How to Read a Bacteriostatic Water COA and Spot One That Proves Nothing

1. What a Certificate of Analysis Actually Is

A certificate of analysis (COA) is a test report for one manufactured lot. It is not a badge, a seal, or a statement of intent. It records four things for every test performed: the method used, the specification the result had to meet, the measured result, and the lot it applies to.

Remove any one of those four and the document stops being evidence. A result with no specification cannot be judged. A specification with no result is a promise. A test with no named method cannot be repeated. And a report with no lot number cannot be connected to the vial sitting on your bench.

2. An Annotated Example COA, Line by Line

Most pages on this topic list the tests a COA should contain. Few show what the finished document looks like, so we drew one. The example below is a generic mock-up, not any company’s real certificate: the lot number is a placeholder and the results are illustrative values inside the published limits. The numbered markers follow the contents FDA’s Q7 guidance recommends for a certificate: each test with its acceptance limit and numerical result, the batch number, release and expiry dates, and a dated signature from the quality unit.¹

Two lines in the example deserve a note. Particulate matter is counted by instrument: USP <788> passes an injection of 100 mL or less when it averages no more than 6,000 particles of 10 µm or larger and no more than 600 of 25 µm or larger per container by light obscuration.⁵ Visible particulates are different: FDA expects every final container to be inspected and any unit with visible particles rejected, so “Conforms” is a fair way to report that line.⁶

3. The Specifications You Can Check Independently

The strongest thing about bacteriostatic water as a purchase is that its key numbers are public. You do not have to take a supplier’s word for what the specification should be, because the FDA-approved label and the USP-NF monograph state it.²³ Check the seller’s results against these, not against the seller’s own claims:

Note the pattern in the right-hand column: every credible result is a number with a unit and a method. That is the difference between a laboratory document and a graphic.

4. Seven Red Flags on a Bacteriostatic Water COA

1. No lot number, or a lot that doesn’t match your vial

This is the single most important check and the one most often skipped. A COA certifies one batch. If the document does not carry a lot number, or carries one that differs from the lot printed on the vial in your hand, it tells you nothing about what you bought. Suppliers who publish a single undated COA for all orders are publishing a sample, not a certificate.

A cardiologist who wrote a public thread on checking vials bought outside pharmacies listed the same check first:

2. Results stated as “Passed”, “Conforms” or a checkmark

“Conforms” is legitimate for a small number of attribute tests, such as appearance or a net content check against a label claim. It is not legitimate for assay, pH, or endotoxins, which produce numbers. A COA where every line reads “Passed” has removed exactly the information that would let you evaluate it.

3. No analytical method named

“Endotoxin: < 0.5 EU/mL” is weaker than “Endotoxin: < 0.05 EU/mL by kinetic chromogenic LAL.” The method determines what the number means and whether it can be reproduced.⁴

4. No specification printed beside the result

A result in isolation invites you to assume it is good. Real COAs print the acceptance criterion next to the measurement so the reader can judge rather than trust.

5. No test date or release date

Bacteriostatic water carries an expiration date, and the label directs storage at 20 to 25°C.² A COA without a date cannot be placed on that timeline.

6. No laboratory identity or signatory

Someone has to be accountable for the numbers. A COA should name the testing laboratory and carry an authorised signatory or release identifier. “Third-party tested” without naming the third party is not a claim that can be checked.

7. A QR code you haven’t actually scanned

QR codes have become a trust signal in this category, which is precisely why they deserve scrutiny. A QR code is a link. It can resolve to a lot-specific PDF, or to a storefront, or to an affiliate tracking URL, and all three look identical printed on a label.

5. What FDA Expects of a COA (and Why Manufacturers Don’t Take Them on Trust)

The regulated drug industry already has rules for this problem, and they are stricter than most buyers assume. FDA’s Q7 guidance, written for active pharmaceutical ingredients, is the closest thing to a published template for a COA. It says a certificate should list each test performed with its acceptance limits and the numerical results obtained, be dated and signed by the quality unit, and name the original manufacturer. When a repacker or broker issues its own certificate, it should name the lab that did the testing, reference the original manufacturer, and attach a copy of the original batch certificate.¹

Even a certificate that meets that standard is not taken on faith. Under 21 CFR 211.84(d)(2), a drug manufacturer may accept a supplier’s report of analysis in place of its own testing only if it runs at least one specific identity test on the material itself and periodically validates the supplier’s results.⁹ In other words, the industry that writes COAs treats every COA it receives as a claim to be checked.

FDA warning letters show why. In a 2018 letter to an Indian manufacturer of over-the-counter drugs, FDA reported that the firm’s own personnel told investigators the microbiological results recorded on its certificates of analysis had been falsified and the testing had not been performed.¹⁰ A buyer cannot audit a lab, but can do the part that costs nothing: read the numbers, check them against the published limits, and confirm the lab and the lot are real.

6. What to Ask a Supplier, Word for Word

If a COA is not published, or the published one is generic, these four questions separate suppliers who hold documentation from suppliers who do not. Any legitimate distributor can answer all four quickly:

1. “Can you send the COA for the specific lot you will ship me?” The answer should be yes, and the lot should match what arrives.
2. “Which laboratory performed the testing, and is it the manufacturer or an independent lab?” Both answers are acceptable. Refusing to say is not.
3. “What method was used for the benzyl alcohol assay and the endotoxin test?” Expect a chromatographic method for the assay and an LAL method for endotoxins.⁴
4. “Are you the manufacturer, the labeler, or a reseller?” This is a fair question and a revealing one. A reseller can be perfectly reputable, but a reseller who describes the manufacturer’s testing as their own is telling you something about how they handle information.

The six questions below turn the sections above into a sequence you can run against any COA in a couple of minutes. A single “no” means the document cannot be verified, whatever else it says.

7. Documentation Is Not the Whole Picture

A clean COA describes the product at the moment it left the manufacturer. Two things happen afterwards that no certificate covers.

Transit and storage. The label specifies 20 to 25°C.² Nothing on the outside of a parcel records whether that held. This is the argument for buying from a supplier who controls storage, and for not buying injectable diluents from general-merchandise marketplaces where the storage history is unknowable.

Your own handling. Once you puncture the vial, the documentation stops and technique takes over: a new sterile needle and syringe for every entry, a clean preparation area, and discard within 28 days of first puncture.¹¹¹² The most thoroughly tested vial in the world becomes unsafe with careless re-entry. See the 28-day puncture rule for the reasoning.

8. If Something Looks Wrong

FDA publishes guidance on evaluating online sellers of drug products, and maintains a public list of warning letters issued to internet pharmacies.¹³¹⁴ Both are worth a search before a first order from an unfamiliar supplier. And regardless of paperwork: inspect the vial itself. Cloudiness, particulates, a compromised seal, or a label that does not match the COA are reasons to stop, independent of what any document says.

For the surrounding purchase decision (retail pharmacy, marketplace, or direct supplier), see where to buy bacteriostatic water, and the Hospira label reference for what the best-known brand’s presentations actually specify.