Certificate of Analysis Red Flags: What Gummy Manufacturers Must Catch Before Releasing Ingredients

Why COA Review Is a GMP Requirement, Not a Courtesy Check

Under 21 CFR Part 111, every dietary supplement manufacturer is required to establish specifications for each component used in production and to confirm that incoming materials meet those specifications before use. That confirmation process almost always begins with the supplier's Certificate of Analysis. But the regulation does not say that receiving a COA constitutes verification — it says you must verify. There is a meaningful legal and operational difference between those two things.

For gummy manufacturers specifically, this distinction matters more than it does in most other supplement formats. Gummies are moisture-sensitive, texture-sensitive systems where the functional performance of raw materials — bloom strength in gelatin, degree of esterification in pectin, water activity in finished coating sugars — has a direct and measurable effect on product quality, dose accuracy, and shelf life. A COA that lists a passing identity result but omits moisture content, or one that reports bloom strength without specifying the test method used, gives you a document but not assurance.

Every COA that comes through your receiving dock should be evaluated by someone trained to read it critically, not just filed as proof of receipt. If your incoming material review process consists of stamping a COA and moving the pallet to production-ready status, you are not in compliance with 21 CFR Part 111 — and you are one audit away from finding out the hard way.

The Most Common COA Red Flags in Gummy Ingredient Receiving

Not all COA problems look the same. Some are obvious — a result listed as "conforms" with no numerical value attached, or a test date that predates the shipment by fourteen months. Others are subtle and require familiarity with your specific ingredient categories to catch. Gummy facilities deal with a narrower but technically demanding set of raw materials, and your QA team needs to know what to look for in each category.

Gelatin COA Red Flags

• Bloom strength reported without method reference: Bloom is measured using standardized protocols (typically AOAC or British Pharmacopoeia methods), and the result is meaningless without knowing the method. A supplier reporting "Bloom: 200" without a method citation may be using an internal or non-standard test that does not correlate to your process requirements.
• Viscosity omitted entirely: Viscosity and bloom work together in gummy depositing. A COA that only lists bloom and skips viscosity is incomplete for gummy manufacturing applications.
• Heavy metals tested as a single "heavy metals" line: FDA increasingly expects individual metal results (lead, arsenic, cadmium, mercury) rather than a single combined screen. A composite result with a passing notation gives you almost no actionable information.
• pH range reported as a wide band: Gelatin pH affects gel formation in combination with acidulants. A COA showing a pH range of 4.5–7.0 tells you nothing about where your specific lot falls within that range.

Pectin COA Red Flags

• Degree of esterification not reported: High-methoxyl and low-methoxyl pectins behave completely differently in gummy systems. A COA that does not specify DE% should be treated as incomplete.
• Gel strength tested under conditions inconsistent with your formula: Pectin gel performance is pH- and sugar-concentration-dependent. If the supplier's COA does not note the conditions under which gel strength was measured, the number may not translate to your cooking and depositing parameters.
• Moisture content not listed or listed as "passes" with no value: Pectin moisture content directly affects your batch water activity and texture outcomes. A pass/fail notation without a percentage is not sufficient for gummy ingredient release.

Active Ingredient and Botanical COA Red Flags

• Identity testing performed by organoleptic evaluation only: Smell and appearance are not identity tests. For botanicals and standardized extracts used in gummies, HPLC, FTIR, or DNA barcoding should be specified on the COA.
• Potency expressed as a range without a mean value: If a COA says an extract "contains 5–8% active compound," that range may be too wide to support your label claim without your own confirmatory testing, especially given moisture loss during gummy cooking.
• Microbiological results that do not match your finished product risk profile: Ingredients that will be cooked may tolerate higher incoming bioburden, but coating ingredients and post-cook additions must meet stricter limits. A COA for a post-cook botanical that shows yeast and mold counts near your finished product specification limit should raise an immediate flag.

Sugar, Syrup, and Coating Ingredient COA Red Flags

• Water activity not reported for hygroscopic coating sugars: Coating materials are a primary driver of finished gummy water activity shift during shelf life. A COA for a coating sugar that omits Aw is missing a critical parameter for gummy shelf stability prediction.
• Dextrose equivalent (DE) not listed for glucose syrups: DE affects sweetness, hygroscopicity, and crystallization behavior in your gummy matrix. Different DE values from the same supplier across lots can cause texture batch-to-batch variation that is difficult to trace without this data.

Building a COA Review SOP That Catches What the Eye Misses

A written, trained, and enforced COA review procedure is not optional under 21 CFR Part 111 — it is part of your component testing and examination program. But most gummy facilities either have no formal SOP for COA review, or they have one that is generic enough to miss ingredient-specific requirements. Your SOP needs to be built around the ingredients you actually use.

The core structure of an effective COA review SOP should include a required parameter checklist for each ingredient category, a clear decision tree for what happens when a parameter is missing versus when a parameter fails, escalation steps for borderline results, and a documentation requirement that records not just the COA but the reviewer's findings. The SOP should also define who is qualified to perform COA review — this should not be a receiving clerk function for technically complex ingredients.

One of the most practical tools you can build is an ingredient-specific COA acceptance template. For each approved ingredient on your Approved Supplier List, create a form that lists every parameter your specification requires, the acceptable range for each, and the test method you expect the supplier to use. When a COA comes in, the reviewer completes the form rather than reading the COA freehand. This structure dramatically reduces the chance that a missing parameter is overlooked, and it creates a documented record that shows your QA team actively evaluated the COA rather than simply filing it.

For NSF GMP certification and many third-party retailer audits, this level of documented COA review is expected as a baseline. Auditors from NSF and certification bodies like UL will ask to see your COA review records alongside your component specifications, and they will check whether the two documents are consistent with each other.

When a COA Red Flag Requires Confirmatory Testing

Not every COA deficiency requires you to reject the material outright. In some cases, the right response is to hold the material in quarantine and perform your own confirmatory testing before making a release decision. Understanding when each response is appropriate is part of building a compliant and operationally functional receiving program.

Confirmatory testing is appropriate when a COA parameter is within your specification but at or near the limit, when the supplier has had prior COA discrepancies that your ongoing monitoring program has flagged, when you are receiving a new lot from a supplier whose recent lots have shown variability, or when a COA omits a parameter that is critical to your process but the material is otherwise acceptable. For gummy manufacturers, bloom strength near the low end of your specification, moisture content at the upper boundary for pectin, or water activity data that is close to your finished product stability threshold would all be examples of situations where hold-and-test is the right call.

Your component specifications, developed as part of your 21 CFR Part 111 quality system, should define the test methods and acceptance criteria for any confirmatory testing you perform in-house or send to a third-party laboratory. The results of that testing must be recorded and linked to the lot in question before a release decision is documented. If you release a material based on confirmatory testing rather than the supplier COA alone, that decision should be clearly noted in your batch production record and component examination log.

There are also situations where the right answer is unconditional rejection regardless of confirmatory testing capability. If a COA shows a pathogen-positive result for a material that will be used in a post-cook addition, no in-house confirmatory test changes that decision. If a COA for a botanical extract shows pesticide residue results that exceed your specification limits, the lot should be rejected and your supplier notified formally in writing. These rejection events should feed into your CAPA system and your ongoing supplier qualification monitoring process — a single rejected lot is a data point; two rejected lots from the same supplier in a rolling period is a qualification event that requires formal review.

Integrating COA Review Into Your Broader Quality System

COA review does not exist in isolation. It is one control point within a larger incoming material management system that includes your approved supplier qualification program, your component specifications, your quarantine and release procedures, and your batch record documentation. For gummy facilities, these systems need to be designed with the specific sensitivities of gummy ingredients in mind — because a deviation in gelatin bloom strength, pectin moisture, or active ingredient potency that might be manageable in a tablet or capsule operation can produce an entire depositing run of unusable product in a gummy facility.

One of the most valuable things a gummy manufacturer can do is to build a COA trending database for each approved ingredient. Over time, tracking the actual reported values for critical parameters across multiple lots and suppliers gives you early warning of supplier drift — a situation where a supplier's product is still within specification but moving consistently in one direction. Catching that trend before it crosses your specification limit lets you address the issue proactively rather than reactively.

Amazon supplement compliance requirements, which increasingly mirror NSF GMP audit criteria, include documentation of your testing and quality review processes for raw materials. If your COA review records are disorganized, inconsistently documented, or absent for certain ingredient categories, those gaps become leverage points during an Amazon compliance review just as they would during an FDA inspection. Building a clean, auditable COA review record from the point of receiving forward is not just a GMP exercise — it is a commercial protection strategy for gummy brands selling through any major retail or e-commerce channel.

If you are unsure whether your current COA review process meets the standard that FDA investigators and third-party auditors will expect, a structured gap assessment is the fastest way to find out. GummyGMP LLC works exclusively with gummy supplement manufacturers to build and strengthen the quality system components — including incoming material controls — that protect your product, your facility rating, and your brand.