SOP: Certificate of Analysis Review and Incoming Material Disposition

This is a ready-to-use SOP for reviewing a Certificate of Analysis (CoA) and dispositioning an incoming lot. Replace every <<FILL: ...>> placeholder with your own specifics, set your document numbers and dates, and route it through your normal document control, review, and approval. A worked filled specimen follows the template. This is general guidance to adapt and verify, not legal or regulatory advice; confirm each cited regulation against the current source before you rely on it.

Document control header

1. Purpose

This procedure defines how <<FILL: COMPANY NAME>> reviews a supplier Certificate of Analysis against the internal, approved specification and dispositions the lot for use or rejection. The objective is a defensible, documented release decision that never accepts material failing your own specification and never relies on a supplier certificate without the per-lot check the regulation requires.

2. Scope

This procedure applies to CoA review for all incoming GMP materials, including raw materials, excipients, active pharmaceutical ingredients, drug substance, primary packaging components, and, where applicable, contract-tested materials. It covers both the Certificate of Analysis (numeric results per lot) and the Certificate of Compliance or Conformance (a conformance statement without results). It does not cover finished-product release, which is governed by <<FILL: SOP-ID for finished-product disposition>>, or supplier qualification, governed by <<FILL: SOP-ID for supplier qualification>>.

3. Responsibilities

4. Definitions

• Certificate of Analysis (CoA): a document issued by the testing party listing, for a defined lot, each test performed, the method or reference used, the acceptance criterion, the actual result, and an overall conformance conclusion.
• Certificate of Compliance / Conformance (CoC): a statement that a lot meets stated requirements, usually without numeric results. A CoC alone does not support release of an attribute that requires a numeric result.
• Controlled specification: the internal, approved, current-version specification for the material. This is the master against which the CoA is judged, not the supplier’s own limits.
• Per-lot in-house check: the test the receiving site performs on every lot regardless of CoA reliance. For components, at least one specific identity test (21 CFR 211.84(d)(2)); for drug product containers and closures, at least a visual identification (211.84(d)(3)).

5. Procedure

5.1 Confirm receipt and quarantine

Confirm the material is in quarantine and cannot be used until dispositioned. Retrieve the CoA (and any CoC), the purchase order, and the packing slip.

5.2 Match the lot

Compare the lot number, material name, and grade on the CoA against the physical container labels, the purchase order, and the packing slip. All must agree. A mismatch (wrong certificate, one CoA covering multiple lots, or a certificate copied forward from a prior lot) is a quarantine event: stop and raise a deviation per <<FILL: SOP-ID for deviations>>.

5.3 Confirm the source is qualified

Confirm the CoA issuer is a qualified manufacturer on the approved supplier list, and that the supply chain, including any distributor or repackager, is qualified end to end. A distributor’s own CoC over an unqualified manufacturer’s certificate is not acceptable.

5.4 Pull the controlled specification

Open the internal approved specification for this material at its current version. Record the specification number and version on the review record so the comparison is traceable.

5.5 Compare test coverage and limits

1. Confirm the CoA lists every test in your current specification. Any test in your spec that is absent on the CoA is a gap; the material is not fully certified.
2. Confirm each CoA acceptance limit meets or is tighter than your specification limit. If the CoA limit is wider than yours, judge the actual result against your tighter limit.

5.6 Walk every result against your criterion

For each test, confirm the actual result satisfies YOUR acceptance criterion. Check units and limit direction (a “not more than” versus a “not less than” limit). For ranges, confirm the result falls inside. For descriptive tests, confirm the recorded outcome matches. A “conforms” stamp against the supplier’s looser limit is not a pass against yours.

5.7 Run the required per-lot in-house check

Sample per the applicable sampling plan and perform the mandatory per-lot check: for components, at least one specific identity test; for containers and closures, at least a visual identification. Confirm the in-house result matches the CoA identity claim. For materials not under reduced testing, run the full incoming test panel and judge those results the same way. Reduced or skip-lot testing, where applied, is governed by <<FILL: SOP-ID for reduced testing>>.

5.8 Check dates and lifecycle attributes

Confirm the date of analysis follows the manufacture date. Assign material expiry or retest from the manufacture or retest date on the CoA. Flag a certificate with an old analysis date or a missing retest date where one is needed.

5.9 Disposition and record

1. If every check passes, release the lot; the quality unit records the release decision, signed and dated.
2. If any check fails (lot mismatch, missing test, a result failing your spec, a failed identity check, or an unresolved out-of-specification condition), reject or hold the lot, open a deviation, and notify supplier quality.
3. Retain the CoA, the in-house test data, the spec version compared against, and the disposition record together as the release package.

6. Acceptance criteria

The review is complete and defensible when all of the following are true:

• Lot, material, and grade match the physical material, the purchase order, and the packing slip.
• The issuer is a qualified source and the supply chain is qualified end to end.
• Every test in the current specification is present on the CoA with a method reference.
• Every result meets your own acceptance criterion, with units and direction verified.
• The required per-lot in-house check was performed and matches the CoA identity claim.
• Dates are consistent and expiry or retest is assigned.
• The disposition is recorded, signed, and dated, with the full release package retained.

7. References

21 CFR 211.84 (testing and approval or rejection of components, drug product containers, and closures), including 211.84(d)(2) for components and 211.84(d)(3) for containers and closures. 21 CFR 211.165 (testing and release for distribution) and 211.194 (laboratory records). ICH Q7, Good Manufacturing Practice Guide for Active Pharmaceutical Ingredients, Section 11.4 (certificates of analysis). EudraLex Volume 4, EU GMP Guide, Chapter 6 (Quality Control). ISO/IEC 17025 (general requirements for the competence of testing and calibration laboratories) where a contract lab issues the CoA.

Confirm the current version and clause numbers of each reference before issue.

8. Record generated: CoA review and disposition record

9. Revision history

10. Approvals

Filled specimen

The following shows the record completed for an example purified excipient lot, so you can see the level of detail an inspector expects. The company, material, and numbers are illustrative; replace them with your own.

In this example, the CoA reported loss on drying of 0.7%. The supplier’s certificate stated “conforms” against its internal limit of not more than 1.0%, but SPEC-RM-0142 v4.0 sets not more than 0.5%. The reviewer judged the result against the internal limit, held the lot rather than releasing on the supplier’s stamp, opened a deviation, and notified supplier quality to resolve whether the lot is genuinely out of the internal specification or whether the specifications need alignment. The identity test still passed and was recorded, because the per-lot check is performed regardless of the disposition outcome.

Common inspection findings this SOP prevents

• Releasing material against the supplier’s looser limit instead of your own tighter specification.
• Relying fully on the supplier CoA with no per-lot in-house identity or visual check.
• A CoA lot number that does not match the container, or one certificate used to release several lots.
• A test in the current specification missing from the CoA, unnoticed because the reviewer only checked that present rows passed.
• Specification version drift: the internal limit was tightened but incoming review still compares to the old limit.
• Material released with the CoA on file but no record of who reviewed it, when, or against which specification version.

How to adapt this SOP

1. Set your document number, owner, and effective date in the header.
2. Point the cross-references in sections 5.2, 5.7, and 5.9 to your real deviation, reduced-testing, and supplier-qualification procedures.
3. Attach or reference your sampling plan for the per-lot in-house check.
4. If you receive electronic or structured CoAs, add the authenticity and system controls for those to section 5.1.
5. Confirm every regulation in section 7 against the current published version before issue.