Most food brands accept supplier-provided test results without asking a single question about the lab behind them. Here’s why that gap is more dangerous than it looks — and what independent verification actually means.
Every food brand has a supplier. Most have dozens.
And most of those suppliers send along test results with every shipment. A certificate of analysis showing the ingredient is within spec. A microbial screen confirming no pathogens detected. A potency report backing the label claim.
The paperwork looks right. The numbers are there. The box gets checked.
What almost nobody asks: who ran that test?
The supplier COA problem
Supplier-provided COAs are everywhere in the food industry. They’re standard practice, expected by buyers, and seemingly rigorous. But “supplier-provided” is doing a lot of work in that phrase.
Here’s what supplier testing often actually means:
- An in-house lab with no independent accreditation: the supplier built a lab, hired technicians, and ran tests on their own product. There is no external verification of their methods, equipment, or data integrity.
- A third-party lab with a long-standing supplier relationship: the supplier contracts with a lab they’ve worked with for years. That lab depends on the supplier’s business. The financial relationship creates an implicit incentive to produce clean results.
- Methods not validated for your specific matrix: accreditation covers specific test methods applied to specific product types. A method validated for one matrix may not be appropriate for another — but the COA won’t tell you that.
- No chain of custody: the sample travels from the supplier’s facility to their lab with no independent documentation of how it was handled, stored, or processed before testing.
None of this means supplier testing is fraudulent. Most of it isn’t. But it means the result is unverified — and in food safety, unverified isn’t good enough.
Your supplier says it’s safe. The question is whether anyone independent has verified that.
What “independent verification” actually means
Independent verification means a lab with no financial relationship to your supplier, operating under ISO/IEC 17025 accreditation, running validated methods on a sample with a documented chain of custody.
That combination matters for a specific reason: it removes every structural incentive for the result to be anything other than accurate.
The accreditation body doesn’t care whether the result is clean or flagged. The independent lab doesn’t have a contract renewal on the line. The chain of custody ensures the sample that was tested is the sample that shipped.
That’s a fundamentally different kind of result than a supplier COA — even when both show the same number.
Three situations where the difference becomes critical
1. A retailer qualification
Major retail buyers — Whole Foods, Costco, Target, and others — increasingly require independent, accredited test data as a condition of shelf placement or SKU approval. Supplier COAs don’t qualify. Brands that have been relying on supplier-provided documentation often discover this gap at the worst possible moment: when a buyer asks for accredited results and the brand doesn’t have them.
2. An FDA inspection
FDA investigators reviewing a food safety program don’t just look at whether testing was done. They look at who did it, how, and whether the process was independently verified. Supplier-provided COAs from unaccredited labs carry significantly less weight in an inspection than results from an independent, ISO 17025 accredited facility. In a consent decree or warning letter scenario, this distinction can be the difference between a manageable finding and a major enforcement action.
3. A contamination event or recall
When a product is implicated in an illness event or regulatory action, the entire testing record gets scrutinized. Plaintiff attorneys, FDA investigators, and insurance adjusters all ask the same question: was this testing independent and defensible? Supplier COAs from in-house labs don’t pass that test. The brand that relied on them is now in the position of defending results generated by the same entity that had a financial interest in producing them.
The most common scenario we see
A mid-size food or supplement brand has been purchasing ingredients from the same supplier for three to five years. The supplier sends COAs with every shipment. Results are consistently clean. The QA team files them, the procurement team is satisfied, and nobody asks questions.
Then one of the following happens:
- A major retail buyer requests accredited independent test data for a new SKU review
- The FDA issues a warning letter to the supplier — which triggers scrutiny of every brand purchasing from them
- A consumer complaint triggers an internal investigation that reveals the brand has no independent verification of any ingredient claims
At that point, the brand is starting from zero. They need to re-test every active SKU, rebuild their documentation, and explain to buyers and regulators why they were relying on supplier-provided data without independent verification.
That process takes months and costs significantly more than an independent testing program would have.
What independent verification looks like in practice
At Genista, independent verification means your ingredient or finished product sample is tested by an ISO 17025 accredited lab with no relationship to your supplier — using validated methods appropriate for your specific matrix, with full chain of custody documentation from receipt to result.
For brands that source from multiple suppliers, we build ongoing independent verification into the testing program: every supplier, every shipment category, on a cadence calibrated to risk level and production volume.
The result is a testing record that holds up to a retailer audit, an FDA inspection, or a legal proceeding — because it was built to be defensible, not just to check a box.
The question worth asking today
For every ingredient in your supply chain, ask: if the FDA showed up tomorrow and asked to see independent, accredited verification of this supplier’s results, could you produce it?
If the answer is no — or “I think so” — that’s worth addressing before it becomes urgent.
Independent verification isn’t a redundancy. It’s a second opinion with credentials. And in food safety, that distinction is everything.
