Last reviewed: August 30, 2026. Educational content for adults 21+. This is not medical or legal advice. Kiody does not sell concentrated 7-OH products.
Suggested page / content hub: Learning Center → Lab Testing & Product Quality
Secondary phrases: kratom COA audit trail, kratom chromatogram review, laboratory data integrity, kratom lab records, how to verify a kratom COA
Suggested SEO title: Kratom Laboratory Data Integrity: What Is Behind a COA?
Suggested meta description: Learn how chromatograms, audit trails, integrations, calculations, signatures and COA version control support a trustworthy kratom lab result.
Suggested URL slug: /learn/kratom-laboratory-data-integrity/
The short answer
A certificate of analysis is the final summary of a much larger analytical record. A defensible COA should be traceable to a specific sample, lot, method, instrument sequence, analyst, calculation, review and approved report version. For instrument-based tests, the supporting record may also include raw data files, chromatograms or spectra, integration settings, calibration data, system-suitability results, audit trails and any documented reprocessing.
That does not mean every customer should receive an instrument’s entire electronic database. It means the company relying on the result should have a practical way to confirm that the report is authentic, lot-specific, complete and supported by records that qualified reviewers can reconstruct.
The central question is simple:
If someone challenged the number on this COA, could the responsible parties reconstruct how the sample became that number without guessing?
A polished PDF alone cannot answer that question. Neither can a laboratory logo, an ISO/IEC 17025 accreditation badge or a QR code by itself. Those can be useful signals, but data integrity depends on how records were created, preserved, changed, reviewed and connected.
For kratom, the issue matters because small differences in wording or calculation can produce very different interpretations. Examples include:
- Reporting 7-OH as a percentage of product weight versus a percentage of total alkaloids;
- Converting a dry-weight result into milligrams per serving;
- Integrating a small peak near the method’s reporting limit;
- Applying a dilution factor to an extract;
- Linking a tested bulk sample to finished packaged units;
- Deciding whether a non-detect means “not present” or merely “not detected above the reporting limit”; and
- Reissuing a COA after a correction without preserving the superseded version.
Data integrity is not a promise that the product is safe, effective or legal. It is the foundation for determining whether the reported evidence is reliable enough to use.
What “data integrity” means in plain language
FDA’s data-integrity guidance for drug CGMP describes complete, consistent and accurate data and uses the familiar characteristics attributable, legible, contemporaneously recorded, original or a true copy, and accurate. That guidance directly addresses drug manufacturing, not kratom or dietary supplements. Kiody uses its concepts here as a technical framework for understanding trustworthy laboratory records—not as a claim that every drug-specific provision automatically governs every kratom test. FDA Data Integrity and Compliance With Drug CGMP.
In practical terms, trustworthy laboratory data should allow a reviewer to determine:
- Who performed each important action;
- What sample, method, instrument and version were used;
- When the work and review occurred;
- Where the original or authoritative record is maintained;
- Why a change, reintegration, repeat or correction occurred; and
- How the final result was calculated and approved.
Data integrity covers paper and electronic records. A handwritten worksheet can have integrity problems if entries are backdated, overwritten or missing. An electronic system can have integrity problems if analysts share passwords, can delete failed injections, overwrite files or change integrations without a trace. Technology does not create integrity on its own; controls and review do.
The regulatory baseline for dietary-supplement laboratory records
Kratom’s federal regulatory position is unusual. FDA states that kratom has not been lawfully marketed in the United States as a conventional food or dietary supplement. This article does not imply FDA approval of kratom or any Kiody product. FDA and Kratom.
At the same time, dietary-supplement CGMP requirements provide an important quality-control framework for companies and laboratories evaluating botanical products. Under 21 CFR Part 111:
- Laboratory facilities must be adequate for the tests and examinations needed to determine whether specifications are met.
- Laboratory control processes must be established and followed.
- Examination and testing methods must be verified as appropriate for their intended use.
- An appropriate, scientifically valid method must be identified and used for each specification requiring a test or examination.
- Written laboratory procedures must be kept.
- The person conducting a test must document at the time of performance that the established methodology was followed.
- Laboratory records must include the results of the testing and examination.
These points come from 21 CFR Part 111, Subpart J, including 21 CFR §111.320 and §111.325.
Part 111 does not prescribe a universal file format for a kratom chromatogram or a single commercial laboratory-information system. It does require records sufficient to show that the applicable procedure was followed and to preserve the test result. The right record package depends on the method and decision. A visual package inspection produces different source records from an HPLC alkaloid assay, an ICP-MS metals panel or a microbiological enrichment test.
FDA’s current dietary-supplement inspection program also identifies botanical ingredients as an area of concern because they may carry microbial or elemental contaminants, and it notes that botanical extracts can present identity and strength-testing challenges. FDA Compliance Program 7321.008.
A COA is a report, not the complete analytical record
A COA usually presents selected information in a readable format:
- Laboratory name and contact information;
- Customer or submitting company;
- Sample name and identifier;
- Lot or batch number;
- Dates received, tested and reported;
- Methods or method references;
- Analytes and results;
- Units and reporting limits;
- Specifications or pass/fail statements, if the laboratory was given them;
- Authorizing signature; and
- Report number and version.
The complete analytical record may be much larger. Depending on the test, it can include:
- Chain-of-custody and sample-receipt records;
- Sample condition and photographs;
- Sample preparation weights, volumes and dilution steps;
- Reagent, standard and reference-material records;
- Instrument sequence or run list;
- Calibration standards and calibration curve;
- Blanks, controls, spikes, duplicates and continuing checks;
- System-suitability data;
- Chromatograms, spectra, plate counts or instrument outputs;
- Processing methods and integration parameters;
- Raw result and calculation worksheets;
- Audit trails and user activity;
- Deviations, investigations and repeat-test decisions;
- Technical and quality review evidence; and
- Final, corrected and superseded report versions.
The COA is therefore closer to the last page of a documented process than the process itself.
The seven links in a traceable result
1. Product lot to submitted sample
The first link is not analytical. It is the connection between the commercial lot and the portion delivered to the laboratory.
A laboratory can accurately test the wrong sample. It can also accurately test a small portion that was not selected representatively. Data integrity does not cure sampling error, but it should preserve the sample’s identity and history.
A traceable submission record should identify, as applicable:
- Product name and form;
- Manufacturer or responsible company;
- Lot or batch number exactly as shown on the package;
- Bulk, in-process or finished-packaged status;
- Package count or sampling location;
- Person who collected the sample;
- Collection date and sampling plan;
- Seal or custody identifier;
- Requested tests; and
- Storage and transport conditions.
If a COA says only “Green Powder” with no lot number, a customer cannot reliably connect it to the product in hand.
2. Submitted sample to laboratory accession
When the lab receives the sample, it should assign a unique identifier and document condition. The accession record helps prevent two similarly named products from being confused.
Useful receipt details include:
- Date and time received;
- Receiver identity;
- Package and seal condition;
- Amount received;
- Temperature or other condition when relevant;
- Discrepancies between submission form and sample label;
- Photographs where useful; and
- Laboratory accession number.
The accession number should carry through worksheets, instrument sequences, raw data and the final report.
3. Accession to test portion and preparation
Many results depend on steps that occur before the instrument reads anything. Powder must be mixed or subsampled. A known mass may be extracted into a known volume. The solution may be diluted again. Capsules may be composited or tested individually. Extracts can require very large dilution factors.
A reconstructable preparation record should capture the actual values, not just ideal instructions:
- Balance and container identifiers;
- Actual sample mass;
- Extraction solvent and volume;
- Sonication, mixing, filtration or digestion conditions;
- Dilution steps and final volume;
- Preparation date and time;
- Analyst identity;
- Reagent and standard lots; and
- Departures from the method.
One missing zero in a dilution factor can change a reported result tenfold. A final COA may not display the intermediate math, but the source record should.
4. Preparation to instrument sequence
Instrumental analysis is rarely a single sample injection. A sequence may include a blank, multiple calibration standards, a system-suitability solution, controls, the sample, a duplicate, a spike and later calibration checks.
The sequence establishes context. A sample peak can look reasonable in isolation even when the blank is contaminated, the calibration has drifted or a continuing check failed.
For each run, a reviewer should be able to identify:
- Instrument and software;
- Acquisition-method version;
- Sequence name and creation time;
- Vial positions and sample identifiers;
- Injection order;
- Standards, controls and blanks;
- Acceptance criteria; and
- Aborted, interrupted or excluded injections.
5. Raw signal to processed result
Chromatographic instruments record a signal over time. Software identifies peaks and calculates areas or heights. The processing method can determine where a peak begins and ends, whether two peaks are separated and which small signals are counted.
Integration is not automatically suspicious. Manual review and justified adjustment can be scientifically appropriate. The integrity question is whether the original data, original processing, changed processing and reason for the change are preserved and reviewed.
FDA’s drug data-integrity guidance defines an audit trail as a secure, computer-generated, time-stamped record that allows reconstruction of creation, modification or deletion events. Its HPLC example includes the user, run date and time, integration parameters, reprocessing details and justification. Again, that is nonbinding drug guidance used here for technical context. It gives readers a concrete picture of what “reconstructable” means. FDA data-integrity guidance.
6. Processed result to calculation and specification
The instrument output is often not the result shown on the COA. Calculations may apply sample mass, extraction volume, purity correction, dilution factor, moisture correction, unit conversion and serving size.
For example:
- 0.012% by weight equals 0.12 mg/g;
- 0.12 mg/g in a 2.5 g serving equals 0.30 mg per serving;
- 0.12 mg/g is not the same as 0.12% of total alkaloids; and
- A dry-weight result is not interchangeable with an as-received result unless the moisture basis is stated and conversion is supported.
The calculation record should show formulas, inputs, units, rounding and reviewer checks. The specification applied should be the approved version for the product and jurisdiction—not a limit selected after the result was known.
7. Approved result to issued COA
The final link is report control. A report should not become “official” merely because someone exported a PDF.
A controlled COA process should answer:
- Who technically reviewed the data?
- Who authorized release of the report?
- What report number and version were issued?
- Was the report sent through a controlled portal or authenticated channel?
- Can a recipient verify it directly with the laboratory?
- If corrected, what changed and why?
- Was the earlier version marked superseded rather than silently erased?
The report’s digital appearance is secondary. A plain report with strong control can be more trustworthy than a glossy report with no version, signature or verification path.
Static records, dynamic records and why a PDF may not be enough
A static record presents fixed information. A printed balance ticket or finalized PDF is static. A dynamic electronic record allows interaction that may be necessary to understand the data—for example, zooming into a chromatographic baseline, inspecting integration events, reviewing individual injections or viewing metadata.
Exporting a dynamic record to PDF can preserve visible content while losing important context. It may omit:
- Audit-trail events;
- Processing-method changes;
- Hidden or aborted injections;
- Peak-identification settings;
- Manual integration events;
- User and time metadata; or
- The ability to reconstruct how the result was generated.
FDA’s drug guidance says an electronic true copy should preserve the content and meaning of the original, including relevant metadata and the record’s static or dynamic nature. The practical lesson for kratom quality review is not that every brand needs the laboratory’s proprietary software. It is that a brand should not treat a flattened PDF as proof that all relevant source data were reviewed and preserved.
Audit trails: the change history behind the data
An audit trail should help reconstruct significant electronic actions. Depending on the system, it may record:
- User login and logout;
- Sequence creation or modification;
- Method creation or modification;
- Data acquisition;
- File renaming, copying or deletion attempts;
- Integration changes;
- Reprocessing;
- Result approval or rejection;
- Report generation; and
- Administrative changes.
An audit trail is useful only if it is enabled, secured, retained and reviewed. A system can create thousands of events that no one meaningfully evaluates. Review should be risk-based and connected to the data decision.
For a near-threshold 7-OH result, a reviewer may focus on changes to peak integration, calibration, dilution factors, sample identity and reprocessing. For a microbiology result, the more relevant trail may involve sample login, media controls, incubation records, plate interpretation and confirmed pathogen results.
Audit trails also need context. A reintegration event is not proof of manipulation. A single analyst may legitimately correct an objectively misdrawn baseline. The questions are whether the action was authorized, scientifically justified, traceable and independently reviewed.
Original data, true copies and backups are different
These terms are often blurred.
- Original data are the first capture of the information or the source record in which it was initially recorded.
- Metadata describe and give context to the data, such as user, date, time, instrument, method and processing events.
- A true copy preserves the content and meaning of the original record, including necessary metadata.
- A backup is a protected copy used for recovery after loss or system failure. A backup is not a substitute for an accessible working archive.
- A report summarizes selected results. It is not automatically an original record or true copy of all analytical data.
A laboratory should be able to retrieve records throughout the required retention period. Files stored on an instrument computer with no controlled archive are vulnerable to deletion, corruption, hardware failure and software obsolescence. Conversely, copying files nightly does not establish that users lacked the ability to change or delete them before the backup.
User access and shared passwords
Attributable data require identifiable users. Shared analyst logins undermine the ability to determine who performed or changed an action.
Useful controls include:
- Unique user accounts;
- Role-based permissions;
- Separation of routine analyst and system-administrator authority;
- Prompt removal of access when roles change;
- Password and session controls;
- Periodic access review;
- Restricted deletion privileges; and
- Review of administrator activity.
Small laboratories may have limited staff, but limited headcount does not make shared identity a sound record-control practice. Where complete separation of duties is difficult, documented independent review and compensating controls become more important.
Chromatograms, integrations and reprocessing
What a chromatogram shows
In HPLC or LC-MS analysis, a chromatogram displays detector response across time. Peaks may correspond to compounds separated by the method. Identification and quantitation also depend on standards, retention behavior, selectivity and the validated method—not the visual shape alone.
For a kratom alkaloid panel, a responsible review can include:
- Correct sample and sequence identity;
- Calibration performance;
- System suitability;
- Blank interference;
- Retention-time or identification criteria;
- Peak separation and selectivity;
- Integration consistency;
- Dilution suitability;
- Quality-control sample performance; and
- Results within the method’s validated range.
Manual integration
Automatic integration rules cannot resolve every unusual baseline. Manual integration may be allowed under a controlled procedure when scientifically justified. Red flags arise when:
- Manual integration is common rather than exceptional;
- Only failing or near-limit samples are reintegrated;
- The original integration is not preserved;
- The reason is vague, such as “better result”;
- Different integration treatment is applied to standards and samples without rationale;
- Analysts can change results after review; or
- Reviewers see only the final PDF.
Reprocessing versus retesting
Reprocessing uses existing raw data with a changed processing method or integration. Retesting performs a new measurement, often with a new preparation or injection. They answer different questions and should not be blurred.
A laboratory should not repeatedly process or test until a preferred result appears. If a result is questioned, the investigation should define the hypothesis, the authorized action and the treatment of all results before the repeat is performed. Drug-specific FDA out-of-specification guidance offers a useful technical principle: preserve and fully document the original result and laboratory assessment. It is not presented here as a direct kratom rule. FDA OOS guidance.
Different tests produce different source records
Alkaloid testing
An alkaloid result may rely on HPLC, UHPLC or mass-spectrometric detection. Important records can include certified reference-standard information, calibration, chromatograms, integration, dilution factors, moisture basis and reporting units.
Near a legal or internal limit, denominator discipline is critical. A dry-weight percentage, milligrams per gram, milligrams per serving and percentage of total alkaloids are not interchangeable.
Heavy metals
ICP-MS or related elemental methods generate calibration, blank, internal-standard and quality-control data. Digestion weights, final volumes, dilution factors and interference controls matter. A COA may round to two decimals while the decision was made with more digits; the rounding rule should be controlled.
Microbiology
Microbiological source records may include sample portion, media lot, positive and negative controls, incubation temperature and time, colony counts, enrichment steps and confirmation. “Not detected” should specify the tested analytical portion or method basis where the report format permits.
Pesticides and residual solvents
Multiresidue methods can involve many analytes, transitions, retention windows and reporting limits. Headspace GC methods for solvents require matrix-appropriate calibration and controls. A single “pass” hides many analyte-level decisions, so the laboratory should retain the underlying panel and control data.
Identity tests
Botanical identity evidence can include microscopy images, chromatographic fingerprints, DNA data, reference specimens and analyst observations. A method that supports raw-leaf identity may not be suitable for a highly processed extract in which diagnostic structures or DNA are absent.
Five worked data-integrity reviews
Scenario 1: The correct result is attached to the wrong lot
A COA reports acceptable microbiology results for lot K2407. The product package says lot K2470. The seller says the digits were transposed on the PDF.
What the evidence shows: The report does not match the package as issued.
What to review: Submission form, sample photograph, accession record, laboratory work order, report-generation history and corrected-report procedure.
Sound outcome: Do not silently edit the PDF. Determine whether the tested sample was K2407 or K2470. If the source records support K2470 and the report contained a transcription error, issue a controlled corrected report that identifies the change and supersedes the earlier version. If sample identity cannot be established, the COA should not be used for that lot.
Scenario 2: A 7-OH peak is manually reintegrated
An initial integration reports 0.052% 7-OH. A later integration reports 0.048%. Only the later number appears on the COA.
What the evidence shows: A result changed after processing. It does not establish whether the first or second integration is scientifically correct.
What to review: Raw chromatogram, original and revised integrations, integration procedure, audit trail, calibration and controls, analyst justification, independent review, measurement uncertainty and applicable denominator.
Sound outcome: A qualified reviewer determines which integration follows the validated method and documents the reason. Both processing histories remain preserved. The decision should not be driven by which number is more commercially convenient. If the result is near a product or legal threshold, a pre-established decision rule and product-specific legal review are essential.
Scenario 3: An extract result is off by a factor of ten
The instrument reports a valid solution concentration, but the COA’s mitragynine result is ten times higher than expected.
What the evidence shows: The instrument signal may be sound while the final calculation is not.
What to review: Sample mass, extraction volume, serial dilution steps, calculation template, units, formula version and second-person calculation check.
Sound outcome: Correct the calculation under report-control procedures, assess whether any released product decision relied on the incorrect result and preserve both report versions. A new instrument run is not necessarily needed if the raw data and preparation records are valid and the error is solely a documented calculation mistake.
Scenario 4: The laboratory sends only a screenshot
A vendor provides a screenshot showing “Salmonella: PASS” with a lab logo but no sample identifier, method, report number or signature.
What the evidence shows: The image does not establish which sample was tested or whether it is an authorized report.
What to review: Full report, lab verification portal or direct confirmation, sample lot, dates, method, analytical portion and authorized signatory.
Sound outcome: Treat the screenshot as incomplete. Obtain a complete, verifiable report before relying on the result.
Scenario 5: A corrected COA replaces the original with no explanation
A current QR code opens a COA dated August 20. A customer saved an earlier report for the same lot dated August 17 with a different lead result. Neither is marked as a revision.
What the evidence shows: Two conflicting reports exist without visible version control.
What to review: Laboratory report history, reason for correction, raw data, calculation record, authorization and distribution list.
Sound outcome: Establish which report is current, why the result changed and whether affected recipients were notified. The revised report should identify its version or amendment status, and the superseded report should remain retrievable in the controlled record.
Twenty warning signs on a kratom COA or lab record
One warning sign is not proof of misconduct. It is a reason to ask for clarification.
- The product lot is absent or does not match the package.
- The sample name is generic enough to fit many products.
- The report lacks a unique report number.
- No issue date or testing dates appear.
- The laboratory cannot verify the report directly.
- The QR code leads to an editable seller-controlled image rather than an authenticated report or lot page.
- Units or denominators are missing.
- “ND” appears without a reporting limit or method context.
- A multi-analyte panel is reduced to one unexplained “pass.”
- The reported method is unsuitable for the product matrix or analyte.
- The result falls outside the stated calibration range with no dilution or qualification.
- The laboratory permits analysts to share logins.
- Original integrations or failed injections cannot be retrieved.
- Manual integration is routine and undocumented.
- Repeated testing continues until a passing result appears.
- A corrected report silently replaces the original.
- The laboratory report and seller-displayed COA contain different values.
- A report carries an accreditation logo, but the specific method is outside the lab’s accredited scope.
- The brand cannot explain how the submitted sample represents the commercial lot.
- A “legally compliant” statement appears without identifying the jurisdiction, product basis, date or threshold.
A practical 32-field Kiody laboratory-data record
The following record could support internal COA review without requiring public release of confidential laboratory systems.
| Field | Review question |
|---|---|
| 1. Product name | Does it match the marketed item? |
| 2. Product form | Leaf powder, pure-leaf capsules, extract, liquid or other? |
| 3. Internal SKU | Is the product unambiguous? |
| 4. Lot or batch | Does it match finished units? |
| 5. Manufacturing stage | Component, bulk or finished packaged product? |
| 6. Sampling-plan ID | How was the portion selected? |
| 7. Sampler and date | Who collected it and when? |
| 8. Chain-of-custody ID | Was transfer documented? |
| 9. Laboratory | Which legal entity performed the test? |
| 10. Accreditation and scope | Does the relevant method appear on the current scope? |
| 11. Laboratory accession | Can the lab find the exact sample? |
| 12. Receipt condition | Was damage or discrepancy recorded? |
| 13. Test panel | What was requested? |
| 14. Method and version | Which controlled method applied? |
| 15. Matrix suitability | Is it appropriate for this product form? |
| 16. Analyst | Is work attributable? |
| 17. Instrument or equipment | Which controlled system produced data? |
| 18. Test dates | When was work performed? |
| 19. Reference standards | Are identity, lot and validity documented? |
| 20. Calibration status | Did calibration and checks meet criteria? |
| 21. Quality-control samples | Did blanks, spikes, duplicates or controls pass? |
| 22. Sample preparation | Are actual weights, volumes and dilutions recorded? |
| 23. Raw-data location | Can source data be retrieved? |
| 24. Processing method | Which integration or processing version was used? |
| 25. Reprocessing | Did it occur, and is the reason documented? |
| 26. Retesting | Did it occur under an approved investigation? |
| 27. Calculation | Are formula, units and rounding reproducible? |
| 28. Specification version | Which pre-approved acceptance rule applied? |
| 29. Technical review | Who checked analytical validity? |
| 30. Quality review | Who approved product use or disposition? |
| 31. COA report and version | Is the issued report uniquely controlled? |
| 32. Correction history | Are changes and superseded versions preserved? |
This record is a proposed editorial tool, not a regulation or a substitute for a qualified quality system.
What customers can reasonably verify
Customers do not need to become chromatography auditors. A useful public lot page can provide enough information to check the essentials:
- Exact product and lot;
- Laboratory identity;
- Sample or report number;
- Dates;
- Methods or method families;
- Results, units and reporting limits;
- Authorized report version;
- A direct authentication route;
- Plain-language explanations of ND, LOQ and units; and
- Clear separation of tested facts from marketing claims.
Brands can add trust without publishing proprietary raw files. They can state that complete source records are retained and reviewed, describe their COA-verification process, disclose report corrections and provide a contact for technical questions.
What a brand should ask a contract laboratory
A responsible supplier-qualification or audit conversation can include:
- How are samples accessioned and linked to final reports?
- Are users assigned unique accounts?
- Who can create, change or delete methods and data?
- Are audit trails enabled for critical systems?
- How are audit trails reviewed, and by whom?
- How are manual integrations governed?
- How are aborted injections, reprocessing and retesting handled?
- Are original data and metadata retained in a reconstructable format?
- How are backups tested, and how are archived records retrieved?
- How are calculation templates controlled and verified?
- How are report revisions approved and communicated?
- Can the laboratory authenticate a report for a customer?
- What happens when a result is out of specification or otherwise atypical?
- Does the accreditation scope cover the exact method and matrix?
- How are subcontracted tests identified?
The answer does not have to expose cybersecurity-sensitive details. It should demonstrate that the lab understands and controls the risks.
COA authenticity and version control
A verification feature is most useful when it is controlled by the laboratory or when a brand’s lot page displays the exact authorized laboratory report without alteration.
Good practices include:
- A unique report identifier;
- Version or amendment number;
- Laboratory-controlled portal or verification contact;
- Cryptographic or document security where appropriate;
- Clear “superseded” status for replaced reports;
- Change reason on corrected reports;
- Record of recipients who received a material correction; and
- Internal reconciliation between public lot page and approved file.
A QR code is only a pointer. It does not authenticate whatever appears at the destination. If the destination can be changed without version control, the code may create convenience without integrity.
Data integrity does not replace the rest of quality control
Even perfect records cannot correct a weak underlying study.
A complete, accurate COA may still be unhelpful if:
- The sample was not representative;
- The method was not suitable for the matrix;
- The wrong analytes were tested;
- The reporting limit was too high for the decision;
- The product specification was unsupported;
- The result was applied to a different lot;
- Packaging or labeling controls failed; or
- The legal threshold was misunderstood.
Data integrity is one layer of evidence. Sampling, method suitability, specifications, manufacturing controls, labeling and product-specific legal review remain separate layers.
Botanical leaf, extracts and concentrated products must remain distinct
Ordinary botanical kratom leaf, leaf powder and pure-leaf capsules are not analytically interchangeable with extracts, enhanced leaf or concentrated 7-OH products.
- Botanical leaf and powder: Records should preserve botanical identity, lot, plant material sampling and the natural matrix used in the method.
- Pure-leaf capsules: Kiody describes its capsules as containing approximately 500 mg of leaf powder per capsule. Capsule weight, composite strategy and lot connection matter.
- Extracts: Higher concentrations and additional manufacturing steps can demand different preparation, dilution, identity and residual-solvent controls.
- Enhanced or fortified products: Added material changes the composition and may create analytical and legal questions that a natural-leaf COA does not answer.
- Concentrated 7-OH: Kiody does not sell concentrated 7-OH. A report for such a product should never be presented as evidence about ordinary botanical leaf.
- Synthesized or semi-synthesized derivatives: These require compound-specific identification and legal review. A generic “kratom alkaloids” panel may not resolve them.
Current federal 7-OH and derivative status as of August 30, 2026
Legal status is not a stability attribute or a general laboratory “pass.” It requires the correct compound, product form, threshold, denominator, date and jurisdiction.
As of August 30, 2026:
- DEA’s proposal to temporarily place 7-OH above a specified threshold in Schedule I remains proposed, not final. The federal comment period was extended through September 10, 2026. The proposal uses a 0.050% dry-weight threshold and an alternative 1 mg article trigger under specified circumstances. Federal Register comment-period extension.
- Mitragynine pseudoindoxyl, MGM-15 and MGM-16 entered federal Schedule I on August 26, 2026 under a separate temporary scheduling order. DEA temporary scheduling order.
These are different actions. A laboratory report should identify which analyte it measured and at what reporting limit. A broad “7-OH compliant” statement does not establish absence of mitragynine pseudoindoxyl, MGM-15 or MGM-16. State and local requirements can also use different limits and denominators.
Frequently asked questions
1. Does a lab signature prove a COA is authentic?
Not by itself. A signature is useful when it belongs to an authorized reviewer and the report can be verified through a controlled laboratory channel.
2. Is an ISO/IEC 17025-accredited COA automatically reliable?
Accreditation is a meaningful signal, but the exact method must be within the laboratory’s current scope, and the sample, report and records must still be controlled. Accreditation does not make every method at a lab accredited.
3. Should a customer ask for every chromatogram?
Usually not. The company relying on the data should ensure qualified review and retention. Customers can reasonably ask for a lot-specific, authentic report and clear explanations of unusual or near-limit results.
4. What is an audit trail?
It is a time-stamped electronic history that helps reconstruct creation, modification or deletion events. Its content depends on the system.
5. Is manual integration always improper?
No. It can be scientifically justified under a controlled procedure. The original integration, change, reason and review should be preserved.
6. What is the difference between reprocessing and retesting?
Reprocessing recalculates or reintegrates existing raw data. Retesting generates additional measurements. Both should be authorized, documented and interpreted with the original result.
7. Can a laboratory delete a failed injection?
A complete record should preserve relevant invalid, aborted or failed work and the reason it was excluded. Silent deletion prevents reconstruction.
8. What does “original data” mean for an HPLC test?
It includes the initially acquired electronic data and relevant metadata, not merely the printed final chromatogram.
9. Is a PDF a true copy?
It may be for a static record. For dynamic instrument data, a PDF may omit metadata or functionality needed to preserve content and meaning.
10. What does ND mean?
Usually “not detected” under the method’s conditions. It does not mean absolute zero. The reporting or detection limit is necessary to interpret it.
11. Can a brand edit a laboratory COA for readability?
It is safer to publish the authorized report unchanged and provide a separate plain-language explanation. Altering the report can create authenticity and version-control problems.
12. Why do two COAs for the same lot sometimes differ?
Possible reasons include different samples, methods, preparation, reporting basis, laboratories, dates or corrected calculations. The difference should be investigated rather than averaged away.
13. What if the lot number has a one-character typo?
Confirm the source records. If it is a report error, issue a controlled correction. Do not assume the correct lot without evidence.
14. Does a passing COA prove every package is identical?
No. It describes the tested sample. The strength of the inference depends on the sampling plan, process controls and lot uniformity.
15. Does data integrity prove a product is legal?
No. Reliable data support legal analysis, but legality also depends on product form, composition, date, jurisdiction, sales channel and applicable law.
16. Does Kiody sell concentrated 7-OH?
No. Kiody is 21+ and does not sell concentrated 7-OH.
17. What should happen when a COA is corrected?
The correction should be reviewed, authorized, dated and versioned. The reason should be recorded, the earlier report retained as superseded, and affected recipients notified when appropriate.
18. What is the simplest customer check?
Match the exact product and lot, confirm the laboratory and report number, inspect units and dates, and use the laboratory’s verification route when available.
Primary sources and editorial references
- 21 CFR Part 111, Subpart J—Laboratory Operations — current federal dietary-supplement laboratory requirements.
- 21 CFR §111.320 — appropriateness and scientific validity of laboratory methods.
- 21 CFR §111.325 — written procedures, contemporaneous documentation and results.
- FDA Dietary Supplement Compliance Program 7321.008 — current inspection framework issued August 18, 2025.
- FDA Data Integrity and Compliance With Drug CGMP — drug-specific, nonbinding guidance used here only for technical concepts such as metadata, dynamic records and audit trails.
- FDA OOS Test Results Guidance — drug-specific guidance used only for the technical distinction between investigation, retesting and preserving original results.
- FDA and Kratom — FDA’s current federal kratom position.
- Federal 7-OH comment-period extension — proposed action and September 10, 2026 comment deadline.
- DEA temporary order for mitragynine pseudoindoxyl, MGM-15 and MGM-16 — effective August 26, 2026.