A certificate of analysis is a test report. A laboratory takes a sample from a specific lot, runs named methods against named specifications, and prints what came back. That is the whole of it. It is not a license, not an approval, not a grade awarded by an outside authority, and not a statement about anything except the material that went into the instrument on the day the test ran.
The document is worth understanding anyway, because it is the only quantitative claim about product that anyone in this category ever offers a buyer. The contents of the container are a separate subject, covered in the article on what a vial holds. This one is about the paper.
The certificate the law requires points the other way
Both compounding routes in federal law carry a certificate-of-analysis condition, and in both it is inbound. A drug may be compounded under section 503A only where the pharmacist uses bulk drug substances manufactured by a registered establishment and accompanied by valid certificates of analysis for each bulk drug substance.[1] The outsourcing-facility section states the same condition in the singular: the bulk drug substances are each accompanied by a valid certificate of analysis.[2]
Read those carefully and the picture inverts. The certificate the statute requires describes the raw active ingredient before compounding starts. It is produced by whoever manufactured the powder, it is addressed to the pharmacy receiving it, and it says nothing about the finished preparation, the dilution, the vial, the stopper or the date. Neither section requires a certificate for the compounded product itself, and neither requires any certificate to reach a patient. A certificate offered to a buyer is a voluntary document about a step the law does not require to be documented, and the mandatory one is about a step the buyer never sees.
The upstream certificate has a supplier problem
That inbound document is only as good as the establishment issuing it, and the agency has published what it found when it went looking. Of 48 GLP-1 active-ingredient sites the FDA evaluated, 21% were noncompliant under section 501 of the act — either because their responses to records requests showed noncompliance with manufacturing requirements, or because they did not respond in time. The agency also describes a recurring pattern: sites that register as GLP-1 ingredient manufacturers, offer material for import, refuse to answer records requests, and then deregister, all within a short period.[3]
The same page names the consequence for the lighter compounding route in plain words. Compounders operating under section 503A are exempt from manufacturing requirements, including the requirement to ensure that the active ingredient meets specifications for impurities or potency, so quality concerns in the bulk substance may not be controlled for during compounding of the finished form.[3] The inbound certificate is therefore the only quality gate on the ingredient in that route, and it is written by the supplier.
Who owes a release test, and under which rule
The obligation to test a finished batch before it ships does exist in federal regulation, but it arrives through manufacturing practice rather than through compounding law. For each batch of drug product there must be appropriate laboratory determination of satisfactory conformance to final specifications, including the identity and strength of each active ingredient, prior to release; products failing to meet established standards must be rejected. For each batch purporting to be sterile or pyrogen-free there must be appropriate laboratory testing to determine conformance.[4]
Those rules bind an outsourcing facility, which is subject to manufacturing requirements. They do not bind a compounder operating under section 503A, which is exempt from them.[3] Whether a release test is legally owed on the vial in your hand therefore depends on which category prepared it, a distinction unpacked in the article on the two categories. A voluntary certificate can of course be produced either way. The point is that its absence means something different in each.
The line FDA tells compounders not to lean on
Here is the sentence that should change how the most reassuring row on a certificate reads. In its guidance on insanitary conditions, the agency states that compounding facilities producing purportedly sterile drug products under insanitary conditions should not rely upon or cite a passing sterility test result as an indication of product sterility, and must correct those conditions regardless of whether the drugs pass a sterility test.[5] That guidance also notes that neither compounding section exempts anyone from the adulteration provision covering insanitary conditions.[5]
A sterility test samples a small number of units from a batch. It is a weak instrument for detecting sporadic contamination, which is why the process matters more than the result, and why a certificate reporting a pass is evidence about the sample rather than assurance about the lot.
The enforcement record follows that logic exactly. Across the compounded semaglutide and tirzepatide recall records published in the federal enforcement database as of September 9, 2026 — 70 of them, from 14 distinct recalling firms — the stated reason was lack of assurance of sterility in 39, lack of processing controls in 13, particulate matter in 11, subpotency in 4, and validation failures in 2.[6] The dominant failure in this market is not a test that came back wrong. It is a process that could not assure the thing the test was supposed to confirm.
What an assay cannot see
A test finds what its method was designed to find. A laboratory comparison of follow-on GLP-1 products against their originators used chromatography with ultraviolet and mass-spectrometry detection, inductively coupled plasma spectroscopy, nuclear magnetic resonance, dissolution testing and fibrillation assays, across 16 injectable semaglutide products, 8 oral semaglutide products and 2 injectable liraglutide products.[7]
The injectable follow-ons carried new impurities and new impurity patterns relative to the originator, including high molecular weight proteins, trace metals, anions, counterions and residual solvents. Several oral products contained markedly less semaglutide than the label claimed, with different dissolution profiles. Neoepitopes were identified in both substance and product, which the authors describe as indicating potential immunogenicity, and the liraglutide follow-ons showed increased fibrillation tendency and reduced physical stability. The authors state that the effect of these differences on efficacy and safety is unknown and requires clinical study.[7]
One caveat belongs directly beside those findings: every author is employed by the company that manufactures the originator products, which is a commercial interest in the comparison and is disclosed on the paper. The methods are described in full and the result is a laboratory finding rather than an opinion, but a reader should weigh it knowing who ran it.
The relevance to a certificate is structural rather than alarming. Trace metals, residual solvents and aggregation behavior are not attributes that appear on a routine potency-and-sterility page. An impurity nobody specified is an impurity nobody assayed, and a document reading “conforms” across five rows is silent about everything that is not one of those five rows — because “conforms” means conforms to the specification the issuer chose.
A test interval is not a batch test
Two different practices are described in this market with the same four words. A release test is run on a specific lot before that lot is distributed. A periodic audit samples the output of a process at intervals to confirm it is still behaving. Among the sellers written up here, one describes third-party potency testing conducted every three to six months against a ten percent tolerance — a real quality practice, and not a certificate for the vial arriving next week.
The distinguishing question is whether the document names a lot. A certificate without a batch identifier cannot be matched to anything, and one with an identifier can only be matched if the same identifier is printed on the container.
How often one is published at all
Across the 286 sellers written up here, 15 record any claim about a certificate of analysis or about third-party testing for potency, sterility, purity or endotoxins. 2 record a certificate actually published to be read — in one case two documents with batch numbers and test dates attached, in the other a standing page of downloadable files. 1 records reports offered on request. The rest assert that testing happens without producing an artifact.
The cross-tabulation is the part worth pausing on. 13 of those 15 do not name the pharmacy that prepares the medication, against 2 that do. Across the whole set, 51 of the 266 sellers where the question could be settled name a pharmacy. A testing claim does not travel with a named preparer; if anything it runs slightly the other way, and a claim made on behalf of an unnamed laboratory attached to an unnamed pharmacy has no handle on it. What each company publishes is recorded in the individual seller write-ups.
One reference point a buyer might expect to check is not available. The United States Pharmacopeia compounding chapters are behind a subscription, and the phrase “certificate of analysis” does not appear on any freely readable page of the standard-setter’s site, so what those chapters require of a certificate cannot be established from outside.
The gap the paper cannot close
Three limits survive even a complete, genuine, lot-matched document. Sampling: a certificate describes the units that were tested, and the inference to the rest of the lot is a statistical one the page does not show. Time: potency measured at release is not potency at the door, which is the subject of the cold-chain article. And identity of the container itself.
That last one is not hypothetical. Of the compounded GLP-1 recall records in the federal database, exactly one carries the most serious classification, and its stated reason is a label mix-up: a product labeled as tirzepatide that contained testosterone cypionate, across 751 vials, initiated in April 2024.[6] No certificate of analysis for a tirzepatide lot would have caught that, because the document describes what the laboratory tested and not what went into the box.
What this does not establish
Coverage is not census. The counts above are floors derived from what each seller publishes on the pages examined, so a company with no recorded testing claim may test extensively and say nothing about it, and the absence of a certificate is not evidence about a product. Nothing here asserts that any certificate in this market is inaccurate, no seller is identified as deceptive, and the recalling firms are deliberately not named — the distribution of failure reasons is the finding, not any one company.
The conclusion is about the document rather than about anybody holding one. A certificate raises the floor on what a buyer can know, which is worth something in a category where the usual floor is a marketing sentence. It does not change the position underneath it: compounded drugs are not FDA-approved, and the agency does not verify the safety, effectiveness or quality of compounded drugs before they are marketed.[8] A certificate is a private party’s test result, not a substitute for the review that did not happen — a distinction set out in the approval article, and applied throughout the methodology.