A certificate is a scope statement. It records what a certifying body checked, at which site, against which standard, on which date. It does not describe what is in your container.
Buyers of coconut oil, MCT and desiccated coconut file three documents against a shipment: an organic certificate, a supplier GRAS letter, and a certificate of analysis. All three can be genuine and current while the lot misses spec or gets detained at the US border. Usually nothing has been falsified. The documents cover less ground than the buyer assumes, and the gap costs a rejected container plus six to ten weeks of replacement lead time.
What does an organic certificate actually attest?
Production method, at a named operation, for listed products.
US law defines organic production as a production system managed through cultural, biological and mechanical practices, and defines “organic” itself as a labeling term. Neither definition touches composition, residues or safety. The same section defines a certified operation as an operation “or portion of such operation”. That phrase is the scope trap. A refinery can be certified for one line and not another, so match the exact product name on the certificate rather than the company name at the top.
Residue testing does not attach to your consignment either. Under 7 CFR 205.670 a certifying agent tests a minimum of five percent of the operations it certifies each year, which is portfolio surveillance rather than a lot release test. EU maximum residue levels under Regulation (EC) No 396/2005 apply to all food on the market, organic or conventional, with a 0.01 mg/kg default. Organic status carries no residue advantage in law.
Organic certification also has no expiry date. Under 7 CFR 205.404 it runs until surrendered, suspended or revoked, so a PDF can look current while the operation behind it sits suspended. That rule requires certificates to be generated from the Organic INTEGRITY Database, and requires certifier addenda to tell you to verify the operation there. The regulation is instructing buyers not to trust the paper alone.
The consignment document is a different one. 7 CFR 205.273 requires each US import shipment to carry valid NOP Import Certificate data, filed by the importer in CBP’s Automated Commercial Environment. A scope certificate with no import certificate against the container leaves the lot with no organic paperwork at all. Where those chains break is covered in organic coconut chain of custody.
Why does a GRAS letter carry less than buyers assume?
GRAS attaches to a substance under stated conditions of use. Never to a supplier, a factory or a lot.
FDA’s notification programme is explicitly voluntary. A company may instead convene its own expert panel, reach a self-affirmed conclusion, and never tell FDA. Most supplier GRAS letters in ingredient trade are that second kind: a document the supplier paid for.
Even the reviewed version says less than the sales sheet implies. FDA’s response letter on MCT states that it “is not an affirmation that MCT is GRAS under 21 CFR 170.35” and that manufacturers stay responsible for compliance. The C8 and C10 ranges and the lead and peroxide limits inside that notice were the notifier’s own specification, not limits FDA imposed on the industry.
| Record | Status | Date |
|---|---|---|
| GRN 449, medium chain triglycerides (Lonza) | FDA ceased evaluation at the notifier’s request | 19 February 2014 |
| GRN 1049, medium-chain triacylglycerols (Nestlé) | No questions, limited to use as a fat source in cow milk based exempt infant formula for term infants, up to 50% of total fat by weight | 21 September 2022 |
| Notices filed under “caprylic” | None in the inventory | n/a |
| Affirmed listing for MCT in 21 CFR | None | n/a |
Source: FDA GRAS Notice Inventory, searched September 2026. The two notices sit under different spellings, so searching “triglycerides” alone misses the 2022 record.
Read that GRN 1049 scope line twice.
A supplier presenting it against MCT sold into a beverage or a nutrition bar is citing a clearance that does not reach the use. Nothing in it speaks to 3-MCPD and glycidyl esters, mineral oil hydrocarbons, pesticide residues, or the refining route the plant ran. For the feedstock and duty questions under that spec, see sourcing MCT oil.
The ground is moving. FDA published a proposed rule on 11 August 2026, docket FDA-2025-N-3262, that would require GRAS notices to be submitted rather than kept in house. Comments close 9 December 2026 and no final rule exists. The proposal ends self-affirmation in private, not a company’s ability to reach its own conclusion. Treat “we are self-affirmed” as a statement with a shelf life.
What does a BRCGS or FSSC certificate exclude by design?
Two audits in three are booked in advance.
The GFSI benchmark requires only one unannounced audit every three years, so on an annual cycle most visits are scheduled. What they cover is narrower again. BRCGS states in its scope design guideline of 22 July 2025 that certification is site specific, and that transport, sales, marketing, growing, distribution and delivery all fall outside the standard. Where product leaves the site and does not return, those activities are outside the audit, which is what happens when fractionation or repacking is tolled out.
The same guideline bans claim language in scope wording, including claims supported by other schemes such as organic and halal. A GFSI certificate therefore carries no organic assurance, by the scheme owner’s own rule. Products are grouped rather than listed individually, so a scope line reading “manufacture of coconut derived oils” reveals nothing about grade or route.
Certificates also die quietly: a site that moves premises has its certificate withdrawn. Verify status in the register, not the PDF in your file.
When is a COA not a verification record?
When it prints typical values instead of tested results.
21 CFR 111.75 lets a manufacturer rely on a supplier’s certificate of analysis only where it first qualified the supplier by confirming the supplier’s results, the certificate states the method, the limits and the actual results, and the buyer periodically re-confirms. A specification datasheet dressed as a COA fails that on its face.
FSMA supplies the field list. Under 21 CFR 1.506 a testing record must identify the food and lot, the number of samples, the methods, the dates, the results and the laboratory that ran them. Anything missing a lot number, a method or a lab name is a marketing document.
ISO/IEC 17025 accreditation is granted per method, so check the lab’s scope, not just its logo. And an ISO 2859-1 acceptance quality limit caps the risk of taking a poor lot, making a pass a probability, not a guarantee about every drum.
Falsified paperwork is not theoretical. A UK trader was fined £50,830.75 in July 2024 after 13 of 16 Salmonella test reports shown to an inspector proved fabricated. CFIA’s 2024 to 2025 food fraud report, published July 2026, recorded 67% authenticity compliance for olive oil and 86% for other expensive oils. Most failing lots shipped with clean paperwork.
Who carries the risk when the paperwork is clean?
The importer carries it.
Under the Foreign Supplier Verification Programs rule at 21 CFR part 1 subpart L, the importer is the US owner or consignee, and FDA’s guidance puts verification on that party. The rule recognises four verification activities: onsite audit, sampling and testing, review of the supplier’s food safety records, and other appropriate activities. A supplier certificate is not among them. The domestic mirror at 21 CFR 117.415 goes further and forbids accepting a supplier-conducted audit, or that supplier’s review of its own records, as verification at all.
Coconut buyers have a live example. FDA Import Alert 23-12, published 17 July 2025, applies detention without physical examination to coconut products over microbiological contamination, and its red list names firms in Sri Lanka, India, the Philippines, Vietnam and Thailand. Listing is firm specific rather than country wide, and once a firm is on it detention applies whatever its BRCGS or FSSC certificate says.
| Document | What it attests | What it does not reach | Where to verify |
|---|---|---|---|
| Organic certificate | Production and handling method at a named operation, for listed products | Residue results for your lot, micro limits, allergens, heavy metals, quality spec | USDA Organic INTEGRITY Database |
| NOP Import Certificate | Organic status of one consignment | Anything about food safety | Data filed in CBP ACE |
| GFSI certificate | Food safety system at one audited site, for grouped products in the scope line | Growing, transport, distribution, organic or halal claims, off site steps | BRCGS Directory, FSSC public register, SQF database |
| GRAS letter | A substance under stated conditions of use | The supplier, the factory, the lot, refining route, contaminants | FDA GRAS Notice Inventory |
| Certificate of analysis | Tested results for a sampled lot, where actual results are printed | Untested parameters, lots outside the sample | Lab accreditation scope, retained samples |
What this means for buyers
- Procurement (persona A): match the certificate to the product name and processing step, not the supplier name, and pull status live from the issuing register at every renewal. None of these documents fails loudly.
- Procurement (persona A): reject any COA printing typical or specification values. Require actual results, method, limits, lot number and the lab name, then check that lab’s accreditation scope covers the method.
- Brand owners (persona C): treat a supplier GRAS letter as an opening position. Ask whether it is self-affirmed or notified, and if notified, read its conditions of use against your application.
- Both: write verification into the contract rather than the file. Retained samples, split-sample testing at load port and a right to audit do work no certificate performs.
- Both: diary 9 December 2026, when GRAS comments close. If notification becomes mandatory, suppliers relying on private expert panels need a new answer.
FAQ
Does an organic certificate mean the product is pesticide free?
No. Organic certification is a production-method standard. Certifiers test a minimum of five percent of certified operations annually as surveillance, and EU residue limits under Regulation (EC) No 396/2005 apply to organic and conventional food alike.
Is a self-affirmed GRAS letter legal?
Yes, today. Notification to FDA is voluntary, so a company may reach its own GRAS conclusion privately. FDA proposed making notification mandatory on 11 August 2026, with comments closing 9 December 2026. No final rule has been issued.
Does a BRCGS or FSSC certificate cover my organic claim?
No. BRCGS scope guidance prohibits claims such as organic or halal in certificate scope wording, including claims supported by other schemes. The two systems are audited separately.
Who is liable if a certified supplier ships a failing lot?
Under FSVP the US importer carries the verification duty. A supplier certificate is not one of the four verification activities the rule recognises, and a supplier-conducted audit is excluded outright.
Need a spec and its verification route locked across origins before the contract is signed? Send the desk an RFQ.