A CoA arrives with the pallet, gets filed, and is opened again only during an audit. That is a waste, because the certificate is the one document that tells you whether the lot in your store is the product you qualified.

What should be on it

At minimum: the product name and reference, the lot number, the manufacturing date, the tests performed, the method used for each test, the specification limit and the result. A certificate without a method is a claim, not a record.

For a cleanroom wipe, the relevant tests usually include base weight, sheet dimensions, sheet count, and particle release or extractables where the specification requires them. For a sterile product, add the sterilisation method, the indicator result and the sterility assurance level.

Lot, not product

The certificate must refer to the lot on the carton, and the lot must be traceable to the converting run and the raw material batch. A certificate that covers "the product" rather than a lot cannot support a deviation investigation, because it cannot tell you which other deliveries share the same material.

Check the lot number on the carton against the certificate before the pallet is put away. A mismatch found at goods-in is a phone call; a mismatch found during an audit is a finding.

Specification and result should line up

The most common weakness in a CoA is a test that appears on the certificate but not in the specification, or a limit that is different from the one in the purchase order. Both make the certificate decorative. The table below is the check I run on a new supplier.

CheckPassQuestion
Product referenceMatches the POIs the pack count the same?
LotMatches the cartonWhich raw material batch?
MethodNamed for each testIs it the method in the spec?
LimitStated numericallySame as the specification?
ResultWithin limit, with unitsIs it a lot value or a typical value?

Red flags worth a question

"Typical value" where a lot result is expected. A method described only as "in-house". A result reported without units. A specification limit that is a range wide enough to cover any outcome. None of these is fraud; they are signs that the certificate was written for marketing rather than release.

The other flag is a certificate that never changes. If every lot reports exactly the same particle count, either the process is extraordinarily stable or the number is a nominal value copied from a template. Ask for the raw data behind one lot.

Filing that survives an audit

File by lot, not by delivery date, and keep the specification and the change record alongside. During an audit the question is usually "show me the evidence for this lot", and a folder organised by date makes that a search rather than an answer.

Retain for the period your quality system requires, and at least as long as the shelf life plus the traceability window. For sterile references, keep the sterility release with the lot record, not in a separate sterilisation file.

A five-minute goods-in check

Match the product reference and the lot. Check that every test in the specification appears on the certificate with a method and a unit. Confirm that the result is inside the limit and that the signatory is identified. Photograph the label and file it with the certificate.

Five minutes at goods-in prevents a pallet from being put away under the wrong lot, which is the kind of error that takes a week to unpick during an investigation.

Is a CoA the same as a certificate of conformity?

No. A certificate of conformity states that the product meets the specification. A CoA reports the results. The first is a declaration; the second is evidence.

Do we need a CoA for every delivery?

For critical consumables, yes, per lot. For utility items, a periodic certificate with lot traceability may be acceptable if the quality system says so.

What if a result is out of specification?

The lot should not ship, or should ship with a deviation and a documented acceptance. The certificate should never show an out-of-specification result without a corresponding disposition.