Certificate of Analysis Tracking (Free Excel Log)

Certificate of analysis tracking means keeping a written specification for every ingredient you ask a certificate for, logging each certificate against the exact lot it arrived with, checking every result against the specification, and holding the lot until it passes or the paperwork turns up. A certificate of analysis (CoA) is the supplier's report of test results for one lot: the tests, the methods, the limits and the actual results, with the lab and the date. Below is what a good one shows, what the FDA rules ask of you, a month of certificates logged at a small food business, and a free Excel log that flags anything out of spec or missing.

The short version

• Write the spec first: for each ingredient, the tests you want and the limit for each.
• A CoA belongs to one lot. Check that its lot number matches the delivery before you read anything else.
• Log one row per result, against the spec. "Conforms" with no number isn't a result.
• No certificate, or a result out of spec: the lot waits on hold until it's sorted.
• Now and then, send a sample to your own lab. A certificate you never check is the supplier's word.
• TaroStack holds a delivery for inspection at receiving and keeps your CoA checks on the lot itself. More below.

What a certificate of analysis is

A specification sheet describes a product in general: what it is, what it's meant to meet. A certificate of analysis is about one lot: this drum, this bag, tested on this date, with these results. The difference matters, because the second is the only one that tells you anything about what's on your dock.

A good certificate shows:

What the rules ask

For food facilities under FDA's preventive controls rule with a supply-chain program, sampling and testing of an ingredient is one of the listed supplier verification activities, alongside onsite audits and reviewing the supplier's food safety records (21 CFR 117.410(b)). The supplier may test a particular lot and send you the results, provided you review and assess them and document that review (21 CFR 117.415(a)(4)). The record of testing must identify the ingredient (with the lot number, as appropriate) and the number of samples, the tests and analytical methods, the test and report dates, the results, any corrective actions, and the laboratory (21 CFR 117.475(c)(8)).

Dietary supplement makers have a more specific rule. For components other than a dietary ingredient's identity, you can rely on a supplier's certificate of analysis instead of testing yourself, but only after you've qualified the supplier by confirming its results, and only if the certificate describes the methods, limits and actual results. You keep the records of how you qualified the supplier, re-confirm periodically, and quality control approves it. A dietary ingredient's identity still needs at least one test or examination of your own (21 CFR 111.75(a)).

Cosmetics have no FDA rule on certificates, but buyers, insurers and retailers ask for them anyway. This is general information, not legal advice; your food safety plan, your quality control people and your auditor have the last word.

The specification, filled in

Windward Roots, the made-up taro business I use in these examples, started buying ingredients for a macadamia and cinnamon cookie in September 2026 and asked each supplier for a certificate with every lot. Its specifications (examples, not recommendations):

The log, filled in

The cinnamon passed the test everyone worries about and failed the dull one. Moisture of 12.8% against a 12% limit isn't dangerous, but it's what the spec says, and a spice that clumps in the mixer ruins a batch. Ana held the lot, called the supplier, and sent it back. The coconut arrived with no certificate at all, so it waited on the shelf, held, until the supplier emailed one, and then it was checked like any other.

Trust, but check now and then

A certificate is a document the supplier wrote about its own product. Most are honest and most are right, but the only way to know is to test a sample yourself once in a while: when you approve a new supplier, once a year after that, and whenever something looks off. For supplements that confirmation is required before you rely on the certificates at all; for everyone else it's what turns a pile of paper into evidence.

Lots and their supplier codes are covered in what is lot tracking, and where the supplier's lot number goes at the door in the food receiving log.

Get the log

Download the certificate of analysis log. It has the specifications tab and the CoA log with this month filled in, the check worked out for you (a miss turns the row red), and room down to row 200. It's an ordinary Excel file with no macros, and it works in Google Sheets, LibreOffice and Numbers.

Check   =IF(E2="N","NO CoA",IF(H2="Max",IF(G2<=I2,"In spec","OUT OF SPEC"), ...))

Max means at or under, Min at or over, and Equals means the result must match, such as Negative.

Where this stops working

A CoA log on its own is a list of paper. It knows the cinnamon lot was out of spec; the shelf doesn't. Unless someone also tapes a sign to the bag and tells the kitchen, the held lot sits beside the good stock looking exactly like it, and the person making Thursday's batch reaches for whichever is nearest. And six months later, when a buyer asks for the certificate behind the cinnamon in lot C260922, you're matching dates by hand across a receiving log, a CoA folder and a batch sheet.

How TaroStack does it

In TaroStack, the hold happens at the door. Receiving a delivery has a box to hold everything for inspection, and a business can make that the rule for every receipt, so new stock lands in quarantine instead of on the shelf. Held stock isn't usable: it's left out of what you can sell, what a batch can use, the pick list and the reorder list, until someone releases it. Your CoA checks go on the receipt and the lot as your own checklist fields (CoA received, the moisture result, who reviewed it), so the certificate's verdict and the stock are one record.

Because recording a batch notes which lots it used, any batch leads straight to the cinnamon lot in it and the supplier's lot code behind it, and a supplier lot that turns out to be bad later is one recall report away from every batch and customer it reached (how that trace works is in track ingredients by lot). If it's rejected, sending it back or writing it off records the reason and what it cost.

Receiving, lots, holds and recalls are on every plan, from $49 a month, and the first 30 days are free. Your suppliers and items import from a spreadsheet. If you'd like a hand setting up, ask, and we'll do it with you.

Questions people also ask

What is a certificate of analysis?

A supplier's report of test results for one specific lot of a product: the tests, the methods, the limits, the actual results, the lab and the date, usually signed. It's different from a specification sheet, which describes the product in general.

Do I need a CoA for every lot?

Only if your own program says so. Many businesses ask for one with every lot of higher-risk ingredients and periodically for the rest. Under FDA's preventive controls rule, supplier testing of a lot counts as verification only if you review it and document the review.

How do you verify a certificate of analysis?

Check the lot number matches what arrived, the tests are the ones you asked for, each result is an actual value within your spec, and the date and lab make sense. Then, now and then, test a sample yourself and compare.

How long should CoAs be kept?

As long as the records they support. Records required by FDA's preventive controls rule are kept for at least 2 years after they're made (21 CFR 117.315), and buyers or your own quality system may ask for longer.