Third-Party Lab Testing for Supplement OEM: What to Request and Why

Direct answer: Request three things from any supplement OEM partner, on every programme: (1) a batch-specific Certificate of Analysis issued or countersigned by an independent laboratory accredited to ISO/IEC 17025:2017 — not only the OEM’s own in-house QC sheet; (2) a defined third-party panel covering identity and potency (HPLC or GC assay against the labelled active), full microbial limits (USP <2021> total aerobic microbial count and total yeast-and-mould count, plus USP <2022> testing for Salmonella, E. coli, Staphylococcus aureus and other specified organisms), and elemental impurities for lead, cadmium, mercury and arsenic (USP <232>/<233> or an equivalent AOAC ICP-MS method); and (3) proof that the lab’s accreditation scope actually lists the specific method used on your product, not just a general accreditation certificate. In-house QC — required under GMP and HACCP — confirms the OEM controlled its own process. Independent third-party testing confirms the finished product to a buyer, retailer or regulator who has no reason to take the manufacturer’s own paperwork on faith. Bionutricia coordinates third-party testing through accredited external laboratories alongside its own FSSC 22000, GMP and HACCP-controlled in-house QC on every OEM batch.

Why “third-party” is the operative word

Every credible OEM runs in-house quality control — that’s what GMP and HACCP certification actually audit: whether raw-material intake, in-process checks and finished-batch release follow a documented, validated system. But in-house QC is, by definition, the manufacturer testing its own product. That’s necessary, not sufficient.

A third-party lab has no commercial stake in the result. It receives a sealed sample, runs a defined method, and reports what it finds — favourable or not. That independence is what a distributor, retailer, e-commerce marketplace, or a market’s regulator is actually looking for when they ask “who tested this?” An in-house CoA answers “does the manufacturer say this passes.” A third-party CoA answers “does an unrelated, accredited lab say this passes.” Brands that plan to make any structure/function or quality claim on-label should be able to produce the second document, not just the first.

This is also a substantiation issue: advertising-standards bodies and major retail/marketplace compliance teams increasingly require independent test data before allowing potency, purity or “third-party tested” claims on packaging. The practical question for a buyer isn’t whether to commission third-party data — it’s what to specify when ordering it.

The accreditation to check: ISO/IEC 17025:2017 — and its scope

ISO/IEC 17025:2017 is the general competence standard for testing and calibration laboratories. It’s the right credential to ask for — but accreditation under 17025 is granted method by method, not blanket. A lab can be legitimately 17025-accredited for, say, heavy-metal testing by ICP-MS while running its microbial panel unaccredited, or vice versa. Before accepting a report, ask for:

• The accreditation body name (e.g. a national accreditation body recognised under the ILAC Mutual Recognition Arrangement) and the lab’s certificate number
• The lab’s scope of accreditation document — the schedule listing exactly which test methods are covered
• Confirmation that the specific method used on your CoA (the exact USP chapter, AOAC method, or in-house validated method) appears on that scope

A CoA that simply states “tested by an ISO 17025-accredited laboratory” without naming the lab or showing the method is on-scope is a weaker document than it looks. This is a five-minute check worth doing on every new supplier relationship.

The core third-party test panel to request

Identity and potency

Confirms two separate things: that the material is what it claims to be (botanical species, plant part, or raw-material identity — typically by HPLC or GC fingerprint, sometimes DNA barcoding for botanicals), and that the labelled active is present at the specified strength (a quantitative assay against the ingredient’s own marker compound — anthocyanins for roselle, eurycomanone for Tongkat Ali, curcuminoids for turmeric, and so on). Identity and potency should be run on every batch; this is the test most directly tied to whether the finished product does what the label says.

Microbial limits

Non-sterile dietary supplements are tested under USP <2021> (quantitative enumeration — Total Aerobic Microbial Count and Total Yeast-and-Mould Count) and USP <2022> (qualitative screening for specified organisms).

Elemental impurities (heavy metals)

USP retired the old qualitative <231> Heavy Metals test in favour of quantitative <232> (limits) and <233> (ICP-MS/ICP-OES procedures), with <2232> addressing elemental contaminants specifically in dietary supplements. The four elements every panel should cover:

Risk-based add-ons

Not every raw material needs every test — a sensible programme scopes additional panels to actual risk rather than testing everything on every batch:

• Pesticide residues — relevant for field-grown botanical raw materials, screened against destination-market maximum residue limits
• Mycotoxins (aflatoxins, ochratoxin A) — a risk-based addition for materials with known susceptibility (certain nuts, grains, and some dried botanicals), not a blanket requirement across every ingredient
• Residual solvents — relevant where extraction used ethanol or another Class 3 solvent; a typical residual-ethanol limit is ≤5,000 ppm
• Allergen screening — relevant where the active or a processing aid is dairy-, soy- or shellfish-derived (e.g. some collagen raw materials)

A good OEM partner will explain why a given add-on is or isn’t in the panel for your specific ingredient, rather than defaulting to a fixed list regardless of raw material.

Batch-specific testing vs periodic testing

Not everything needs to be re-run on every single batch. A defensible split: identity, potency and the core microbial panel are tested every batch, because these are the parameters most likely to vary batch to batch. Elemental impurities and risk-based add-ons (pesticides, mycotoxins) are commonly tested on a validated schedule — for example every batch for the first several production runs of a new SKU, stepping down to periodic (quarterly or per-lot-of-lots) testing once the raw-material supply chain has demonstrated consistency, with a trigger to resume full testing if the supplier, origin or process changes. Ask your OEM to put its testing-frequency policy in writing rather than taking a verbal assurance — this is a legitimate, ordinary request and a supplier confident in its process will have the document ready.

Chain of custody and retained samples

A third-party result is only as trustworthy as the sample that produced it. Ask how the sample was pulled: it should come directly from the finished, released batch, sealed and logged by the OEM’s own QA team, and dispatched under a documented chain of custody — not composited across batches or drawn from a vague “representative” master sample. Equally, ask about retained samples: a credible manufacturer holds a physical retain of every batch for the duration of the product’s shelf life plus a defined period after, specifically so a batch can be re-tested if a customer complaint, market surveillance query or regulatory request arises later.

How this sits alongside Bionutricia’s certification stack

FSSC 22000, GMP and HACCP govern the manufacturing process — how raw materials are received, how the line is controlled, how a batch is released. JAKIM halal certification governs the ingredient and process chain from a halal-compliance standpoint. MeSTI is Malaysia’s food-manufacturing licensing framework for the facility. Third-party lab testing sits on top of all of that as the independent check on the finished product itself. Bionutricia’s own facility runs FSSC 22000, GMP and HACCP-controlled in-house QC on every batch, and coordinates third-party verification through accredited external laboratories for OEM programmes that require it — so a brand can specify exactly which independent panel it wants attached to its batch documentation before production starts.

Formats this applies to

The same third-party testing logic applies regardless of finished format — powder sachets, liquid sachets, gel sachets, pouch beverages, chewable tablets and liquid bottles all carry their own identity, potency, microbial and elemental-impurity risk profile, and should each be specified in the testing plan at the formulation-brief stage rather than left until after the first batch is filled.

📚 Related guides

• How to Read a Supplement Certificate of Analysis (CoA): A Buyer’s Guide
• Heavy-Metal & Microbial Testing Standards for Botanical Supplements
• Supplement Stability Testing Explained: ICH Zones, Shelf Life & What Buyers Ask

Ready to specify a third-party testing plan for your SKU?

Bionutricia runs FSSC 22000, GMP and HACCP-controlled in-house QC on every OEM batch, and coordinates independent third-party testing through accredited external laboratories for the panel your brand and market require.

Request a quotation · See our OEM services · View our certifications

WhatsApp: +60 16-661 8510

Frequently asked questions

What third-party lab tests should I request from my supplement OEM partner?

At minimum: an identity and potency assay against the ingredient’s marker compound, a full microbial panel (USP <2021> TAMC/TYMC plus USP <2022> specified-organism testing), and elemental impurities for lead, cadmium, mercury and arsenic (USP <232>/<233> or equivalent AOAC ICP-MS). Add pesticide, mycotoxin, residual-solvent or allergen screening based on the specific raw material’s risk profile, and confirm every result comes from a lab whose ISO/IEC 17025:2017 accreditation scope names the exact method used.

What’s the difference between an OEM’s in-house CoA and third-party lab testing?

An in-house CoA is generated by the manufacturer’s own QA lab as part of GMP/HACCP process control — it confirms the OEM followed its documented system. A third-party CoA is generated by an independent, accredited laboratory with no commercial stake in the result, which is what substantiates on-label claims and satisfies retailers, marketplaces and regulators who have no reason to accept a manufacturer’s self-testing alone.

What accreditation should a third-party testing lab hold?

ISO/IEC 17025:2017 is the standard credential, but accreditation is granted method-by-method rather than as a blanket status. Ask for the lab’s accreditation body, certificate number, and — most importantly — its scope-of-accreditation document, and confirm the exact test method used on your CoA actually appears on that scope.

Should every batch be third-party tested, or only periodically?

Identity, potency and core microbial testing are typically run on every batch, since these parameters are most likely to vary. Elemental impurities and risk-based add-ons (pesticides, mycotoxins) are commonly run on a validated schedule that steps down once a raw-material supply chain has shown consistency — with full testing resuming if the supplier, origin or process changes. Ask your OEM for this policy in writing.

Does Bionutricia provide third-party lab testing as part of its OEM service?

Bionutricia runs FSSC 22000, GMP and HACCP-controlled in-house QC on every batch and coordinates third-party testing through accredited external laboratories for OEM programmes that require independent verification, so a brand can specify the exact panel it needs before production starts.

Article by Bionutricia R&D Team. Last updated: August 5, 2026.