A peptide certificate of analysis is verified only when the analyzing laboratory confirms the lot from its own report register against a sample identifier obtained independently of the supplier. A document chain that starts and ends with a supplier-issued PDF has not been verified at all.
A supplier emails a PDF carrying a lot number, a purity figure, a laboratory name, and a signature block, and the lot number matches the one printed on the vial label. Most incoming-goods procedures stop there and record the certificate as verified. It has not been verified. It has been read. Verification is an act performed against records the supplier does not control — the analyzing laboratory's own report register, queried against a sample identifier that never passed through the supplier's hands. A document chain that begins with a supplier-issued PDF and ends with the same PDF has established internal consistency and nothing more.4
What 'verified' means before any document is read
The Regulatory Procedures Manual glossary defines an audit sample by its purpose: it exists to verify analytical results that a certificate of analysis, or a private laboratory analysis, purports to show. The definition presumes that the certificate is the claim and that something outside the certificate does the verifying.4
A sample collected to verify analytical results provided by a certificate of analysis or private laboratory analysis purporting to show that a product complies with applicable law or regulations.
FDA Regulatory Procedures Manual, Ch. 11 — Glossary, definition of audit sample4
Two features of that definition change how a purchasing file should be built. First, the verifying activity is sample collection followed by analysis, not field-by-field comparison of a document against a label. Second, the object being verified is the analytical result, not the paper. A certificate can be typographically flawless, correctly signed, and consistent with every other document in the shipment while still describing an analysis that was never performed on the material in the box.4
That leaves exactly one party able to confirm that a certificate corresponds to a real analysis of a real sample: the laboratory named on it. The laboratory holds the report register, the sample login record, and the chain-of-custody entry. Everything else in the transaction — label, packing list, invoice, certificate — is generated or forwarded by the party being checked. Reconciliation among supplier-issued documents is a useful screen and a poor substitute.4
What ICH Q7A actually requires a certificate of analysis to contain
Before a laboratory is contacted, the certificate has to survive a content screen, and the content standard is published. FDA guidance on control of components and drug product containers points to Section 11.4 of ICH Q7 for the fields an active pharmaceutical ingredient manufacturer's certificate should carry. Q7A itself sets out what the test section must show and who has to sign it. A certificate missing these fields fails before lot traceability is even at issue.2,3
| Field on the certificate | Source of the requirement | What its absence signals |
|---|---|---|
| Material name and grade | ICH Q7 Section 11.4, cited in FDA components guidance | The document cannot be tied to a specific SKU |
| Batch or lot number | ICH Q7 Section 11.4, cited in FDA components guidance | There is nothing to reconcile against a label or register |
| Date of release | ICH Q7 Section 11.4, cited in FDA components guidance | The certificate cannot be placed in time relative to receipt |
| Each test performed, with acceptance limits and numerical results | ICH Q7A guidance | Pass/fail wording is a conclusion, not data |
| Name, address, and telephone number of the original manufacturer | ICH Q7A guidance | The manufacturing origin is unreachable for confirmation |
| Date and signature of authorized quality unit personnel | ICH Q7A guidance | No identified person accepted responsibility for the result |
The numerical-results requirement carries more weight than buyers usually give it. A certificate reporting a test as compliant, without the limit applied and the figure obtained, cannot be checked against a laboratory report at all. There is no value to compare. Documents built this way are unfalsifiable by design, and the pattern shows up disproportionately in fabricated certificates because the fabricator does not need to invent internally consistent numbers.3
Meeting this content baseline is a screening pass and nothing more. Q7A does not treat a well-formed certificate as a permanent license to skip testing: the guidance recommends that the reliability of a supplier's certificates be checked at regular intervals rather than accepted on a one-time basis. Reliability is a property of an ongoing relationship, re-established on a schedule, not a status conferred once at onboarding.3
Repacked lots: the original batch certificate has to travel with the new one
Peptide material frequently reaches a wholesale buyer after a repack or reprocessing step, and the certificate that arrives is the repacker's, not the original manufacturer's. Q7A addresses that case directly. When a repacker or reprocessor issues a new certificate of analysis, it must show the name, address, and telephone number of the laboratory that performed the analysis, reference the name and address of the original manufacturer and the original batch certificate, and have a copy of that original certificate attached.3
- The analyzing laboratory identified by name, address, and telephone number — not a logo, and not the phrase 'third-party tested'
- A reference to the original manufacturer by name and address
- A reference to the original batch certificate, identifying the batch it covers
- A copy of that original batch certificate, attached to the new one3
This is the provision that decides whether a lot number means anything after a repack. A repacker-issued certificate with no original manufacturer named and no original batch certificate attached documents a repacking event, not a chain of custody for the material. The repack lot number is then a new identifier with no ancestry — traceable forward to the shipment and backward to nothing. Buyers who accept that structure are holding a document that cannot be reconciled past the last party who touched the vials.3
The four places a lot number has to match before stock is released
In practice, reconciling a lot number resolves to four comparison points, and the fourth is the one that constitutes verification. FDA's dietary supplement CGMP compliance guide requires that a unique identifier be used when recording the disposition of each unique lot within each unique shipment of components received, which fixes the receiving record as a formal comparison point rather than a filing convenience.5,2
- The vial or primary container label. Read the lot number off the container itself, not off the carton insert or the shipping manifest, because the container is what will still exist after the packaging is discarded.
- The certificate header. The lot or batch number on the certificate must match the container exactly, character for character. A leading zero, a suffix letter, or a hyphen difference is a mismatch, not a typographical variant, and is resolved by the supplier before receipt is completed, not after.
- The receiving record and packing list. Each unique lot within each unique shipment gets its own unique identifier and its own disposition entry, so that a later inquiry resolves to one lot in one shipment rather than to a purchase order number covering several.
- The analyzing laboratory's report register. The laboratory is asked to confirm that it holds a report for a stated sample identifier, that the report covers the lot in question, and that the numerical results on file match the numerical results on the certificate in the buyer's hands.2,5
Points one through three are internal consistency checks across documents that the supplier produced or forwarded. They catch clerical error and careless fabrication. They cannot catch a certificate fabricated carefully, because a competent fabricator makes those three agree. Point four is the only comparison that reaches a record outside the supplier's control, and it is the point most incoming-goods procedures omit — usually because no one collected the laboratory's contact details at quote stage.5
Why identity can fail even when the certificate is genuine
FDA's guidance on control of components treats identity as a discrete variable at the moment it is tested: a component either is or is not what its label states, with no partial credit and no trend line. That framing separates identity from the continuous attributes — purity figures, water content, residual solvents — where a laboratory result and a warehouse reality can drift apart gradually. What can shift after testing is not the identity finding itself but which container it applies to.2
The same guidance explains how a genuine certificate ends up attached to the wrong material. Container contents can differ from the label because of filling or labeling mistakes, or because of substitution during distribution and warehousing before receipt. Each of those events happens after the analysis was performed and after the certificate was issued. The certificate remains an accurate description of the sample the laboratory analyzed; it simply stops describing what is inside the container that arrived.2
This is why a laboratory-side confirmation and a physical identity test answer different questions and neither replaces the other. The laboratory confirms that the certificate describes a real analysis of a real logged sample. An identity test on the received lot confirms that the material in the container is the material named on the label. FDA's components guidance requires the second test regardless of what the first has already confirmed; FDA Warning Letter 729345, issued to Woodbine Products Company Inc. on July 27, 2026, is one instance of that requirement being enforced against a firm that had relied on a supplier's certificate alone.2,1
What 'qualifying a supplier's certificate' actually requires under FDA guidance
Firms often describe a supplier as qualified without being able to state what the qualification consisted of. FDA's guidance on components and containers ties reliance on a certificate to two conditions: the reliability of the supplier's results has to be established through initial validation and confirmed again through periodic revalidation, and at least one specific identity test still has to be run on each incoming component lot regardless of what the certificate reports. FDA Warning Letter 729345 to Woodbine Products Company Inc. shows those conditions applied to a single firm's facts — a certificate accepted without that validation and without the per-lot identity test. Certificate acceptance is a reduced-testing arrangement, not a no-testing arrangement.2,1
- Initial validation. The supplier's reported results are compared against the buyer's own or a contract laboratory's results on the same material, and the comparison is documented as the basis for later reliance.
- Periodic revalidation. The comparison is repeated on a schedule. ICH Q7A frames the same obligation as checking the reliability of a supplier's certificates at regular intervals rather than accepting them once.
- A specific identity test on every incoming lot. FDA's components guidance requires at least one identity test on each incoming component lot regardless of what the supplier's certificate reports; FDA Warning Letter 729345 to Woodbine Products Company Inc. is an example of that requirement being enforced.
- Documented supplier qualification. FDA's dietary supplement CGMP compliance guide requires the receiving firm to document how it qualified the supplier and to periodically re-confirm the supplier's certificate of analysis.
- Certificate content sufficient to be checked. The same guide requires the certificate to include a description of the test methods used, the limits applied, and the actual results obtained.1,2,3,5
Read together, these requirements dissolve the idea of a permanently trusted supplier. Reliance on a certificate is earned by comparison, kept alive by re-comparison on a schedule, and bounded by a per-lot identity test that never goes away. A supplier who cannot name the laboratory that generated a result, or who resists a buyer sending material out for independent comparison, has made initial validation impossible — which is a qualification finding, not a relationship problem.1,5
Audit samples and split samples: the two ways a lab confirms a lot independently
FDA's own procedures name the two mechanisms a buyer can invoke, and naming them correctly in correspondence changes how a laboratory responds. An audit sample is collected to verify analytical results provided by a certificate of analysis or private laboratory analysis. A split sample is defined more simply, and it is the mechanism for a comparison rather than a confirmation.4
A sample divided into two or more portions for analysis by two or more laboratories.
FDA Regulatory Procedures Manual, Ch. 11 — Glossary, definition of split sample4
The audit sample route asks the named laboratory a closed question about its own records: does a report exist under sample identifier X, does it cover lot Y, and do the reported figures match the document in circulation. The sample identifier is the load-bearing element. If it was supplied by the vendor along with the certificate, it proves nothing, because a fabricated certificate carries a fabricated sample identifier that the fabricator will happily confirm. It has to come from the laboratory's own login record.4
The split sample route settles a disputed figure rather than a disputed document. Material from the received lot is divided and sent to two laboratories, one of which may be the laboratory named on the certificate, and the results are compared attribute by attribute. Split samples resolve method disagreements and quantitation disputes. Audit-sample confirmation resolves whether the certificate describes an analysis that happened at all. Buyers routinely commission the first when the second is the open question.4
Putting the verification requirement into the purchase order, not the dispute email
Every mechanism above depends on information that is easy to obtain at quote stage and nearly impossible to obtain during a dispute. Once a mismatch has surfaced, the supplier's incentive to identify the analyzing laboratory collapses. The requirement therefore belongs in the purchase order terms, tied to release of stock and to payment, with the specific fields named rather than gestured at.5
- The analyzing laboratory named on every certificate, with address and telephone number, matching the ICH Q7A field requirement rather than a brand mark.
- A sample identifier assigned by that laboratory for each lot, stated on the certificate, with the supplier's written authorization for the laboratory to confirm the corresponding report directly to the buyer.
- A unique lot identifier recorded for each unique lot within each unique shipment, as the disposition record requires, so that later inquiries resolve to one lot rather than one purchase order.
- For repacked material, the original manufacturer named and the original batch certificate attached, as a condition of receipt rather than a document to be requested afterward.
- Release of stock and clearance of payment conditioned on laboratory-side confirmation and on the buyer's own specific identity test for the lot.
- A stated remedy for a lot number mismatch across label, certificate, receiving record, and laboratory register — return, replacement lot, or credit — agreed before the first shipment.5,3,1
What changes is the receiving procedure, not the org chart: the four comparison points have to be written down, the fourth one has to be reachable because the laboratory's details were captured at quote stage, and the identity test on each incoming lot has to be treated as non-optional. A lot verified this way can be defended to an auditor with records held by three separate parties. A lot cleared on a supplier PDF can be defended with one.1,5