Certificate of Analysis Verification for Imported APIs in Canada: What Health Canada's GMP Requirements Actually Demand

Most Canadian pharmaceutical manufacturers have a written COA review procedure. Far fewer have one that would survive scrutiny from a Health Canada GMP inspector.

That gap is surprisingly common — and consequential. During GMP inspections under the Food and Drug Regulations, incoming materials testing consistently ranks among the top cited deficiency categories. The problem usually isn’t that companies skip COA review entirely. It’s that their review is superficial: a QC sign-off confirming the document arrived, not a genuine verification that the data is reliable, the methods are appropriate, and the identity has been independently confirmed in-house.

If your facility imports active pharmaceutical ingredients, the regulatory expectations are more specific than you might expect — and they go well beyond confirming that numbers fall within the stated specification range.

What Health Canada Actually Requires From a Supplier COA

The foundational requirement sits in Part C, Division 2 of Canada’s Food and Drug Regulations, which governs Good Manufacturing Practices for drug products. These provisions require that raw materials — including APIs — be tested against established specifications before release for use in manufacturing. Health Canada’s Good Manufacturing Practices Guide for Drug Products (GUI-0001) expands on those requirements considerably, and for APIs specifically, the framework draws from ICH Q7, the international GMP guidance for Active Pharmaceutical Ingredients that Health Canada has formally adopted.

Under this combined framework, a compliant supplier COA must include:

• The complete product name, grade, and CAS number where applicable
• Batch or lot number, traceable to the originating manufacturer’s production records
• Name and address of the actual manufacturing site — not just the distributor’s letterhead
• Manufacturing date and retest or expiry date
• Each test performed, the specific method referenced (compendial or in-house), the acceptance specification, and the actual result
• A qualified person or quality unit signature, along with a clear disposition statement (pass/fail)

That last point about the manufacturing site catches organizations more often than it should. A COA issued by a trading company or distributor that simply re-labels the original manufacturer’s data — sometimes without identifying the originating facility at all — creates a traceability gap that Health Canada inspectors look for specifically. Your incoming materials SOP should require explicit confirmation that the COA traces back to the site that manufactured the material. If it doesn’t, the document on file is incomplete regardless of whether every number is in spec.

The Identity Testing Obligation — Each Container, Not Each Lot

Here’s the requirement that surprises the most manufacturers: identity testing must be performed on each individual container of API received, not merely on a representative sample pulled from the shipment.

ICH Q7’s materials management section is explicit about this. For APIs received directly from a single qualified manufacturer, a reduction in the number of containers identity-tested may be possible — but only when a formal, documented supplier qualification program is already in place. For materials received through a broker or trading company, the expectation tightens further: absent a robust qualification framework that includes the broker, testing each container is generally required.

What counts as a valid identity test? An organoleptic check — appearance, color, odor — does not meet the standard. The method must be specific to the API: typically an infrared (IR) spectroscopic comparison against a verified reference standard, or another technique with documented capability to distinguish the material from potential adulterants or look-alike substances. For compendial APIs, a USP, Ph.Eur., or BP identity test is the natural reference point. For non-compendial materials, the in-house method must carry validation data demonstrating specificity.

This has a practical implication for your receiving SOP. If your current procedure states something like “sample a minimum of 10% of containers for identity testing” and that applies uniformly to APIs, it doesn’t satisfy the requirement. We see this cited regularly in inspection observation letters — not because companies were being careless, but because the procedure was written against a looser standard and never revisited when ICH Q7 expectations were formalized.

How to Qualify a Supplier for Reduced Testing Under Canada GMP

The framework does allow for reduced testing of non-identity parameters once a supplier is formally qualified — and getting there is absolutely worth the investment. The per-lot testing burden for a fully unqualified supplier can add days to your release timeline and thousands of dollars in external lab costs annually. A legitimate qualification program addresses that, within boundaries.

The key steps in a supplier qualification program that Health Canada inspectors will accept:

1. Qualification audit or detailed assessment. For high-volume or high-risk API suppliers, an on-site GMP audit conducted by your quality team — or by a qualified third-party auditor — is the expected approach. Where an audit isn’t operationally feasible (low-volume purchases, geographically remote facilities), a comprehensive supplier questionnaire covering manufacturing controls, QC system, change control procedures, and deviation management can form part of the qualification file. Health Canada inspectors look for evidence the responses were actually evaluated, not just received.

2. Multi-lot historical data review. Before committing to reduced testing, you need COA data across a meaningful number of consecutive conforming lots — typically a minimum of three to five, though your procedure should document the justification for whatever number you choose, based on product risk and supplier history.

3. A formal reduced testing protocol. This is a written document — not a verbal understanding, not an email thread — specifying which tests are reduced, the conditions under which full testing is reinstated (a failed lot, a supplier change notification, a significant deviation), and how the arrangement is periodically reviewed.

4. Ongoing re-qualification. Initial qualification is not a permanent status. Your procedure needs a defined review cycle, typically annual, that includes a review of COA trending data, any change notifications received from the supplier, and an assessment of whether any quality events during the year should trigger an earlier re-qualification.

One parameter generally cannot be reduced regardless of how well-qualified the supplier is: identity. Your COA verification program may reduce the number of containers identity-tested for a formally qualified supplier delivering directly, but eliminating identity testing entirely is not a defensible position under Health Canada’s interpretation of ICH Q7.

What Health Canada Inspectors Flag When They Pull Your COA Files

During a GMP inspection of a pharmaceutical manufacturer, the incoming materials records are typically among the first things requested. Inspectors are trained to look for specific patterns — and after enough inspections, certain red flags appear consistently.

Missing method references. If a supplier COA lists a test result without specifying the method used to generate it, that’s a discrepancy your QC reviewer should catch during review — not something to approve and file anyway. Your SOP should explicitly require that method references are present, and if a supplier consistently omits them, that becomes a supplier quality discussion.

Results at exactly the specification limit. A supplier reporting a potency result of precisely 98.0% when your lower limit is 98.0% — consistently, across multiple lots — warrants scrutiny. Repeated results landing exactly on a specification boundary are a recognized indicator of data manipulation in the global API supply chain. This isn’t hypothetical: Health Canada has cited manufacturers for failure to investigate anomalous supplier data patterns.

Chain of identity gaps. If an API was manufactured in one country, repackaged by an intermediary in a second country, and shipped to your Canadian facility, the file needs documentation establishing an unbroken chain connecting the original material to what you received. Re-packaging records and, where applicable, re-testing data from the intermediary should be part of your incoming materials package.

Reference standard traceability. Your in-house identity test is only as reliable as the reference standard used to run it. Health Canada expects reference standards to be sourced from a recognized pharmacopoeia (USP, Ph.Eur., BP) or internally qualified with documented testing. A reference standard obtained from the same supplier you’re qualifying — and used without independent qualification — creates a circular verification problem that inspectors recognize immediately.

Date inconsistencies. A COA dated weeks before the material was shipped, or — more unusually — after it arrived at your facility, raises questions about when the testing actually occurred. Cross-checking COA dates against your bill of lading, customs documentation, and receiving records should be a standard step in your incoming materials checklist.

A COA Review That Functions as an Analytical Activity, Not a Paperwork Step

The facilities that consistently perform well on Health Canada GMP inspections approach incoming materials verification as a genuine analytical exercise. QC reviewers understand the chemistry well enough to recognize anomalies. Procedures specify exactly what must be evaluated and how discrepancies are escalated. Supplier relationships are structured so that follow-up questions get real answers, not boilerplate responses.

If your current COA verification procedure hasn’t been reviewed against GUI-0001 and ICH Q7 requirements in the past 12 to 18 months — or was written before your product portfolio shifted toward higher-risk imported APIs — that’s a gap worth closing before your next inspection cycle, not after an observation letter lands on your desk.

---

Written by Nour Abochama, Quality & Regulatory Advisor, Androxa. Learn more about our team

Talk to our team about Health Canada compliance Contact us

Related from our network

• Pharmaceutical Raw Material and API Testing — Qalitex Laboratories provides identity, potency, and impurity testing for APIs and raw materials to USP, Ph.Eur., and in-house specifications, supporting Canadian GMP release requirements.
• EU GMP Documentation and Ingredient Compliance — Care Europe helps manufacturers entering the European market align their supplier qualification and COA documentation with EU GMP expectations under Directive 2001/83/EC.