A certificate of conformance is a supplier’s signed statement that a shipment meets the contract’s requirements; a certificate of analysis goes further and hands you the laboratory test results that prove the material meets its specifications. In short, a certificate of conformance versus a certificate of analysis comes down to declaration versus data. Which one you should require depends on how much risk the material carries, what your purchase order says, and whether a regulator has already made the choice for you.
What a Certificate of Conformance Is
A certificate of conformance (CoC) is a formal statement from a manufacturer or supplier confirming that the goods delivered match the purchase agreement. It speaks to the process and to overall compliance, not to individual measurements. The supplier is putting its name behind the claim that the items were built to spec, inspected under its quality system, and shipped in the correct quantity.
In U.S. government contracting, the Federal Acquisition Regulation defines the content precisely. The contractor certifies that the supplies conform “in all respects with the contract requirements, including specifications, drawings, preservation, packaging, packing, marking requirements, and physical item identification (part number)” and are in the quantity shown on the acceptance document.1Acquisition.GOV. 48 CFR 52.246-15 – Certificate of Conformance An authorized representative signs and dates it.
Outside government work, the format is flexible but the core elements stay the same: the manufacturer’s identity, the product (usually by part number), the purchase order reference, the quantity shipped, and a compliance statement. The signature is what gives the document weight. Without it, you have a shipping description; with it, you have a binding representation the supplier can be held to.
What a Certificate of Analysis Is
A certificate of analysis (CoA) reports the actual test data behind a specific batch. It lists each test performed, the measured results, and how those results compare against the acceptance criteria. Where a CoC tells you the supplier followed the process, a CoA lets you check the numbers yourself.
The World Health Organization’s model CoA for pharmaceutical products sets out the standard elements: product name and description, batch number, date of manufacture, the specification and acceptance limits for each test, and the actual numerical result against those limits.2World Health Organization. WHO Technical Report Series, No. 1010 – Annex 4 Model Certificate of Analysis If an active ingredient has a purity specification of 99.5 percent minimum, the CoA would show, say, 99.8 percent alongside that limit.
Every CoA is tied to a lot or batch number, which is what makes traceability possible. Months later, that number links the material back to its production run, the lab that tested it, and the technician who signed off. Results from subcontracted laboratories should be identified as such, and a qualified technician or quality control officer signs to certify accuracy.2World Health Organization. WHO Technical Report Series, No. 1010 – Annex 4 Model Certificate of Analysis
How the Two Documents Differ
The fundamental split is declaration versus data. Everything else follows from that.
- Level of detail. A CoC contains no test results. A CoA lists parameters, measured values, and acceptance ranges for every test performed on the batch.
- What it tracks. A CoC references the purchase order and confirms the shipment matches it. A CoA references the lot or batch and confirms the material’s chemical or physical properties.
- Who generates it. A CoC always comes from the manufacturer or supplier. A CoA can come from the manufacturer’s own lab or from an independent third-party facility.
- Risk it addresses. A CoC fits situations where the buyer trusts the supplier’s quality system and the material carries lower risk. A CoA fits situations where properties directly affect safety, efficacy, or performance.
The European standard EN 10204 formalizes this spectrum. It defines four inspection document types, from a simple declaration of compliance (Type 2.1, essentially a basic CoC), through a test report based on non-specific inspection (Type 2.2), up to inspection certificates with specific test results verified by the manufacturer (Type 3.1) or by both the manufacturer and an independent inspector (Type 3.2). Types 3.1 and 3.2 function as certificates of analysis. When a purchase order cites EN 10204, the type number tells you exactly what level of documentation the buyer expects.
Which Document to Request
The right choice depends on what a nonconforming product could do. For standard hardware like fasteners, brackets, or packaging materials from a supplier with a track record, a CoC is usually enough. You are confirming that the supplier followed its process and shipped the right parts; anything wrong should surface at incoming inspection or assembly.
A CoA is necessary when the material’s chemical or physical properties determine whether the end product works safely. Raw pharmaceutical ingredients, specialty chemicals, metals used in critical structural applications, and food-grade materials all fit here. A batch of stainless steel tubing going into a medical device needs measured tensile strength and composition data, not a promise that it was made correctly.
Some jobs call for both. A buyer might require a CoC for a finished assembly and CoAs for the raw materials that went into it. This layered approach is common in aerospace and medical device manufacturing, where both the process and the material properties carry consequences.
New suppliers are often held to the stricter document even for lower-risk materials. Once several shipments come through clean and the supplier’s results have been validated against independent testing, the buyer may drop back to a CoC for routine orders. That earned trust is exactly what the FDA envisions in its guidance on accepting supplier test results.
When Regulation or Contract Makes the Choice for You
Pharmaceutical and FDA-Regulated Products
The FDA’s current good manufacturing practice rules require manufacturers to test each lot of drug components for purity, strength, and quality before use. A manufacturer may accept a report of analysis from a component supplier in place of full testing, but only if it still runs at least one identity test on the material and has validated the supplier’s reliability through periodic checks of the supplier’s results. For containers and closures, release based on the supplier’s CoA plus visual identification is permitted once reliability is established.3U.S. Food and Drug Administration. Control of Components and Drug Product Containers and Closures
For active ingredients, a CoC alone is never enough. The regulations demand actual test data, and the manufacturer stays responsible for verifying that data regardless of what the supplier’s CoA says.
Government Contracts
Under the FAR, a contractor may ship supplies with a CoC only when the Contract Administration Office has authorized it in writing. Even then, the government keeps its right to inspect and can reject defective items after delivery, requiring the contractor to replace or correct them at the contractor’s expense.1Acquisition.GOV. 48 CFR 52.246-15 – Certificate of Conformance A CoC here is a convenience mechanism that substitutes for source inspection, not a waiver of quality obligations.
ISO 9001 Quality Management Systems
Organizations certified to ISO 9001 must maintain documented information sufficient to demonstrate that their processes are operating as planned.4International Organization for Standardization. Guidance on the Requirements for Documented Information of ISO 9001:2015 The standard does not itself dictate CoC or CoA for any specific material. Your quality management system has to define which incoming materials need test data and which can be accepted on a declaration, and auditors will check that the documentation matches your defined procedure.
The Purchase Order Itself
Beyond regulation, the contract often decides. A buyer might specify a CoA for raw chemical inputs and accept a CoC for finished metal components in the same assembly. Once both parties agree, those terms bind. If a product later fails and the supplier cannot produce the documentation the contract required, exposure grows sharply, regardless of whether regulation strictly required that document.
Penalties for Falsifying Either Document
Submitting a false CoC or CoA is not only a contractual breach. When the transaction involves the federal government or a federally regulated product, it can be a federal crime. Under 18 U.S.C. ยง 1001, anyone who knowingly makes a false statement or uses a fraudulent document in a matter within federal jurisdiction faces up to five years in prison.5Office of the Law Revision Counsel. 18 USC 1001 – Statements or Entries Generally If the false statement involves terrorism-related offenses or certain other specified crimes, the maximum rises to eight years.
The financial penalties are steep too. An individual convicted of a federal felony can be fined up to $250,000, or twice the gross gain or loss caused by the offense, whichever is greater. For organizations, the maximum fine climbs to $500,000, subject to the same gain-or-loss multiplier.6Office of the Law Revision Counsel. 18 USC 3571 – Sentence of Fine
Even without prosecution, a falsified certificate destroys supplier credibility in ways that outlast the contract. In aerospace and defense, a single falsified CoC can trigger debarment proceedings that lock a supplier out of government contracts entirely.