuing entity matters more than the numbers
There is a specific paragraph in ICH Q7 that deserves to be quoted at goods-in, because it covers the situation most buyers in Europe and North America actually find themselves in. When a new certificate is issued by or on behalf of a repacker, reprocessor, agent or broker, the certificate must show the name, address and telephone number of the laboratory that performed the analysis, must reference the name and address of the original producer, and must reference the original batch certificate, a copy of which should be attached.
Read that last clause again. A certificate issued downstream of the original production site is not a standalone document. It is a document that has an attachment by design, and its absence is a finding, not a formatting preference.
The practical test: ask for the original batch certificate from the production site, and see whether it arrives without a second request. A supplier who cannot produce it is not necessarily selling bad material. But you have learned that your documentation chain has a gap in it, and that gap is yours to close, not theirs.
The three omissions that matter
No acceptance limit next to the result
A certificate that reads "Assay: 99.4%" without saying whether the limit is 98.5–101.5% or 99.0–101.0% has told you nothing you can act on. The number only becomes information when it sits next to the limit it is being judged against.
No method reference
ICH Q7 requires the tests to be listed as performed in accordance with compendial or customer requirements. It does not require the method number on the certificate. That is exactly why you should ask for it separately. The related-substances result is the clearest example: a total-impurity figure produced by an in-house HPLC method is not comparable with one produced by the pharmacopoeial method, and the two can differ by a factor that matters. Our walkthrough of how the UDCA related-substances limits add up covers the arithmetic; the certificate alone will not tell you which arithmetic was used.
No original producer named, or a trading name in that field
The name in field 8 should be the entity that made the material. When a trading company name appears there, the certificate has absorbed the chain rather than disclosed it. In some flows this is legitimate and the attachment exists. In others it means the certificate travels without the document that would let you trace it back.
How to test a certificate in ten minutes
- Check the batch number appears identically on the certificate, the label, the packing list and your purchase order. Transcription differences are common and are the cheapest fraud signal to find.
- Confirm the tests match the agreed specification, item by item, including anything you specified beyond the monograph.
- Confirm every result has a limit beside it. Count the gaps. Two is a conversation, six is a template.
- Check the date logic. Release date after manufacture date; re-test date consistent with the stability data you have been shown. If the certificate carries a re-test date with no stability report behind it, see what a re-test date actually requires.
- Check who signed it, and whether that person or role is identifiable as belonging to the quality unit rather than to sales.
- Ask what standard the results were measured against. If the answer is a commercial impurity standard rather than a pharmacopoeial reference substance, that is worth knowing before you compare figures across suppliers. Only four pharmacopoeial reference standards cover the whole UDCA monograph, and the rest of the market works from something else.
- If you accept the supplier's results instead of testing in-house, know what that costs you. Under 21 CFR 211.84, a party releasing a finished product may rely on a supplier's report of analysis only if it carries out at least one specific identity test on the component and establishes the supplier's reliability through periodic verification. The certificate does not replace that step. It is what the step is performed against.
What to ask for alongside the certificate
An authentic certificate on its own answers the question "what was measured". It does not answer "measured how", "against what", or "by whom, ultimately". I would ask for four things in addition, on the first order rather than the third: the analytical method references, the chromatograms for the impurity tests, the original batch certificate from the production site if the material was repacked or brokered, and the current pharmacopoeial text the specification was drawn from, so you can see for yourself which edition is in play.
None of this is about distrust. It is about knowing which of your supplier's claims sit on a document and which sit on a conversation. Only one of those two survives a customer audit.
Frequently asked questions
Is a certificate of analysis an independent test report?
No. A certificate of analysis is issued by the producer itself — the maker's own quality unit reporting on the maker's own batch. It is a self-declaration of results, and its weight comes from the signer's accountability and from whether the chain behind it is disclosed, not from independent measurement. Independent measurement is a different document from a different party: a third-party laboratory report.
What is the difference between a COA and a specification sheet?
A specification sheet lists the tests and limits a supplier works to. A certificate of analysis reports the results measured on one specific batch against those limits. The specification is the plan; the certificate is the record. A certificate without printed limits is a plan wearing a record's clothes.
Does a broker-issued COA meet the same requirements?
It meets a different one. ICH Q7 requires a downstream-issued certificate to name the laboratory that performed the analysis, reference the original producer, and reference the original batch certificate, with a copy attached. A broker certificate without those elements is incomplete on its face, whoever issued it.
Why is the acceptance limit missing from some certificates?
Usually because the template was built to show passing results rather than to be checked. Sometimes because the limit differs by market and the supplier does not want to print the version they used. Either way the number cannot be evaluated without it, so treat the omission as a request for a corrected certificate rather than as a detail.
Should the COA show the analytical method?
ICH Q7 does not require the method number on the certificate itself. Ask for it separately and in writing, particularly for the impurity tests, because a total-impurity figure from an in-house method is not directly comparable with a pharmacopoeial one.
What does "conforms" without a number mean?
It means someone compared something against something and found it acceptable. Without the measured value you cannot see how much room was left, and margin is often the thing you are actually buying. Ask for the numerical result for every test that produces one.
How long should I keep the certificate?
Longer than the material stays with you. ICH Q7 sets reserve-sample retention for APIs at one year past the assigned expiry date or three years after distribution, whichever is longer, and three years after complete distribution for a re-tested API. The certificate should be retained at least that long, because it is the document the reserve sample exists to be compared against.
Where this leaves you
Read a certificate as a chain of custody with numbers attached, not as a quality claim. If the nine lines are present, if every result sits beside a limit, and if the issuer's position in the chain is disclosed rather than blurred, the document is doing its job. If any of those three is missing, you have found the question to ask before the next order rather than after the next audit.
What we ship against, including the documentation that travels with each batch, is set out on our ursodeoxycholic acid page. If you want a certificate reviewed against your own acceptance criteria before you place an order, that is a reasonable thing to ask for and you can raise it through a quotation request. When material is sourced from a production site rather than made in-house, the original certificate from that site, carrying its batch number and its re-test date, travels with the shipment, so the ninth line is answered by a document rather than by a promise.
This article describes documentation and regulatory frameworks for quality, regulatory and procurement professionals. It states no therapeutic use, dose or indication for any substance, and no order quantity or lead time. Confirm all requirements against the current published version of the referenced guidance.