Heavy metals testing for supplements: what a reviewer looks for on a COA

The four elements a COA is checked against

USP General Chapter <2232>, Elemental Contaminants in Dietary Supplements, exists to "limit the amounts of elemental contaminants in finished dietary supplement dosage forms labeled as conforming to USP or NF standards," and its own notice page states plainly that the chapter's focus is "four primary elements: arsenic, cadmium, lead, and mercury." When a reviewer scans a heavy-metals section of a COA, these are the four rows expected. A results table missing one of them, for a product tested against USP's chapter, is missing a required test rather than simply reporting a clean result.

Why per-day exposure, not just concentration

A concentration figure alone, parts per million in the product, doesn't say how much of the element a person actually takes in, because that depends on how much of the product they consume in a day. USP's chapter is built around a Permitted Daily Exposure (PDE) rather than a bare concentration: the compliance approach is risk-based, and PDE values are then converted into a concentration appropriate to a specific product and its serving size, rather than one concentration figure applying uniformly to every product regardless of dose. A separate technical explainer of the chapter puts it directly: "PDE values need to be converted to concentrations when evaluating metallic impurities in formulations or their structural components." Two products can carry the identical parts-per-million reading and have different exposure implications, because the amount actually consumed per day differs.

Why an element's chemical form matters

Not every chemical form of an element carries equal toxicological weight, which is why elemental contaminant testing is not simply "measure the element, compare to one number" for every case. Some elements are assessed and reported at a level that distinguishes the form actually present rather than a generic elemental total. What this means for a COA: a results table that reports a bare elemental total with no note on the form or method used is giving a reviewer less assurance than one that documents what was actually measured. If a product's result is close to a limit, the underlying chemical form of what was found can be the difference between a result that clears review and one that doesn't, which is a question for the testing lab's method, not something a brand can infer from a single number.

Two different authorities, two different numbers

A single product can be checked against more than one authority's heavy-metal limits, and they are not interchangeable:

California's statute defines a chemical as known to the state to cause cancer or reproductive toxicity if it has been "clearly shown through scientifically valid testing according to generally accepted principles," or if "a body considered to be authoritative by such experts has formally identified it," or if a state or federal agency has "formally required it to be labeled or identified" as such: three distinct listing pathways, none of which require the same evidence standard as the others. This is a different mechanism entirely from USP's compendial process, which is why the same element can carry different limits under each authority for the same product.

What this means for reading your own COA

• Check that all four elements appear as line items with numeric results and units, not a single combined "heavy metals: pass" line.
• Check what the result is being compared against. A specification column that just says "USP" or "Prop 65" without a product-specific figure isn't giving you the actual limit applied.
• If a result is close to a limit, ask the lab what form or method was used for that element, not just the headline number.
• Know which authorities actually apply to your product and sales channel. Prop 65 applies by where you sell, USP by what your label claims or what your platform requires.

The mechanics of reading any COA line (non-detect notation, why "Conforms" isn't a result, what makes a results table unusable) are covered in how to read a Certificate of Analysis. The actual numeric limits, by authority and product type, with their own citation and verification date, are in the requirements library, not restated here, since a number copied into an article goes stale the moment the authority updates it. Compliant Always's free check reads a COA's elemental results against the current library values directly.