1. What a Certificate of Analysis Actually Is
A certificate of analysis (COA) is a test report for one manufactured lot. It is not a badge, a seal, or a statement of intent. It records four things for every test performed: the method used, the specification the result had to meet, the measured result, and the lot it applies to.
Remove any one of those four and the document stops being evidence. A result with no specification cannot be judged. A specification with no result is a promise. A test with no named method cannot be repeated. And a report with no lot number cannot be connected to the vial sitting on your bench.
The one-sentence test. Read any line of a COA and ask: could a second laboratory repeat this and get a comparable number? “Bacterial endotoxins: < 0.05 EU/mL by kinetic chromogenic LAL, specification < 0.25 EU/mL” passes. “Endotoxins: Passed ✓” does not.
2. The Specifications You Can Check Independently
The strongest thing about bacteriostatic water as a purchase is that its key numbers are public. You do not have to take a supplier’s word for what the specification should be, because the FDA-approved label and the USP–NF monograph state it.21 Check the seller’s results against these, not against the seller’s own claims:
| Test | Published specification | Where the number comes from | What a real result looks like |
|---|---|---|---|
| Benzyl alcohol assay | 0.9% (9 mg/mL) or 1.1% (11 mg/mL) | FDA-approved label2 | “9.02 mg/mL by HPLC” |
| pH | 4.5 to 7.0 (typical 5.7) | FDA-approved label2 | “5.8, potentiometric” |
| Bacterial endotoxins | < 0.25 EU/mL | Water for Injection limit31 | “< 0.05 EU/mL, kinetic chromogenic LAL” |
| Sterility | No growth | USP <71> membrane filtration1 | “No growth at 14 days, USP <71>” |
| Container | Type I if borosilicate glass | USP <660> glass classification4 | “Type I borosilicate, hydrolytic resistance per <660>” |
Note the pattern in the right-hand column: every credible result is a number with a unit and a method. That is the difference between a laboratory document and a graphic.
3. Seven Red Flags on a Bacteriostatic Water COA
1. No lot number, or a lot that doesn’t match your vial
This is the single most important check and the one most often skipped. A COA certifies one batch. If the document does not carry a lot number, or carries one that differs from the lot printed on the vial in your hand, it tells you nothing about what you bought. Suppliers who publish a single undated COA for all orders are publishing a sample, not a certificate.
2. Results stated as “Passed”, “Conforms” or a checkmark
“Conforms” is legitimate for a small number of attribute tests, such as appearance or a net content check against a label claim. It is not legitimate for assay, pH, or endotoxins, which produce numbers. A COA where every line reads “Passed” has removed exactly the information that would let you evaluate it.
3. No analytical method named
“Endotoxin: < 0.25 EU/mL” is weaker than “Endotoxin: < 0.05 EU/mL by kinetic chromogenic LAL.” The method determines what the number means and whether it can be reproduced.3
4. No specification printed beside the result
A result in isolation invites you to assume it is good. Real COAs print the acceptance criterion next to the measurement so the reader can judge rather than trust.
5. No test date or release date
Bacteriostatic water carries an expiration date, and the label directs storage at 20–25°C.2 A COA without a date cannot be placed on that timeline.
6. No laboratory identity or signatory
Someone has to be accountable for the numbers. A COA should name the testing laboratory and carry an authorised signatory or release identifier. “Third-party tested” without naming the third party is not a claim that can be checked.
7. A QR code you haven’t actually scanned
QR codes have become a trust signal in this category, which is precisely why they deserve scrutiny. A QR code is a link. It can resolve to a lot-specific PDF, or to a storefront, or to an affiliate tracking URL — and all three look identical printed on a label.
Scan it before you trust it. Point your phone at the code and read the URL bar before the page loads. A verification code should land on a document that names the lot printed on that vial. If it lands on a product listing, a checkout, or a URL carrying referral or campaign parameters, it is a sales link wearing a verification badge. That is worth knowing either way — it does not necessarily mean the product is bad, but it does mean the QR code proved nothing.
4. What to Ask a Supplier, Word for Word
If a COA is not published, or the published one is generic, these four questions separate suppliers who hold documentation from suppliers who do not. Any legitimate distributor can answer all four quickly:
- “Can you send the COA for the specific lot you will ship me?” The answer should be yes, and the lot should match what arrives.
- “Which laboratory performed the testing, and is it the manufacturer or an independent lab?” Both answers are acceptable. Refusing to say is not.
- “What method was used for the benzyl alcohol assay and the endotoxin test?” Expect a chromatographic method for the assay and an LAL method for endotoxins.3
- “Are you the manufacturer, the labeler, or a reseller?” This is a fair question and a revealing one. A reseller can be perfectly reputable, but a reseller who describes the manufacturer’s testing as their own is telling you something about how they handle information.
5. Documentation Is Not the Whole Picture
A clean COA describes the product at the moment it left the manufacturer. Two things happen afterwards that no certificate covers.
Transit and storage. The label specifies 20–25°C.2 Nothing on the outside of a parcel records whether that held. This is the argument for buying from a supplier who controls storage, and for not buying injectable diluents from general-merchandise marketplaces where the storage history is unknowable.
Your own handling. Once you puncture the vial, the documentation stops and technique takes over: a new sterile needle and syringe for every entry, a clean preparation area, and discard within 28 days of first puncture.85 The most thoroughly tested vial in the world becomes unsafe with careless re-entry. See the 28-day puncture rule for the reasoning.
6. If Something Looks Wrong
FDA publishes guidance on evaluating online sellers of drug products, and maintains a public list of warning letters issued to internet pharmacies.67 Both are worth a search before a first order from an unfamiliar supplier. And regardless of paperwork: inspect the vial itself. Cloudiness, particulates, a compromised seal, or a label that does not match the COA are reasons to stop, independent of what any document says.
For the surrounding purchase decision — retail pharmacy, marketplace, or direct supplier — see where to buy bacteriostatic water, and the Hospira label reference for what the best-known brand’s presentations actually specify.
References & Primary Sources
Every technical claim on this page is sourced to a pharmacopeial monograph, a federal regulatory body, or peer-reviewed literature. Links open the primary source directly.
- Regulatory / pharmacopeialBacteriostatic Water for Injection (official monograph)
- Regulatory / pharmacopeialBacteriostatic Water for Injection, USP — FDA prescribing information (Hospira, Inc.)
- Regulatory / pharmacopeialBacterial Endotoxins/Pyrogens — Inspection Technical Guide
- Regulatory / pharmacopeialGeneral Chapter ⟨660⟩ Containers — Glass
- Regulatory / pharmacopeialGeneral Chapter ⟨797⟩ Pharmaceutical Compounding — Sterile Preparations
- Regulatory / pharmacopeialBeSafeRx: Your Source for Online Pharmacy Information
- Regulatory / pharmacopeialInternet Pharmacy Warning Letters
- Public health authorityPreventing Unsafe Injection Practices