A 2 mL clear glass vial from lot 22-0417 failed the incoming check at a contract lab because the certificate of analysis listed a fill volume tolerance of ±0.05 mL, but the balance reading on 30 randomly pulled units came back at 1.94 mL mean with an SD of 0.021 mL. The lot was within spec on the balance. It failed because the certificate referenced a gravimetric method performed on a different balance, by a different operator, and the lab could not produce the calibration certificate that tied the balance to a national mass standard on the date the certificate was signed. The vial was fine. The traceability chain was broken at link four, and the auditor wrote it up as a nonconformity under ISO 17025 clause 6.5. That is the failure mode this article is about: not the consumable, but the paper behind it.
If you buy consumables for a lab that operates under ISO 17025, the traceability question you actually face is narrower than the standard’s text suggests. You are not being asked to prove that glass is glass. You are being asked to prove, on request, that every measured property on the certificate of analysis (CoA) you received traces back through an unbroken chain of calibrations to a national metrology institute. For aijiren consumables, the chain has five links. Four of them are usually present. One is almost always missing, and it is the same one every time.
Clause 6.5 of ISO/IEC 17025:2017 requires that measurement results be traceable to the International System of Units (SI) through an unbroken chain of calibrations, each contributing to the measurement uncertainty. The clause is written for calibration and testing laboratories, not for consumable manufacturers. But when a lab uses a consumable in a validated method and the method’s performance depends on a stated property of that consumable (fill volume, dimensional tolerance, septum thickness, extractables), the lab has to be able to defend that property. In an assessment, the assessor does not ask the manufacturer. The assessor asks you.
Three things get tested in practice. First, the certificate has to name the property and the method used to measure it. “Meets USP <381>” is not a method. “Gravimetric fill, n=30, acceptance ±0.05 mL, method SOP-QC-0114 rev 3” is. Second, the certificate has to identify the instrument used, and that instrument has to have a calibration certificate in force on the date of the test. Third, the calibration certificate itself has to trace to a national standard, either directly (NIST, NPL, PTB, NMIJ) or through an accredited calibration provider whose own scope covers the parameter.
That is the whole requirement. It is not complicated. It is tedious, and it is where most consumable supply chains quietly fail.
The five-link chain for a consumable, drawn end to end
I find it useful to draw the chain explicitly, because when an assessor asks “show me traceability for this lot,” the answer is not a document. It is a sequence, and any link that is missing is a finding. For a typical HPLC vial or GC septum, the chain looks like this:
- Link 1: the national standard. The mass standard, the length standard, the temperature standard. Owned by NIST or an equivalent NMI. This link is never the problem.
- Link 2: the calibration provider. An accredited calibration laboratory whose scope covers the parameter (mass, length, force, temperature) and whose certificate references link 1. This link is present if the manufacturer uses an ISO 17025-accredited calibration provider; it is missing if they use an in-house “check” against a reference weight with no accredited certificate.
- Link 3: the measuring instrument. The analytical balance, the micrometer, the vision system, the torque tester. It has a calibration certificate in force on the date of the test. This link is present if the certificate is on file and current; it is missing if the calibration expired, or if the instrument was recalibrated after the test and the certificate on file is the newer one.
- Link 4: the test record. The actual measurement, with operator ID, date, raw data, and the calculated result. This link is present if the raw data exists; it is missing if only the summary result was retained.
- Link 5: the certificate of analysis. The document you receive with the lot. It references link 4 and, by extension, links 1 through 3. This link is present if the CoA names the method and the instrument; it is missing if the CoA only states a pass/fail against a specification.
Links 1 and 2 are usually fine. Link 3 is fine at most manufacturers, though it goes stale more often than people expect. Link 5 is fine at any reputable supplier. Link 4 is where the chain breaks, and it breaks in a specific way: the raw data behind the CoA number does not exist in retrievable form, or it exists but cannot be tied to the specific instrument calibration in force on the test date.
Why link four is the one labs cannot produce
Here is the pattern I have seen across more than a dozen supplier audits. The manufacturer runs the test, records the result, and files the CoA. The raw data goes into a spreadsheet, and the spreadsheet lives on the QC technician’s desktop. When the lot is two years old and an assessor asks for the raw data, the technician has left, the spreadsheet has been overwritten, and the only surviving artifact is the CoA itself. The CoA is a summary. It is not a record. Under ISO 17025 clause 7.5, the record is what has to be retained, and the CoA is downstream of the record.
The second failure in link four is subtler. The manufacturer does retain raw data, but the instrument calibration certificate on file is the one issued after the test. That happens when the balance is recalibrated annually and the test was run in month 11 of the calibration cycle. The certificate on file is dated month 12. The test was run under the month 11 certificate, which is no longer in the folder. An assessor who looks closely will catch this. Most do not, because most assessors do not go that deep into a consumable supplier’s QC records. But the ones who do will write it up, and the finding lands on your lab, not the supplier’s.
If you want to see what a defensible chain looks like on the supplier side, the CoA should name the method, the instrument ID, the calibration certificate number, the test date, and the operator. Anything less is a summary, not a traceable record. The difference between a supplier who can produce link four on request and one who cannot is usually visible in the first five minutes of a supplier audit, and it is the single most useful thing to check before you qualify a new consumable source.
A decision checklist for the CoA you actually receive
The table below is what I use when a lab asks me to review a consumable CoA for ISO 17025 defensibility. It is not a substitute for a supplier audit, but it catches the failures that show up in the document itself.
| Check | Pass condition | Common failure |
|---|---|---|
| Property named | Specific property with units (e.g., fill volume in mL, septum thickness in mm) | “Meets specification” with no property named |
| Method named | SOP number and revision, or a published method (USP, ISO, ASTM) | “Per internal QC” with no SOP reference |
| Sample size | n stated (typically n=10 to n=30 for dimensional and gravimetric checks) | No n; result presented as a single value |
| Acceptance limit | Numeric limit stated (e.g., ±0.05 mL, ±0.1 mm) | Limit implied by the specification sheet, not on the CoA |
| Instrument ID | Balance, micrometer, or vision system ID on the CoA | No instrument ID; “analytical balance” as a generic term |
| Calibration certificate | Certificate number and expiry date, in force on test date | Certificate number absent, or expired on test date |
| Test date | Date of test, not date of CoA issuance | Only the CoA issue date, which is often weeks after the test |
| Operator | Initials or ID of the technician who ran the test | No operator; “QC department” as a generic attribution |
| Uncertainty | Measurement uncertainty stated for critical properties (fill volume, dimensions) | Uncertainty omitted; result presented as exact |
If a CoA fails three or more of these checks, it is not traceable in the ISO 17025 sense. It is a marketing document. That does not make the product bad. It makes the product undefendable in an assessment, which is a different problem and often a worse one.
Field case one: the septum thickness that drifted by 0.08 mm
A pharma QC lab running a residual solvents method on a headspace GC had a run of failed system suitability checks over three weeks. The internal standard response dropped by 11% run to run, and the leak check on the inlet passed every time. The lab pulled 20 septa from the current lot and measured them with a digital micrometer (0.001 mm resolution, calibrated within the last 6 months). Mean thickness was 3.12 mm against a CoA value of 3.20 mm. That is a 0.08 mm difference, well outside the ±0.05 mm tolerance the CoA claimed.
The investigation traced the lot to a supplier change in the PTFE facing laminate. The CoA on file was a summary sheet with no instrument ID, no sample size, and no raw data. The supplier could not produce the original measurements. The lab had no choice but to re-qualify the lot against an in-house method, which took two weeks and cost about $4,800 in analyst time and instrument downtime. The fix was to add a thickness check to incoming inspection (n=10, micrometer, acceptance ±0.05 mm) and to require the supplier to provide the raw data package with each lot. The next lot from a different supplier came with a CoA that named the micrometer ID, the calibration certificate, and the test date. That is what link four looks like when it is intact.
You can see the same thickness and facing specification issues discussed in more depth at Vial Supplier, but the point here is narrower: the CoA number was wrong, and the reason it was wrong is that nobody could trace it back to the measurement.
Field case two: the fill volume that traced to a stale balance certificate
A contract lab running an LC-MS method for a regulated environmental analyte received a lot of 2 mL vials with a CoA stating a fill volume of 1.98 mL ± 0.03 mL (n=30, gravimetric). The lab’s own check on 10 units gave 1.96 mL mean, which is within tolerance but at the low edge. The lab asked for the raw data. The supplier provided it, and the data was clean: 30 individual weights, operator initials, test date, balance ID. The balance ID was a Mettler Toledo XPR205. The calibration certificate on file was dated 14 months before the test date. The certificate had a 12-month cycle. The balance had been out of calibration for two months when the test was run.
That is a link three failure, not a link four failure, but it produces the same outcome: the CoA is not traceable. The lab had to re-test the lot in-house, which it could do because it had its own calibrated balance and its own SOP. The supplier was placed on a corrective action, and the next audit found that the calibration cycle had been extended from 12 to 18 months without a change control. That is the kind of finding that gets a supplier disqualified from a regulated supply chain, and it is exactly the kind of thing an ISO 17025 assessor will find if they look.
The lesson is that traceability is not a document property. It is a property of the whole measurement system, and a stale calibration certificate breaks it as effectively as missing raw data. If you are qualifying a consumable supplier, ask for the calibration certificate for the balance used on the CoA, and check the date against the test date. If they cannot produce it, you have your answer.
What to require in a supplier qualification, in writing
The practical fix is to put the traceability requirement into the supplier qualification document, not into a conversation. The clauses I use are short and specific:
- Raw data retention. The supplier retains raw measurement data for each lot for a minimum of 5 years (or the lab’s record retention period, whichever is longer) and makes it available within 5 business days of a written request.
- Instrument calibration. The CoA names the instrument ID and the calibration certificate number, and the certificate is in force on the test date. The supplier provides a copy of the certificate on request.
- Method reference. The CoA names the SOP number and revision, or the published method (USP, ISO, ASTM, EPA SW-846 where applicable). “Internal QC” alone is not acceptable.
- Uncertainty. The CoA states measurement uncertainty for critical properties (fill volume, dimensional tolerances, septum thickness).
- Change notification. The supplier notifies the lab in writing within 30 days of any change to the measurement method, the instrument, or the calibration provider for a property listed on the CoA.
These five clauses cost nothing to write and almost nothing to enforce, and they close the gap at link four. A supplier who cannot sign them is telling you something useful about their QC system.
Where the chain most often breaks in a real assessment
In my experience, the assessment finding is almost never “the supplier had no calibration.” It is “the lab could not produce the traceability record for the lot in use.” Those are different failures, and the second one is the lab’s problem. The lab has the CoA in a binder, but the binder does not contain the raw data, the calibration certificate, or the method reference. When the assessor asks, the lab has to go back to the supplier, and the supplier takes two weeks to respond, and the assessment is already closed with a finding.
The fix is to treat the CoA as the entry point to a record, not the record itself. When a lot arrives, the receiving lab should file the CoA together with the supplier’s raw data package (or a written confirmation that it is retrievable), the calibration certificate for the instrument named on the CoA, and the method reference. That is four documents per lot, not one. It takes about 15 minutes to assemble and it is the difference between a closed finding and an open one.
For labs buying through a distributor rather than directly from the manufacturer, the distributor is often the weak point. The manufacturer has the raw data; the distributor has the CoA and nothing else. If you buy through a distributor, the qualification clause has to flow down to the manufacturer, and the distributor has to be able to produce the manufacturer’s raw data on request. That is a contractual requirement, not a courtesy. You can see how this plays out across the supply chain at Aijiren, and the same principle applies to any consumable source you qualify.
How to test a supplier’s traceability in one afternoon
You do not need a full audit to find out whether a supplier can produce link four. You need one lot number and one written request. Ask for the following, for a lot you have already received:
- The raw measurement data behind the CoA (individual readings, not the summary).
- The calibration certificate for the instrument named on the CoA, in force on the test date.
- The SOP or published method used, with revision number.
- The name of the calibration provider and its accreditation scope (ISO 17025 or equivalent).
A supplier with an intact chain will send all four within two business days. A supplier with a broken chain will send the CoA again, or send a specification sheet, or ask why you need it. The response time and the completeness of the package tell you more than any audit checklist. I have used this test on more than 20 suppliers, and the split is roughly 60/40: 60% can produce the package, 40% cannot. The 40% are not necessarily bad manufacturers. They are manufacturers who never had to defend a CoA in an assessment, and their QC system reflects that.
The decision rule
If a consumable appears in a validated method and its stated properties affect method performance, the CoA is not evidence until you can produce the raw data, the instrument calibration certificate in force on the test date, and the method reference for that lot. If you cannot produce all three within the assessment window, the lot is not traceable under ISO 17025 clause 6.5, regardless of what the certificate says. Qualify the supplier on their ability to produce link four, not on the certificate’s appearance, and put the requirement in writing before the first purchase order. The certificate is the last link in the chain, not the chain itself. For a broader view of how consumables sit inside a regulated method, the chromatography resources at Lab Chromatography and the technical notes at Restek are worth reading alongside the supplier qualification, and the method-level container rules in EPA SW-846 are a useful stress test of whether your traceability package survives a real regulatory review. The same discipline applies whether you are buying vials with caps from Vials With Caps or septa from a chromatography consumables distributor: the chain is the product, and the certificate is only the part you can see.
References & further reading
Related resources from our lab consumables network:
- Aijiren at aijirentech.com
- Vials With Caps at vialswithcaps.com
- Vial Supplier at vialsupplier.com
- Lab Chromatography at labchromatography.com
External references and standards: