Peptide Testing Labs: How to Verify a Lab Before You Trust Its Report

A certificate of analysis lands in your inbox and the supplier tells you the product is clean, pure, and ready to list. The problem is that you have never heard of the lab that signed the report. You do not know whether it is a real analytical facility with trained chemists and calibrated instruments, a paper operation that prints whatever a client pays for, or something in between. That uncertainty is a real risk. If the report is meaningless, every claim your store makes about third-party testing is meaningless too, and the downstream consequences for your brand's credibility and your customers' trust are severe.

A certificate of analysis is only as reliable as the lab behind it. That sentence sounds obvious, but founders can skip the verification step because they do not know what to look for or where to look. To verify a lab, confirm its legal identity, confirm that the exact test method in your report is on the lab's current accreditation scope, and confirm the report number directly with the lab. We will walk through what an accreditation scope is and why the scope matters more than the certificate itself, what a credible lab report must disclose, a numbered verification procedure you can run on any lab before you trust its work, a copyable comparison worksheet, and the red flags that separate a legitimate analytical facility from a report mill. By the end, you will have a repeatable process you can apply to every new supplier relationship you build.

Why Accreditation Is Not a Binary Yes or No

When a founder hears "the lab is accredited," they often treat that as a pass and move on. Accreditation is not a single switch. Ask what exactly the lab is accredited for. Understanding what an accreditation covers, and what it does not, is the first skill a peptide brand operator needs.

Ask the lab for its accreditation scope document and read which test methods it lists. Do not assume that an accreditation certificate on a website covers the specific work done for you. Check the scope against your report.

This is the distinction that most founders miss. The question is never simply "is this lab accredited?" The question is "is the specific test method used in this specific report listed on this lab's current accreditation scope?" Those are two entirely different questions, and only the second one protects you.

ISO/IEC 17025 is the international standard that sets the management and technical requirements a testing lab is assessed against. NIST, for example, says the labs it accredits "are assessed against the management and technical requirements published in the International Standard, ISO/IEC 17025:2017." Accreditation is granted for the specific methods listed on the lab's scope, not for the lab as a whole. The accreditation bodies are checked too. ILAC says the bodies that sign its mutual recognition arrangement, the ILAC MRA, "have been peer evaluated in accordance with the requirements of ISO/IEC 17011 to demonstrate their competence." Its signatory search lists each body with "the scope of their recognition". NIST also reports a transition from the ILAC MRA to the Global Accreditation Cooperation MRA, so check the current ILAC pages before you rely on what recognition any body holds. Use https://ilac.org to find the accreditation body named on your report, then search that body's own directory for the lab.

Find the accreditation body named on the report and look for its public directory. When you find the lab's entry in that directory, download the scope document and read it. Look for the specific analytical technique mentioned in the report you are evaluating. If the technique is not on the scope, the accreditation does not cover that work, regardless of what the lab's marketing materials say.

One more nuance: accreditation status can change, so a lab that was accredited in the past may not be today. Always check the current status in the accreditation body's live directory, not on a PDF the lab emailed you.

What a Credible Lab Report Must Disclose

Before you run any verification procedure, you need to know what a legitimate analytical report looks like. A report from a competent, independent laboratory will contain a specific set of disclosures. If any of these are missing, that absence is itself a data point.

Laboratory identity. The report must state the lab's full legal name, its physical address, and its accreditation body and certificate number. A PO box or a suite number in a virtual office building is not a physical laboratory address. The address should correspond to a real analytical facility.

Report number. Every legitimate report carries a unique report number that the lab can look up in its own records system. This is how you confirm the report is genuine. If a lab cannot retrieve a report by its report number when you call or email, that is a serious problem.

Sample identification. The report should describe how the sample was identified when it arrived at the lab. This typically includes a sample ID assigned by the lab, a description of the sample as received, and the date of receipt. The date of receipt matters because it lets you cross-reference the report date against the timeline of your supplier relationship.

Chain of custody or sample receipt documentation. A credible lab documents how the sample arrived. This does not need to be an elaborate chain of custody form, but there should be some record of who submitted the sample and when. For a research use only peptide brand, this matters because it establishes that the sample tested was actually the product in question, not a substitute.

Test methods, stated explicitly for each result. This is one of the most important disclosures and one of the most commonly omitted in low-quality reports. For each result on the report, the method used to generate that result should be named. For each of purity, identity, sterility or bioburden, and endotoxin, the report should name the method used. If you do not recognize a method, ask the lab to explain it in writing. Example: a report that states "purity: 99.2%" without naming the method used to arrive at that number is not a complete report. You cannot evaluate the result without knowing the method.

Instrument and column information (for chromatographic methods). Sophisticated labs will include the instrument model, the column used, and the chromatographic conditions in an appendix or method section. This level of detail is a positive signal. Its absence does not automatically disqualify a report, but its presence raises your confidence.

The actual chromatogram or spectrum. For HPLC purity results, a credible lab will either include the chromatogram in the report or make it available on request. The chromatogram is the raw data underlying the purity number. A lab that refuses to provide chromatograms is asking you to trust a number without showing you the evidence. For mass spectrometry identity results, the spectrum or a summary of the identified peaks should be available.

Analyst signature and review signature. A credible report shows who authorized its release.

Units and reference ranges. Every numerical result should state its units and, where applicable, the acceptance criteria or reference range used to interpret it. Example: a purity result of 98.7% means something different depending on whether the method is area percent by HPLC or a different calculation. The report should be explicit.

If you want to go deeper on reading the individual sections of a report once you have confirmed the lab is legitimate, see our guide at How to Read a Peptide Certificate of Analysis.

The Numbered Verification Procedure

This is the core of the guide. Run this procedure on every lab whose reports you plan to rely on. Each step has a pass or fail check. A single fail at any step is a reason to pause and investigate further before accepting the report.

Step 1: Establish the lab's legal identity.

Search the lab's full legal name in the business registry of the state or country where it claims to be located. Confirm that the entity exists, that it is in good standing, and that its registered address matches or is consistent with the address on the report.

Pass: The lab's legal name appears in the relevant business registry, is in good standing, and the address is consistent with the report.

Fail: The lab name does not appear in any business registry, the entity is dissolved or suspended, or the address on the report does not correspond to any registered entity.

Step 2: Confirm the physical address is a real laboratory.

Search the address in a mapping tool and look at the street-level imagery. A legitimate analytical laboratory occupies a commercial or industrial building. If the address resolves to a residential property, a UPS Store, or a virtual office suite, that is a fail.

Pass: The address corresponds to a commercial or industrial facility that is plausibly a laboratory.

Fail: The address is a residential property, a mailbox service, or a virtual office.

Step 3: Find the lab in the accreditation body's live directory.

Identify which accreditation body the lab claims to be accredited by. Go to that accreditation body's website directly, not through a link the lab provides. Search the live directory for the lab by name and location. Confirm the accreditation is current and not suspended.

Pass: The lab appears in the accreditation body's live directory with a current, active accreditation.

Fail: The lab does not appear in the directory, or its accreditation is listed as suspended, withdrawn, or expired.

Step 4: Download and read the scope document.

From the accreditation body's directory entry for this lab, download the current scope of accreditation. Read through the listed test methods. Find the specific method used in the report you are evaluating. Confirm it is on the scope.

Pass: The specific test method named in the report (for example, HPLC for purity, LC-MS for identity) appears in the lab's current accreditation scope for the relevant sample type.

Fail: The method used in the report is not listed on the scope, or the scope covers a different category of testing entirely.

Step 5: Check the accreditation body on the ILAC website.

Go to https://ilac.org and look for the accreditation body named on the report. Check the current ILAC pages to see how they describe that body.

Pass: You can find the accreditation body on the ILAC website and what you find is consistent with what the lab claims.

Fail: You cannot find the accreditation body on the ILAC website, or what you find is not consistent with what the lab claims.

Step 6: Confirm the report number directly with the lab.

Contact the lab by phone or email using contact information you found independently, not the contact information printed on the report itself. Ask the lab to confirm that report number X was issued by their facility, that it covers the sample described, and that the results on the report match their records. A legitimate lab will confirm this without hesitation. They may ask you to submit the request in writing for their records, which is reasonable.

Pass: The lab confirms the report number, the sample description, and the results match their records.

Fail: The lab cannot find the report number in their system, the results they confirm differ from the report you hold, or the lab does not respond to the inquiry.

Step 7: Confirm the sample submission chain.

Ask your supplier to provide documentation of how the sample was submitted to the lab. This could be a submission form, a shipping label, or a chain of custody document. Confirm that the submitter named in the lab's records is consistent with your supplier's identity. This step is about confirming that the sample tested was actually your product, not a substitute.

Pass: The supplier can provide submission documentation, and the submitter identity is consistent with the supplier's identity.

Fail: The supplier cannot explain how the sample reached the lab, or the submitter identity in the lab's records does not match the supplier.

Step 8: Request the underlying raw data.

Ask the lab for the chromatogram for any HPLC result and the spectrum for any mass spectrometry result. A legitimate lab will provide these, either as part of the standard report package or on request. Evaluate whether the chromatogram is consistent with the purity number reported. If you are not yet fluent in reading chromatograms, our guide at How to Read a Peptide Certificate of Analysis covers the basics.

Pass: The lab provides raw data on request, and the data is visually consistent with the reported results.

Fail: The lab refuses to provide raw data, or the raw data is inconsistent with the reported results.

The Lab Comparison Worksheet

Use this worksheet when you are evaluating multiple labs simultaneously. Copy it into a spreadsheet and fill in one column per lab. Leave no field blank when you complete your evaluation. A blank field means you have not yet verified that item.

The "report verification method" field is where you record how the lab allows you to confirm a report is genuine. Some labs provide a QR code or a web portal where you can enter a report number and see the confirmed results. Others require a direct email or phone inquiry. Document this for every lab you work with so your team can run verification consistently without reinventing the process each time.

The "sample retention period" field matters for your own records management. If a question about a product arises months after the report was issued, you want to know whether the lab still holds the original sample and for how long. Ask this question before you rely on a lab, not after.

For more detail on what testing costs and how to budget for it across your product line, see What Third Party Peptide Testing Actually Costs. For guidance on how to select a lab in the first place, before you begin the verification process described here, see How to Choose a Peptide Testing Lab: An RFP for Analytical Work.

Red Flags That Suggest a Report Mill or a Forged Report

This section covers the warning signs that should make you stop and investigate before accepting any report at face value. Some of these are definitive disqualifiers. Others are signals that warrant deeper inquiry.

The lab cannot be found in any accreditation body's directory. This is the most serious red flag. If a lab claims accreditation but does not appear in the relevant accreditation body's live directory, treat the accreditation claim as unverified until the accreditation body confirms it, and do not accept the report in the meantime. Directory names can differ from trading names, so search the legal name and any parent company too.

The lab's address does not correspond to a real facility. If the address on the report resolves to a residential property, a mailbox service, or a virtual office, the lab is not operating a real analytical facility at that address. This does not necessarily mean the report is forged, but it means the lab's identity claim is false, which is a serious reason to reject the report until the lab explains.

The report number cannot be confirmed by the lab. If you contact the lab using independently verified contact information and they cannot find the report number in their system, the report is either forged or the lab's record-keeping is so deficient that the report is unreliable. Either outcome is a fail.

The report lists no methods. A report that gives results without naming the analytical method used to generate each result is not a complete analytical report. It is a document that asserts numbers without evidence. Legitimate labs always name their methods because the method is part of the result. Omitting methods is a hallmark of report mills that generate documents without performing actual analysis.

The purity result is suspiciously round or suspiciously high. Example: a report that states purity is exactly 99.0% for every product in a supplier's catalog, with no variation, is statistically implausible. Real analytical results vary. A supplier whose entire catalog shows identical round-number purity results across multiple batches and multiple compounds is a signal worth investigating.

The chromatogram is unavailable or inconsistent with the reported purity. If a lab refuses to provide the chromatogram underlying an HPLC purity result, that refusal is a red flag. If they do provide a chromatogram and the peak areas are inconsistent with the reported purity percentage, the report may have been altered or the result misreported; ask the lab to explain. Our guide at How to Tell If a Peptide COA Is Fake: Verification Steps covers the specific visual and numerical inconsistencies to look for in a chromatogram.

The report was issued before the sample could have been received and analyzed. Check the sample receipt date against the report date. If the report date is earlier than the receipt date, or the gap is shorter than the lab's own stated turnaround, the timeline needs an explanation. Ask the lab directly.

The lab's contact information on the report does not match independently verified contact information. If the phone number or email address on the report connects you to a different entity than the lab's independently verified contact, the report may have been modified after issuance. Always verify contact information through the accreditation body's directory or the lab's independently verified website, not through the report itself.

The accreditation certificate on the lab's website is expired or does not match the accreditation body's records. A certificate on a lab's website may be outdated or may not match the accreditation body's records. Always check the live directory, not the PDF on the lab's site.

The supplier is resistant to independent testing. If a supplier discourages you from sending a sample to a lab of your own choosing, or insists that only their preferred lab's reports are valid, that resistance is a significant red flag. A supplier with nothing to hide welcomes independent verification. Resistance to independent testing is one of the clearest signals in this business that something is wrong.

The report covers only favorable tests and omits standard tests. Panels vary, so ask which tests were run and why. Purity by HPLC and identity by mass spectrometry answer different questions, and endotoxin by LAL or sterility testing may also be relevant. A report that covers only purity and omits identity confirmation is incomplete. A supplier who provides only partial testing may be hiding results from the tests they chose not to run. For more on endotoxin testing specifically, see Peptide Endotoxin Testing: What to Request Per Lot.

The lab's scope covers only unrelated industries. Some labs are accredited for food testing, environmental testing, or materials testing, and have no scope covering pharmaceutical or chemical analysis of peptides. An accreditation certificate from such a lab is not relevant to peptide purity or identity testing, even if the certificate looks impressive. Always read the scope, not just the certificate.

The report uses vague language about identity. A legitimate identity confirmation by mass spectrometry will state the observed molecular weight, the expected molecular weight, and whether they match within the instrument's tolerance. A report that states "identity confirmed" without any supporting data is not an identity confirmation. It is an assertion.

Understanding the Difference Between Supplier-Provided and Independently Commissioned Reports

One of the most important operational distinctions in peptide brand building is the difference between a COA provided by your supplier and a COA you commission yourself by sending a sample to a lab of your choosing. These two documents are not equivalent, and understanding why matters for how you represent your testing program to your customers.

A supplier-provided COA was commissioned by the party selling you the product. The supplier chose the lab, submitted the sample, and received the report. Even if the lab is legitimate and the report is accurate, the supplier had control over the process. They chose which batches to test, which tests to run, and which results to share with you. You are seeing a curated view of their quality control program, not an independent assessment.

An independently commissioned COA is one where you or your brand purchased the sample from the supplier through normal channels, then sent a portion of that sample to a lab of your own choosing, using your own account with that lab, and received the report directly. In this model, the supplier had no involvement in the testing process after the sale. The report reflects what was actually in the product you purchased, not what the supplier chose to show you.

For a research use only peptide brand that wants to make credible third-party testing claims, independently commissioned testing is the standard that supports those claims. Supplier-provided COAs can be a useful starting point for evaluating a new supplier, but they should not be the only testing your brand relies on. Our guide at What Third Party Tested Means and How to Check It covers this distinction in detail.

How to Build a Repeatable Lab Verification System for Your Brand

Running this verification procedure once is useful. Building it into your standard operating procedures so that every person on your team can run it consistently is what protects your brand at scale. Here is how to operationalize what we have covered.

Create a lab registry document. Maintain a running document or spreadsheet that records every lab your brand has evaluated, with the results of the verification procedure for each one. Include the date you verified each lab, the accreditation body and certificate number, the scope document version, and the contact information you used to confirm the report number. Update this document whenever you verify a new lab or re-verify an existing one.

Set a re-verification schedule. Accreditation status and scope can change, so a lab that passed your verification procedure some time ago may not pass today. Build a calendar reminder to re-verify every lab in your registry on a schedule you set (Example: once per year), or whenever you receive a report from a lab you have not used recently.

Assign verification responsibility. In a small team, the founder often runs verification personally. As your team grows, assign this responsibility explicitly to a specific role. Document the procedure so that whoever holds that role can run it without relying on institutional memory.

Require raw data as a standard deliverable. When you open an account with a lab or negotiate a testing agreement, specify in writing that raw data (chromatograms for HPLC results, spectra for mass spectrometry results) is a required deliverable for every report. Getting this agreed upfront is easier than requesting it after the fact for each individual report.

Document the sample submission chain for every test. Keep records of how every sample you submit to a lab was collected, labeled, packaged, and shipped. This documentation supports the integrity of your testing program and is a useful record to keep on file.

Cross-reference report dates against your purchase records. For every COA in your files, confirm that the sample receipt date on the report is consistent with when the product was available to be sampled. A report dated before a product batch was manufactured is impossible and indicates a problem with the report.

The Relationship Between Lab Verification and Your Brand's Credibility

We want to be direct about why this matters beyond the operational mechanics. The research use only peptide market is one where trust is the primary differentiator. Your customers are researchers, institutions, and professionals who need to know that the products they purchase for their work are what the label says they are. When you publish a COA on your product page, you are vouching for the quality of that document. If the lab behind it is not legitimate, that claim is false, and your brand's credibility is built on a false foundation.

Beyond credibility, there are practical business consequences. Check the current policy of each payment processor and platform you rely on, because this guide cannot tell you how any of them treat testing documentation. The quality of your documentation matters, and the verification procedure in this guide produces records you can show to anyone who asks.

For a complete picture of what "third-party tested" means in practice and how to represent your testing program accurately, see What Third Party Tested Means and How to Check It.

Frequently Asked Questions

How do I find out if a lab is actually accredited right now, not just in the past?

Go directly to the accreditation body's website and search their live directory. Do not rely on the accreditation certificate the lab provides, because certificates are issued at a point in time and may have expired or been withdrawn since then. The live directory reflects current status. If the lab claims to be accredited by a body you have not heard of, first look it up at https://ilac.org and check what ILAC says about it, then find that body's directory and search it directly.

What if the lab's accreditation scope does not specifically mention peptides?

Read the scope carefully before concluding it does not apply. Accreditation scopes describe test methods and sample matrices, not always the specific compound class. A scope that covers HPLC purity testing of synthetic organic compounds or pharmaceutical substances may be relevant to peptide testing even if the word "peptide" does not appear. Conversely, a scope that covers food analysis or environmental water testing is almost certainly not relevant. When in doubt, contact the accreditation body directly and ask whether the listed scope covers the type of analysis you are evaluating.

Can a supplier forge an accreditation scope document as well as the COA itself?

Yes, a sufficiently motivated bad actor could forge both. This is why the verification procedure requires you to go directly to the accreditation body's live directory rather than relying on any document the supplier or lab provides. Compare any scope document you are given with what the accreditation body's directory shows. If there is any discrepancy, treat it as a serious red flag and ask the accreditation body to explain.

What is the minimum testing panel I should require before accepting a supplier's product?

We are not going to prescribe a specific panel because the appropriate testing depends on the compound, the intended research use, and your brand's quality standards. What we will say is that a report covering only one test type (for example, purity only with no identity confirmation) is incomplete for most purposes. Identity confirmation by mass spectrometry is a standard expectation because purity by HPLC alone does not confirm that the compound is what the label says it is. A high-purity sample of the wrong compound is not a quality product. Beyond purity and identity, endotoxin testing is relevant for many research applications. See Peptide Endotoxin Testing: What to Request Per Lot for more on that specific test.

My supplier says their lab is "ISO certified." Is that the same as ISO/IEC 17025 accredited?

Not necessarily. ISO/IEC 17025 accreditation means an accreditation body assessed the lab against that standard's management and technical requirements for the methods on its scope. "ISO certified" can mean many different things, so ask the lab exactly which standard it is certified or accredited to, and ask for the accreditation body's name and certificate number so you can verify it in that body's live directory.

How do I know if a COA has been altered after the lab issued it?

There are several signals to look for. First, run the report number confirmation step in the verification procedure: contact the lab directly and ask them to confirm the results on the report match their records. If the results you hold differ from what the lab confirms, the document may have been altered or the lab's record may be wrong, so ask the lab to explain in writing. Second, look at the chromatogram if one is included. Our guide at How to Tell If a Peptide COA Is Fake: Verification Steps covers the specific visual inconsistencies that appear when a chromatogram has been manipulated, including mismatched fonts in the data fields, inconsistent peak integration values, and metadata anomalies in the PDF file itself. Third, check whether the report's formatting is consistent with other reports from the same lab. Report mills often use templates that differ subtly from the genuine lab's format.

What should I do if I confirm a COA is forged or the lab is not real?

Stop using that supplier immediately and document everything you have found. Keep copies of the forged report, your verification steps, and the evidence that led to your conclusion. Do not destroy any records. Depending on the scale of your exposure, you may want to consult with a lawyer about your options and obligations. You should also consider whether any products sourced from that supplier are currently listed on your store and what your obligations are to your customers. This is a business and legal question, not one we can answer for you in a general guide, but the documentation you have built through the verification process will be essential to any conversation with counsel.

If you are building a research use only peptide brand and want to talk through how to structure your testing program, your supplier verification process, and your documentation practices, we are happy to talk it through with you. Book a fit call at peptideecommerce.com and let us see whether we can help.

Sources

This article is not legal advice and does not constitute legal, regulatory, or compliance counsel of any kind. The verification procedures described here are operational practices for brand operators and do not substitute for advice from a qualified attorney or regulatory consultant.

ILAC, ILAC MRA and Signatories: https://ilac.org/ilac-mra-and-signatories/

NIST, National Voluntary Laboratory Accreditation Program: https://www.nist.gov/nvlap