The Lonza COA That Taught Me to Trust but Verify

Last January, I nearly signed a Certificate of Analysis without really reading it. That doesn't sound dramatic unless you're a quality compliance manager. For me, it would've been close to a professional failure.

The COA was for a batch of Lonza RPMI 1640 formulation, part of a new supplier qualification we were running at our bioprocessing facility. Lonza has a strong track record in cell culture media. Their RPMI 1640 formulation has been a standard tool in cell culture work for decades. But what my team found in that document kicked off a four-week review and permanently changed how we qualify suppliers.

The setup

I review roughly 200 COAs a year. At this point, I can spot a problem in under a minute—date mismatches, lot number issues, spec limits that don't align, test methods that reference old standards. It's pattern recognition built over years.

When the Lonza COA came in, my first instinct was to trust it. The company has decades of experience in pharma manufacturing and GMP compliance. Their documentation is generally thorough. I grabbed the sheets, confirmed the product name—RPMI 1640 formulation—checked the lot number against our purchase order, and was about to stamp it approved.

That's when one of my analysts stopped me with a simple question:

"What's the chemical formula for sodium hydroxide, anyway?"

It's NaOH. I said that and half-laughed. But she wasn't laughing. She was cross-referencing the raw materials listed on the COA against our internal quality specification for the RPMI 1640 formulation. Sodium hydroxide is commonly used for pH adjustment in media manufacturing. If the raw materials on the COA didn't match expectations, that was a gap worth investigating.

We started reading the COA line by line. Not skimming—actually reading. That's when we spotted something odd.

The red flag

The COA cited a pH determination procedure that had been superseded in the latest pharmacopeia update. Per USP-NF guidelines, test methods referenced on certificates need to be current with the edition in force at the time of release testing. The data Lonza provided was technically valid under the old method. But our internal specification required the current one, which uses a narrower acceptance limit. If I remember correctly, the updated procedure tightened the allowable pH range from ±0.2 to ±0.1 units for that test.

We had two options:

1. Accept the COA as-is, relying on Lonza's reputation and the likelihood that the product was fine.
2. Flag it, request re-testing per the updated method, and hold the qualification decision until we had clean data.

My gut said option one. Brand reputation matters, especially with a supplier as established as Lonza. But I've been burned before. In 2022, we accepted a batch of cell culture media from a different vendor and skipped a detailed COA review because "they'd always been reliable." That batch failed our internal growth promotion test. It cost us a $22,000 redo and delayed a product launch by six weeks. Everyone told me to verify specifications before approving. I only truly believed it after ignoring that advice and paying the price.

The most frustrating part of vendor management is how the same issues recur despite clear documentation. You'd think written specifications would prevent ambiguity, but interpretation varies—especially when standards get updated.

Getting perspective

I reached out to a quality counterpart at Strides Pharma. We'd worked together on a joint project the year before, and I knew their team had faced similar supplier qualification challenges. I asked how they handled COA verification for products from large, well-known suppliers.

"We stopped leaning on the name," she said. "The brand gets you the first conversation. After that, it's all data." Their team had moved to a digitized COA review process that flagged outdated test method references automatically. I remember thinking that sounded like overkill. It doesn't anymore.

We also brought in API pharma consultants to audit our supplier qualification workflow. Their feedback was direct, maybe a little embarrassing: our team was reviewing COAs against outdated pharmacopeia standards. We'd been trained on a 2021 edition, and the industry had moved on. Test method changes for cell culture media had been significant—pH determination refinements, osmolality limits, endotoxin testing updates. All things that directly affect product performance.

What was best practice in 2020 may not apply in 2025.

That line stuck with me. The fundamentals of quality assurance haven't changed—verify that the product meets its specification. But the execution has transformed. Standard references change. Analytical techniques get refined. Regulators expect more. COA reviewers have to keep up, whether that means formal training or bringing in outside expertise.

The resolution

We went back to Lonza with our findings. To their credit, there was no pushback. They acknowledged the test method update and re-issued the COA after running the appropriate procedure. The batch passed within the new acceptance range, exactly as we'd suspected. But that wasn't the point. The point was that we'd verified rather than assumed.

That experience pushed us to redesign our COA review protocol. Now every incoming certificate goes through a three-tier check:

• Confirm the product name, lot number, and manufacturing dates match both the shipment and our purchase order.
• Verify every test method cited on the COA is current under the pharmacopeia edition in force at release—not the one we remember, the one that was actually current.
• Compare the acceptance criteria to our internal specifications, not just the supplier's release limits. Those two sets of numbers don't always align.

We also updated our training schedule. Every member of the quality team now gets an annual refresher on pharmacopeia changes and test method updates. The analyst who asked the sodium hydroxide question? She now leads our COA verification training. It's a great outcome from what could've been dismissed as a basic chemistry question.

What I learned

The industry is evolving, and "the way we've always done it" isn't a strategy. Pharmacopeia standards move. Test methods get updated. Acceptance criteria tighten. For cell culture products like RPMI 1640 formulation, small changes in composition or testing methodology can have real consequences in downstream applications.

But the fundamentals haven't changed. A Certificate of Analysis exists to prove a product meets its specification. That's true whether the supplier is Lonza, Strides Pharma, or a small regional vendor. Brand trust gets you in the door, but it doesn't replace verification.

I have mixed feelings about how much we now scrutinize COAs from established suppliers. Part of me thinks it's excessive—these companies have their own quality systems and regulatory accountability. Another part knows that the $22,000 mistake and this near-miss with the Lonza batch are exactly why the scrutiny is necessary. I've reconciled it by deciding that a good supplier won't mind being verified. The ones that do mind? That's a red flag in itself.

The corrected Lonza COA is still on my desk, mostly as a reminder of that close call. Of the analyst's question. Of the fact that even the best suppliers operate in a shifting regulatory landscape. And so do we. The least we can do is read the paperwork.