A certificate of analysis arrives with every lot of a raw material, carries official-looking numbers, and gets filed as proof the ingredient meets spec. The trouble is a COA is only a claim until someone verifies it, and a supplier approval program that treats incoming paperwork as the verification step rather than one input into it is exactly where undetected adulteration and out-of-spec ingredients slip through. A program built around qualification, COA review, and periodic testing closes that gap, and plants rebuilding or tightening theirs can map their current supplier tiers against this framework in a short session.
Treat the COA as a Starting Claim, Not the Final Check
iFactory AI tracks supplier qualification status, flags a COA that falls outside historical pattern, and keeps periodic testing on schedule by risk tier.
Why a COA Alone Is Not Verification
A certificate of analysis tells you what a supplier's lab measured, or claims to have measured. It does not tell you whether that lab is reliable, whether the sample tested matches the lot shipped, or whether the result sits inside your own historical pattern for that ingredient.
The COA May Not Match the Shipped Lot
Without a lot-specific tie-back, a generic or templated COA can travel with a shipment it was never actually tested against.
No Independent Confirmation
A COA reflects the supplier's own lab, with no built-in check against your own incoming testing or a third-party reference.
Risk Tier Gets Set Once, Never Revisited
A supplier qualified as low-risk years ago may have changed ownership, sourcing, or process without the qualification being revisited.
The Four Steps of Supplier Qualification
Qualification is the one-time gate before a supplier ships its first approved lot, and skipping a step here tends to resurface later as a harder problem during an audit.
What a COA Verification Check Actually Covers
Verifying a COA means checking it against something, not just confirming it exists in the file.
See a COA Checked Against Your Own Historical Pattern
Bring a recent COA and your ingredient's typical range to a 30-minute session and see where a deviation would have been flagged.
Matching Testing Frequency to Risk Tier
Not every supplier needs the same ongoing scrutiny. Testing frequency and review depth should scale with the risk the ingredient and the supplier's history actually present.
| Risk Tier | COA Review | Incoming Testing | Reverification |
|---|---|---|---|
| High risk | Every lot, checked against historical range | Periodic independent testing on a defined schedule | Annual audit or more frequent |
| Medium risk | Every lot, spot-checked against range | Periodic testing on a longer interval | Audit on a multi-year cycle |
| Low risk | Reviewed on receipt for completeness | Testing triggered by pattern deviation only | Document review refresh, less frequent audit |
A tier assignment is not permanent. A supplier that produces a deviating COA, changes ownership, or has a documented incident should move up a tier regardless of its original approval date.
The programs that catch problems early are the ones where a COA review is actually compared against something, usually a running historical range per supplier and ingredient, rather than checked only for the presence of a signature and a date. Flagging a deviation automatically, instead of relying on a reviewer to remember what normal looks like across dozens of suppliers, is where most of the real protection comes from.
Frequently Asked Questions
How is this different from what FSVP already requires?
FSVP sets the regulatory floor for verification activities on foreign suppliers, but it does not specify the software or workflow used to track qualification status, COA pattern deviation, or testing schedules, which is where a structured program adds practical value beyond the minimum requirement. Review how this maps to your current FSVP documentation in a short session.
What counts as a COA falling outside the historical pattern?
A reported value that sits meaningfully outside the range your incoming data has established for that supplier and ingredient, rather than a single fixed pass or fail line, since normal variation differs by ingredient and supplier. Ask the iFactory AI team how pattern ranges are built from your own receiving history.
How often should an approved supplier be reaudited?
Frequency should follow the risk tier rather than a single fixed interval for every supplier, with high-risk ingredients and suppliers with any history of deviation reviewed more often than a consistently compliant low-risk supplier. Set a reaudit schedule that matches your supplier mix in a 30-minute call.
Can a supplier move between risk tiers after approval?
Yes, and it should, since an ownership change, a documented incident, or a pattern of deviating COAs are all reasons to move a supplier to a higher tier regardless of how long ago it was originally approved. Discuss tier-change triggers for your supplier base with the iFactory AI team.
Does this integrate with our existing ERP or quality system?
Supplier qualification status, COA records, and testing schedules are built to feed the ERP or quality management system your team already uses, rather than operating as a separate standalone log. Talk through your current system landscape with the support team.
Verify What the COA Claims, Not Just File It
iFactory AI tracks qualification, flags deviating COAs, and keeps periodic testing on schedule by risk tier. Book a walkthrough built around your own supplier list.
