How to read a certificate of analysis, and how to tell if one is real

A certificate of analysis is the document a laboratory issues after it has tested a sample. On paper it answers the questions a label cannot: whether the substance is what it claims to be, how much of it is there, and what else came with it. In practice a great many certificates in circulation answer none of those questions, because a convincing certificate takes minutes to make and real effort to check.

This guide goes through a certificate line by line. For each part it explains what the line should say, why it matters, and how to check it yourself without trusting whoever handed you the document. That includes us.

Why a label is not enough

The best evidence on how often performance products are not what they say comes from a 2022 systematic review and meta-analysis. It pooled 19 studies covering 5,413 samples of anabolic steroids, most of them seized by authorities in Europe and Brazil. It estimated that 36% were counterfeit, meaning the contents did not match the label, and that a further 37% were substandard: the right substance, in the wrong amount.^[6]

The authors warn that the studies differed widely and that the figures "must be interpreted with caution".^[6] The direction is not in doubt, though. Across a large body of testing, a printed label was a poor guide to what was inside, and a certificate is only worth something if it can close that gap.

What a certificate of analysis is

A certificate records the tests performed on a particular sample, the method used for each, the limit the result was judged against, and the result itself. It is a report about one sample, issued by one laboratory, on one date.

That definition already contains the three questions that matter most. Which laboratory? Which sample? Which tests? The rest of this guide is about answering them.

The eight things to check

Every numbered point on the illustration above corresponds to one of these. Work through them in order: if an early one fails, the later ones cannot rescue the certificate.

1. 1The laboratory, with an address and a way to contact it. A certificate from a lab you cannot telephone cannot be checked.
2. 2The accreditation number. Look it up in the accreditation body’s own directory — the number is either in the register, against this lab, for these tests, or it is worth nothing.
3. 3The batch or lot number. It has to match the number printed on the product in your hand, or the certificate describes somebody else’s batch.
4. 4Identity: a test that proves the substance IS what the label says, usually by mass spectrometry against a reference standard.
5. 5Assay: how much of it there is, against what the label claims. This is the line that says whether a product is underdosed.
6. 6Purity, with the limit it was judged against. A result with no specification beside it is a number, not a pass.
7. 7The method for each test, so somebody else could repeat it.
8. 8The date tested, and a named person who signs for the result.

1. The laboratory is real and can be contacted

A certificate should name the laboratory, give a street address and give a way to reach it. A certificate from a laboratory that cannot be found, or whose only contact is the seller, cannot be verified by anybody, and an unverifiable certificate is the same as no certificate.

Do not rely on the contact details printed on the document. If it is forged, those are the details the forger chose. Find the laboratory independently, through its accreditation body's directory or its own website, and use the contact details you found there.

2. The accreditation covers these tests

ISO/IEC 17025 sets out the general requirements for the competence of testing and calibration laboratories, and it is the standard accreditation bodies assess laboratories against.^[1] Accreditation is worth checking because it is granted for a defined scope: the specific list of tests the laboratory was assessed for. The technical assessment is limited to the tests on that scope.^[1]

That detail is what most people miss. A laboratory can be genuinely accredited for water microbiology and have no accreditation at all for the test on your certificate. An accreditation number printed next to an unaccredited test borrows credibility it has not earned.

To check, search the accreditation body's own directory: UKAS in the United Kingdom,^[7] or A2LA for many laboratories in the United States.^[8] Find the laboratory, open its scope, and look for the test named on the certificate. Accreditation bodies that belong to the ILAC Mutual Recognition Arrangement have been peer-evaluated against a common standard, so accreditation from one of them carries across borders: "accredited once, accepted everywhere".^[2]

3. The batch number matches the product in your hand

ISO/IEC 17025 requires a test report to state, in effect, that its results relate only to the items tested.^[5] A certificate for batch A says nothing about batch B, however similar the packaging.

So the batch or lot number on the certificate must match the number printed on the product itself. A certificate with no batch number describes nothing you can hold. The same certificate attached to several batches, or to several products, describes at most one of them.

4. Identity is tested by a method that can prove identity

Identity answers the first question: is this substance what the label says? The method matters, because not every method can prove it. The international guideline on specifications for medicines, ICH Q6A, says that identification "solely by a single chromatographic retention time, for example, is not regarded as being specific". Combinations such as HPLC with mass spectrometry, or GC with mass spectrometry, are generally acceptable.^[3]

In plain terms: a peak appearing at the expected moment on a chromatogram is consistent with the right substance, but other substances can appear at the same moment. Mass spectrometry adds a second, independent kind of evidence. A certificate that establishes identity by HPLC alone has not established identity. What lab tests can and cannot prove explains why in more detail.

5. The assay is reported against the label claim

The assay says how much of the substance is present. On a useful certificate it is reported against what the label claims, usually as a percentage of the stated amount, and judged against a range. This is the line that shows whether a product is underdosed or overdosed, the substandard failure the meta-analysis found in over a third of samples.^[6]

6. Every result has a specification beside it

A result is a number. A result with a specification beside it (the limit it had to fall within) is a pass or a fail. "Purity: 99.1%" on its own does not say what was measured, by what method, or what would have counted as failure. Look for a column of specifications, and check that each result actually falls inside its own.

7. The methods are named

Each test should name its method, so another laboratory could repeat it. The ICH guideline on validating analytical procedures describes what a method has to demonstrate before its results can be relied on. Among them are specificity, how far other substances interfere with the measurement, and accuracy, how close the measured value comes to the accepted true value.^[4] A certificate that names no methods gives nobody anything to evaluate.

8. It is dated and signed by a named person

A certificate should state when the sample was tested and who is answerable for the result. An undated, unsigned certificate cannot be matched to a laboratory's records, and matching it to those records is the most reliable check available.

Red flags

How to confirm a certificate with the laboratory

The strongest check takes one email. Find the laboratory through its accreditation body's directory rather than the certificate. Send it the certificate number, the batch number and the date on the document, and ask whether it issued that certificate with those results. A reputable laboratory keeps records of the reports it issues and can answer.

If it says it did not, the certificate is forged. If it will not answer, you are no better off than before you asked.

What even a genuine certificate cannot tell you

A certificate is evidence about a sample, and only that sample.^[5] Even a real certificate, from an accredited laboratory, for the right test, cannot prove that the vial in your hand came from the batch that was tested. It cannot show how the product was stored after the test. And it says nothing about whether a product is legal where you live or safe for you to use. Those are questions for the law and for a doctor, not for a laboratory.

For the packaging and seller checks that come before a certificate, see how to spot counterfeit steroids and falsified medicines.