Certificate of Conformance vs Certificate of Analysis: CoC vs CoA Explained

A Certificate of Conformance (CoC) is a signed statement from a supplier that a product meets the specified requirements. A Certificate of Analysis (CoA) reports actual test results for a specific batch or lot, measured against defined limits. The difference comes down to evidence. A CoC states that the product conforms. A CoA shows the numbers behind that claim.

Purchase orders often treat the two documents as interchangeable, and that habit causes problems. Two of the most common gaps in supplier document reviews are accepting a CoC where you needed measured data, and accepting a generic CoA that was never tied to your lot.

This guide covers:

Table of Contents

1. What Is a Certificate of Conformance (CoC)?
2. What Is a Certificate of Analysis (CoA)?
3. CoC vs CoA: Side-by-Side Comparison
4. EN 10204 Certificate Types and Where CoC and CoA Fit
5. Which Certificate to Require, Industry by Industry
6. Why Neither Certificate Replaces Inspection
7. How to Verify a CoC or CoA: Review Checklist
8. Red Flags in Supplier Certificates
9. Writing Certificate Requirements Into Purchase Orders
10. Frequently Asked Questions

What Is a Certificate of Conformance (CoC)?

A Certificate of Conformance is a formal declaration from the manufacturer or supplier. It states that a shipment was produced to the drawing, specification, purchase order, or standard named on the document. It is an attestation and does not normally include test values.

The same document goes by other names: Certificate of Compliance, Certificate of Conformity, or Supplier's Declaration of Conformity. For consumer products regulated by the US CPSC, the formal names are General Certificate of Conformity (GCC) and Children's Product Certificate (CPC).

What a CoC Should Contain

A usable CoC identifies the product precisely and makes a specific claim that someone can be held accountable for. At minimum, look for:

• Supplier name and address, plus the manufacturing site if it is different
• Part number, revision level, and description
• Purchase order number and quantity shipped
• Lot, batch, heat, or serial numbers
• The exact specifications, drawings, or standards the product conforms to, including revision
• A clear statement of conformance
• Name, title, and signature of an authorized person, with the date

Standards and Regulations That Govern CoCs

Several frameworks define what a CoC means and who can issue one.

• ISO/IEC 17050-1:2004 sets general requirements for a supplier's declaration of conformity. ISO/IEC 17050-2 covers the documentation that supports it.
• FAR 52.246-15 lets US federal contracting officers accept supplies on a contractor's Certificate of Conformance instead of government inspection, when the contract authorizes it.
• 16 CFR Part 1110 sets the content requirements for CPSC certificates. The revised rule was published January 8, 2025. Importers must eFile certificate data with CBP at entry from July 8, 2026 for most regulated products, and from January 8, 2027 for goods entered from a foreign trade zone. Certificates and supporting test records must be kept for five years.

The CPSC change matters because a consumer product CoC is no longer a document you produce only when asked. It now travels with the customs entry, so a data error can hold a shipment at the port.

What Is a Certificate of Analysis (CoA)?

A Certificate of Analysis reports measured test results for a specific lot or batch and compares each result against the specification limit for that property. Suppliers of chemicals, pharmaceuticals, food ingredients, resins, metals, and electronic materials issue CoAs routinely.

A CoA is only as valuable as its traceability. Each reported value should link back to a sample drawn from the lot you received and tested by a named method.

What a CoA Should Contain

• Product name, grade, and supplier part or catalog number
• Lot or batch number, plus manufacture date and expiry or retest date where relevant
• Each tested parameter, with the specification limit, the actual result, and units
• Test method references, such as ASTM, USP, ISO, or an internal method number
• The laboratory that performed the testing, and its accreditation if it holds one (such as ISO/IEC 17025)
• A pass or fail conclusion against the specification
• Name, signature, and date from an authorized quality representative

Where CoAs Carry Regulatory Weight

• Under 21 CFR 211.84(d)(2), a US pharmaceutical manufacturer may accept a supplier's CoA instead of fully testing a component. It must still run at least one specific identity test and periodically validate the reliability of the supplier's results.
• ICH Q7 Section 11.4 requires authentic CoAs for each batch of an intermediate or API on request. Results must be reported as numbers wherever the test produces numbers.
• EN 10204 type 3.1 inspection certificates serve as CoAs for metallic products. They report specific test results for the delivered heat or lot.

CoC vs CoA: Side-by-Side Comparison

A CoA is not automatically "better" than a CoC, because the two documents answer different questions. For a machined bracket, dimensional conformance backed by a first article report may matter more than a materials CoA. For a solvent, the CoA is the evidence that counts.

EN 10204 Certificate Types and Where CoC and CoA Fit

EN 10204:2004 is the clearest framework for seeing how attestation and test evidence relate to each other. Buyers of steel, aluminum, castings, and fasteners use it every day, and its certificate types map directly onto the CoC vs CoA distinction.

Watch the 2.2 row. A test report built from typical production values looks like a CoA, but it says nothing about your heat or lot. If your drawing calls for EN 10204 3.1, a 2.2 document is a nonconformance, not a substitute.

Which Certificate to Require, Industry by Industry

Your quality system should set certificate requirements by risk, not by habit. Requirements typically break down as follows.

Aerospace and Defense

AS9100D Clause 8.4.3 requires organizations to communicate requirements to external providers, including any required documentation. Buyers commonly require a CoC with every shipment. For raw stock they also require material certifications, often EN 10204 3.1 or mill certs. Federal contracts may invoke FAR 52.246-15. Counterfeit parts controls under SAE AS5553 and AS6081 add one more requirement: the CoC must trace back to the original component manufacturer.

Medical Devices

ISO 13485:2016 Clause 7.4.3 requires verification of purchased product, scaled to supplier risk. A CoC is usually accepted for low-risk components. Critical materials usually need lot-specific CoAs. Examples include implant-grade alloys, biocompatible polymers, and parts sensitive to sterilization. For medical device supplier quality, certificate review is typically paired with periodic independent verification.

Electronics

Buyers of electronics usually rely on CoCs for assembled boards and components, plus material declarations for RoHS, REACH, and PFAS. A RoHS declaration is a form of CoC. It contains no analytical results unless you request XRF screening or lab data. If you rely on chemical declarations before shipment, learn how to verify PFAS compliance before shipment.

Consumer Products (US Market)

A GCC or CPC is mandatory for products subject to a CPSC rule, ban, or standard. A CPC must be based on testing by a CPSC-accepted third-party laboratory. Since July 8, 2026, certificate data has been eFiled at entry. The certificate must now be accurate and complete enough to clear customs.

Pharmaceuticals, Chemicals, and Food Ingredients

Expect a lot-specific CoA for every batch. In regulated pharma, you also need your own identity testing and a documented program for validating supplier CoAs over time.

Metals and Raw Materials

Specify the EN 10204 type, or the equivalent mill test report, on the drawing or PO. Check that the heat numbers on the certificate match the physical heat marks on the material.

Why Supplier Certificates Still Need Physical Inspection

A certificate is the supplier's claim about its own product. It is useful evidence, but it is not independent evidence.

Supplier document reviews commonly turn up these failures:

• CoCs signed by sales or logistics staff with no access to quality records
• CoAs reused across several lots, with identical results down to the last decimal place
• Test methods on the CoA that the supplier's lab is not equipped to perform
• Certificates that reference a superseded drawing revision
• Mill certs that do not match the heat numbers on the delivered bar stock
• Certificates dated before the lot they cover was produced

Example Scenario: When a Valid-Looking Certificate Falls Apart

A buyer orders machined aluminum brackets from a contract manufacturer. The drawing calls for 6061-T6 material with an EN 10204 3.1 inspection certificate. The shipment arrives with a clean CoC and a 3.1 mill cert, both signed and dated, and both referencing the correct PO.

An on-site inspector checks the paperwork against the factory's actual stock before the shipment leaves, and finds three problems:

• The heat number on the mill cert does not match the heat marks on the bar stock in the raw material rack.
• The cert lists mechanical properties, but the purchase records show the supplier bought that heat number months before this order. The bar actually used came from a different distributor.
• The CoC references drawing revision C. The PO specifies revision D, which added a tighter tolerance on one bore.

None of these issues shows up on paper alone. Each document looks complete and correctly formatted. Only checking the documents against the physical material and the factory's own records exposes the gaps.

The resolution follows a standard path. The lot is quarantined, the supplier provides the correct mill cert for the material actually used, and the parts are re-measured against revision D. The supplier also receives a non-conformance report requiring a fix to how certificates are matched to material at receiving, not just a corrected certificate for this one order.

For this reason, certificate review belongs inside a wider incoming quality control process, not in place of one. For new parts or new suppliers, check certificate claims against physical results through First Article Inspections before you move to certificate-based acceptance.

ISO 9001:2015 Clause 8.6 supports this approach. Before release, it requires documented evidence that the product conforms to acceptance criteria, traceable to the person who authorized release. A supplier certificate can be part of that evidence. When risk is high, it cannot be all of it.

How to Verify a CoC or CoA: Review Checklist

Use this sequence on every incoming certificate, and set the depth according to how critical the part is.

1. Match identity. Part number, revision, PO number, and quantity must match the order and the packing list exactly.
2. Match traceability. Lot, batch, heat, or serial numbers on the certificate must match the labels and markings on the goods.
3. Check the specification reference. The standard or drawing name must be the one on your PO, at the current revision.
4. Check dates. The certificate must be dated after manufacture and testing. Expiry or retest dates must leave enough usable shelf life.
5. Review results (CoA only). Every required parameter must appear with units, methods, and a result inside the limits. Look for missing parameters, not only failing ones.
6. Confirm the signatory. The signer should hold a quality role with authority to release the product.
7. Validate the lab. For third-party testing, confirm that the lab's ISO/IEC 17025 accreditation scope covers the method used.
8. Trend over time. Compare results across lots. Values that never vary are as suspicious as values that drift.

When a certificate fails any of these checks, quarantine the material. Then document the gap through your non-conformance report process. That way the supplier's corrective action fixes its documentation system, not just the one certificate.

Red Flags in Supplier Certificates

Some issues should trigger immediate escalation rather than a routine query:

• Signatures that are the same scanned image pasted onto every certificate
• Lab letterhead with no address, accreditation number, or contact details
• A document labeled CoA that reports "pass" or "conforms" without actual values
• Specification limits on the CoA that are wider than the limits on your PO
• A certificate format that differs from the supplier's usual template, with no explanation
• Refusal to provide raw test data or lab records when asked

Any of these justifies an on-site check. A supplier audit can confirm whether the lab, equipment, and records behind a certificate actually exist.

Writing Certificate Requirements Into Purchase Orders

Most certificate disputes trace back to vague PO language such as "certs required." Instead, specify:

• The certificate type required (CoC, lot-specific CoA, EN 10204 3.1, or another named type)
• The parameters that must appear on the CoA, with methods and limits
• Whether testing must be done by a third-party or accredited lab
• Whether certificates must ship with the goods or arrive before shipment
• How long supporting records must be kept, in line with your regulatory obligations
• Your right to request raw data and to audit the supplier's testing

Clear requirements also strengthen traceability in manufacturing. Each certificate becomes a linked record from raw material to finished product, which is exactly what you need during a recall or a customer complaint investigation.

Frequently Asked Questions

Can a supplier issue a CoC without testing the product?

Yes, in many cases. A CoC is an attestation, and the supplier may base it on process controls, in-process inspection, or upstream certificates. Regulated categories are the exception. CPSC children's products, for example, must be certified based on third-party lab testing.

Is an EU Declaration of Conformity the same as a CoC?

Not exactly. An EU Declaration of Conformity is a legal document under the EU New Legislative Framework, and the manufacturer draws it up before CE marking. It covers a product type against EU directives or regulations. A commercial CoC usually covers a specific shipment against your purchase order.

How long should certificates be kept?

The answer depends on the framework. CPSC requires certificates and supporting records to be kept for five years. Under 21 CFR 211.180, US pharmaceutical batch records must be kept for at least one year after the batch expiration date. Aerospace and medical customers often require longer periods by contract, sometimes the life of the product.

Does a third-party lab CoA carry more weight than a supplier CoA?

Generally yes, because the testing is independent. That only holds if the lab is accredited for the specific method and the sample was traceably drawn from your lot. A third-party report on a sample that the supplier chose and shipped proves less than it appears to.

What if a CoA result is within limits but differs from my incoming test?

Treat it as a measurement discrepancy. Do not automatically accept or reject the lot. Compare methods, sample preparation, and equipment calibration on both sides. If the supplier's lab and yours keep disagreeing in the same direction, stop relying on the CoA until you find the cause.

Can I require both a CoC and a CoA on the same shipment?

Yes, and it is common. The CoC confirms that the whole order conforms to the PO. The CoA provides measured evidence for the critical material properties. Aerospace raw material purchases often require both.

Check Supplier Certificates On-Site With AMREP

A certificate tells you what a supplier claims. AMREP confirms what is actually on the factory floor. Our teams work across Mexico, China, Vietnam, India, Thailand, Malaysia, the Philippines, and other manufacturing regions. They verify supplier documents against physical products through witness testing, lab record reviews, and on-site quality inspection services. When certificate gaps keep recurring, our supplier quality engineering team works with your suppliers to fix the documentation system behind them. Contact AMREP to set up certificate verification for your next shipment.