Trust infrastructure · from the 250-topic plan
How to read a certificate of analysis: the four assays that decide your vial
A certificate of analysis is the lab document standing between a compounded tirzepatide vial and a leap of faith — and you can read one in five minutes once you know the four lines that matter: identity (the molecule is what the label says, base form, no salts), potency (assay within a stated range of label strength), sterility (USP <71> pass), and endotoxin (USP <85> within limit) — plus the metadata that makes those lines mean anything: a named testing lab, a batch number matching your vial, and dates that line up. This teardown walks a COA top to bottom, names the red flags, and scripts the request that gets one.
What a COA is — and what it isn't
A COA reports what a laboratory measured about a specific batch: composition, strength, microbial status. It is batch-level evidence, and that's both its power and its limit — it verifies that batch, not the pharmacy's every future batch, and it is not FDA review (nothing is, in this lane; that trade is priced elsewhere on this site). Within those limits it's the single most information-dense document a compounded-GLP-1 buyer can hold, which is exactly why programs comfortable producing one are signaling more than chemistry.
The metadata that gates everything
Before any assay, three header facts decide whether the document is evidence or wallpaper. The lab: a named, findable testing laboratory — independent third-party is the stronger configuration; a lab you can't identify is a result you can't weigh. The batch match: the COA's lot/batch number must match the one printed on your vial — a beautiful COA for someone else's batch certifies someone else's medicine. The dates: manufacture and test dates consistent with your vial's era; a certificate from last winter attached to this week's batch is a template, not a test.
The four assays, line by line
Identity. Chromatographic/spectrometric confirmation (HPLC and mass-spec methods are the workhorses) that the peptide is tirzepatide — or, on the semaglutide side, base semaglutide, since the FDA-flagged salt forms fail identity in the way that matters most. The line to find: identity “conforms” to the stated molecule. Potency. The assay result as a percentage of label claim, with the acceptance range stated — pharmacy specifications commonly run in the ±10%-of-label neighborhood; what you're checking is that a range exists, is reasonably tight, and the result sits inside it. A 10 mg/mL vial assaying at 6 would make your vial math fiction. Sterility. For an injectable, non-negotiable: USP <71> testing with a pass — the assay standing between a subcutaneous product and an infection. Endotoxin. The companion test (USP <85>, LAL methods): bacterial remnants that survive sterilization can still cause fever and worse; the line reports a value under the stated limit. Together the last two are why “it's just a vitamin-shot pharmacy” is not a reassuring provenance for a weekly injectable.
COA red flags, ranked
Disqualifying: no batch number or a mismatch with your vial; no named lab; missing sterility or endotoxin lines on an injectable; identity reported as a salt form. Serious: “in-house testing only” with no independent confirmation ever available; potency with no acceptance range; dates that don't track your batch. Contextual: a refusal dressed as policy — “proprietary,” “available to providers only” — which converts a chemistry question into a candor answer. Weigh flags here exactly like the field manual weighs its fifteen: some end the evaluation; the rest accumulate.
Getting one: the script
To the program, in writing: “Please send the certificate of analysis for the batch that will fill my prescription — including identity, potency, sterility, and endotoxin results, the testing laboratory's name, and the batch number I can match to my vial.” Legitimate 503As field this routinely; the benchmark standard this site scores against treats COA-on-request as table stakes, and the request itself is a free integrity test that costs a program nothing to pass — which is precisely why failing it means so much. The benchmark's standards file ↗
FAQ
What should a compounded GLP-1 COA include?
Identity (base molecule confirmed), potency within a stated range of label claim, sterility (USP <71>) and endotoxin (USP <85>) results — plus a named lab, a batch number matching your vial, and consistent dates.
Is in-house testing enough?
It's weaker than independent third-party confirmation; exclusive in-house testing with no external option is a serious flag, not an automatic disqualifier — weigh it with the rest of the file.
Does a COA make compounded medicine equivalent to brand?
No — it's batch-level lab evidence, valuable and limited; FDA finished-product review remains the brand's certificate, a trade this site prices openly.
What if the batch numbers don't match?
Then the COA certifies someone else's medicine — request the correct batch's certificate before injecting, and treat refusal as the answer.
Sources
- USP <71> (sterility) and <85> (bacterial endotoxins) testing standards.
- USP compounding chapters and pharmacy quality-specification practice.
- FDA communications on semaglutide salt forms — the identity line's stakes.
- This site's provider-file standards — methodology.