# 8 Documents Every Lab Should Keep for Traceability
If an auditor asked you tomorrow to prove where a single vial came from, could you? Most labs can’t, at least not quickly. Lab consumables traceability documents are the paper trail that makes that proof painless, and this list covers the eight that matter most.
Eight documents carry consumables traceability: the CoA, the CoC, the supplier spec sheet, lot records, incoming inspection logs, calibration certificates, storage and temperature logs, and corrective action records. Link them all by lot number and nearly any audit question becomes a two-minute lookup.
Below I explain what each document is, what it must contain, and where labs usually go wrong. I’ve also added notes on retention periods and electronic records, because most audit findings actually come out of those two areas.
The 8 Documents, One by One
1. The Certificate of Analysis (CoA)
The CoA is the workhorse. It reports the actual test results for a specific lot against the product’s specification, so it answers the question an auditor cares about: did this exact lot meet spec when it left the factory?
A proper CoA is lot-specific, not a generic product sheet. Look at a real one and you’ll see test values next to limits. A Thermo Fisher CoA for LC-MS grade acetonitrile, for example, lists gradient suitability, evaporation residue, and a dozen individual ionic impurities, each with a specification and the measured result for that lot. Agilent prepares the CofA for its chemical reference standards according to ISO 17034 and ISO Guide 31, and it includes composition, release date, expiry date, storage conditions, homogeneity, and the uncertainty calculation (Agilent eCertificates page).
One trap worth knowing: some vendors now print a QR code on the box instead of shipping a paper CoA. Waters does this for many kits, and their own support team warns that the lot number on a vial inside the kit may differ from the kit lot number on the box (Waters support note WKB10151). So keep the box, or at least photograph the kit lot, until you’ve downloaded the right certificate.
My default is to file the CoA the day I open the box, not the day the shipment arrives. That way the document is already tied to the moment the lot entered service. If you’re fuzzy on how a CoA differs from a certificate of conformance, the breakdown in CoA vs CoC: what lab buyers should know is worth five minutes.
2. The Certificate of Conformance (CoC)
The CoC is a statement, not a dataset. The manufacturer declares that the goods conform to the agreed specification or purchase order. There are usually no measured values on it, just the declaration, a lot or batch reference, and a signatory.
Why keep it? Because for many commodity consumables, the CoC is the only lot document that exists. Nobody runs HPLC suitability testing on a box of crimp caps or a rack of pipette tips. For those products, the CoC plus your own incoming inspection is the entire quality record. A GxP lab that receives a pallet of autosampler vials without any lot documentation will struggle to answer a data integrity question two years later.
The mistake I see most often is labs treating the CoC as if it were a CoA. If a supplier hands you a “certificate” with no test results, ask which one it is. If your method depends on a measurable property, like membrane cut-off or solvent purity, you need the document with numbers, and you need the right lot number on it. The two documents are related, but they are not interchangeable, and knowing which one you’re holding changes what you can claim about that lot.
One practical note: the CoC should still be lot-specific in its reference. A conformance certificate that says “all products of this type” instead of naming a lot is close to worthless for traceability, because it cannot be tied to the boxes on your shelf. Push back when you receive one. Most suppliers will reissue a lot-referenced version the same week, because they keep that mapping in their release records anyway.
3. The Supplier Specification Sheet
The spec sheet (or technical data sheet) describes what the product is supposed to be: dimensions, materials, tolerances, purity grades, operating ranges. It is the yardstick against which both the CoA and your own checks are measured.
This document matters more than most labs realize, because it defines “fit for purpose” before anything arrives at your door. If your method calls for a 0.45 µm PTFE membrane and a quote arrives for a 0.22 µm version at a tempting price, the spec sheet is where you catch that before it costs you a validation. The same goes for vial volume claims, neck finishes, insert compatibility, and chemical resistance ratings.
A good spec sheet also gives you the vocabulary to challenge a supplier. When a filter clogs unexpectedly or a bottle leaks at the cap, you go back to the stated tolerances and ask whether the lot met them. That conversation goes much better when you can quote the sheet. We keep a guide to reading a lab consumables spec sheet: 10 key terms if the terminology feels dense.
Keep the dated version. Suppliers revise specs quietly, and the version you validated against is the one that matters in an audit, not whatever is on the website this month.
4. Lot and Inventory Records
The four documents above come from the supplier. This one is yours, and it’s the link that makes everything else useful.
A lot record maps each consumable lot through its life in your lab: which purchase order brought it in, where it was stored, when it was opened, and which analyses or projects used it. ISO/IEC 17025 expects exactly this kind of technical record: the standard’s clause on technical records requires the date, the person responsible for each activity, and enough information to repeat the work under conditions as close as possible to the original (ISO/IEC 17025:2017).
The test is simple. Pick any result you reported this year. Can you name the lot of vials, filter, and mobile phase bottle behind it in under five minutes? In my experience, labs that pass this test share one habit: they record the lot at the bench, the moment the container is opened, not in a batch entry at the end of the week when memory has already blurred.
It doesn’t need to be fancy. A printed sheet taped inside the storage cabinet works, one line per lot: lot number, date received, date opened, initials. Some labs pre-print labels when a new lot arrives and stick them on worksheets as containers get used. Whatever the format, one rule holds: the lot number gets written down where the work happens, because a number that lives only on the shipping box gets recycled with the cardboard.
I once watched a lab repeat three weeks of stability runs because nobody could tie a syringe filter lot to the sequence. The data was probably fine. Nobody could prove it, so it wasn’t. That reprint cost more than a year of filter spend, and it happened for the lack of one line in a logbook.
5. Incoming Inspection Logs
Incoming inspection is where supplier promises meet your bench, and the log is your proof that the meeting happened.
What goes in it? Whatever you actually check on receipt: container condition, quantity, label and lot match against the paperwork, expiry dates where relevant, and any functional spot check your lab deems worth doing. The log needs a date, an inspector, and a pass or fail per lot. Two minutes per shipment is enough if the habit is consistent.
The value shows up when something is wrong. A dented box, a short count, a CoA lot that doesn’t match the bottles: the log is the record that you caught it on arrival rather than mid-analysis, which is exactly the distinction a quality investigation will care about. And when a lot genuinely fails, the log becomes the anchor for the whole follow-up. The steps worth taking, from quarantine to supplier notification, are laid out in what to do when a consumable lot fails incoming inspection.
Most labs skip incoming inspection for cheap consumables and get away with it until they don’t. The day a $30 case of vials causes a $30,000 investigation is the day everyone wishes the receiving log had a checkmark in it.
Who does the checking matters less than that it gets done. In small labs the same scientist who ordered the box inspects it, which is easy. In bigger labs, receiving falls to a storekeeper or an office coordinator who may not know what a neck finish is. If that’s your situation, hand the inspector a one-page card with three or four checks in plain language: box intact, count matches, label lot matches the paperwork, certificate present. No metrology degree required, and the log starts meaning something.
6. Calibration Certificates
Consumables traceability leans on equipment traceability. A temperature logger tells you nothing if the logger itself was never calibrated, and a pipette’s volume claim is only as good as its last calibration.
ISO/IEC 17025 handles this under metrological traceability: results must connect through a documented, unbroken chain of calibrations to an appropriate reference, with each step carrying its own recorded uncertainty. The standard also specifies what a calibration certificate must contain, including the measurement results with their expanded uncertainty, so the certificate is a record you can actually evaluate rather than a rubber stamp.
Which certificates belong in the consumables file? Pipettes and balances, obviously. But also the thermometers and data loggers watching your fridges, freezers, and drying ovens, plus any thermometer you use to verify a 40 °C drying oven or a 121 °C autoclave cycle. When an excursion investigation opens, the first question is whether the instrument that reported the excursion was itself in calibration. If the answer is on file, the investigation stays short.
Keep the certificates with their uncertainty values visible. A certificate that says “passed” without numbers is close to useless for anyone who later needs to build an uncertainty budget.
7. Storage and Temperature Logs
Where a consumable lives, and at what temperature, is part of its history. This is the document labs most often under-maintain, usually because nothing goes wrong for years.
The basics: continuous or daily logging for fridges, freezers, and any temperature-controlled storage that holds reagents, media, or reference materials, plus a note when material sits outside its stated conditions. USP makes the stakes clear for reference standards: storage conditions are lot-specific and can change from one lot to the next, and users are expected to check the current lot’s valid use status before use (USP Reference Standards). If a certificate says 2-8 °C, your log needs to show 2-8 °C, including overnight.
The excursions matter more than the graph. A fridge that drifts to 9.5 °C for six hours is a data point. The record of what you did about it, whether you quarantined the contents, checked stability, or documented that the material was unaffected, is what turns an incident into a closed event instead of an open audit finding.
For dry consumables like vials and filters, a simpler record works: storage location plus any humidity-sensitive notes. Even that much beats the common alternative, which is no record at all and a shrug when someone asks where lot 2408-C spent its first six months.
Don’t forget the odd corners. Desiccators holding pre-sieved membranes, the amber cupboard where light-sensitive reagent bottles live, the bench drawer where individually wrapped filters sit at room temperature for months. None of these need a chart recorder, but a note in the lot record saying where the material was kept closes the loop. The most common gap I see is a material that moved: stored correctly on arrival, then parked on a sunny windowsill during a bench reorganization that nobody documented.
8. Corrective Action and Nonconformance Records
The first seven documents capture events. This one captures what you did when events went wrong, and it’s the one auditors read most carefully, because it shows whether your system learns.
ISO/IEC 17025 requires a procedure for nonconforming work that includes judging the significance of the problem, analyzing the impact on previously issued results, and defining who has authority to restart work, with records kept of all of it. The same expectation applies when a consumable lot fails. The record should show the failure, the containment, the impact check on past results, and the prevention.
The pattern that earns respect in an audit is a closed loop. A failed filter lot triggers quarantine, then an impact review, then a root cause that traces back to a supplier process change. A single failure is an event. A repeated failure from the same supplier is a signal, and the right response is a formal supplier review. Our 12-point consumables supplier audit checklist covers what to look at when that conversation happens.
Keep these files linked to the lot numbers they involve. A corrective action that references “the failed filter lot” without a lot number helps nobody two years later.
How Long Should You Keep These Documents?
Longer than feels convenient, and always per contract. ISO/IEC 17025’s records clause requires records to be retained for as long as contractual obligations require, and to remain legible and retrievable for that whole period. Read that carefully: the clock is set by your commitments to customers and sponsors, not by your filing cabinet’s capacity.
For labs in the drug supply chain, FDA expectations run in the same direction, with batch and laboratory records kept for years past a product’s expiry, and the agency’s Part 11 scope-and-application guidance stresses that records must stay readily retrievable for the full retention period and available for inspection on request.
In my experience, five years is a sensible floor for consumables documentation in a GxP environment, with longer periods where a sponsor or method validation protocol says so. The detail that decides real audits is not the duration but the retrieval speed. A record that exists but takes two days to find fails in practice.
Paper or Electronic? What Part 11 Means for Your Records
Many labs now keep CoAs as PDFs and logs in spreadsheets or LIMS. That’s fine, with one caveat. When an electronic record replaces a paper one that a predicate rule requires, FDA’s 21 CFR Part 11 applies, and its core controls kick in: validated systems, limited access, and secure, time-stamped audit trails that record who changed what, and when, without obscuring the previous entry.
The good news is that FDA’s own scope-and-application guidance takes a risk-based view, exercising enforcement discretion on several Part 11 provisions while still expecting the underlying records to be trustworthy and attributable. Practically, that means your spreadsheet of filter lots needs access control and change history if it’s the official record, not just a shared file anyone can overwrite.
My rule of thumb: if a record matters enough to keep, it matters enough to control. Version history on, edits attributed, backups tested once in a while.
A Two-Minute Audit Drill
Try this once a quarter. Pick a random reported result, then trace it backward: the vial lot, the filter lot, the reagent lot, the calibration status of the instrument, and the storage conditions in effect that week. Time yourself.
If the chain closes in two minutes, your eight documents are doing their job. If it breaks somewhere, you’ve found the weak link before an auditor did, which is the cheapest possible way to find it.
Conclusion
Traceability is not a binder you assemble the week before an audit. It’s eight ordinary documents, kept honestly and linked by lot number, that together tell the story of every consumable that touched your work: what the supplier tested, what you checked on arrival, where it was stored, and what you did when something failed. Labs that keep all eight answer audit questions in minutes. Labs that skip a few spend those same audits reconstructing history from memory and invoices, and the reconstruction rarely satisfies anyone.
Start with the documents you’re missing, not a full system redesign. Most labs already have CoAs and calibration certificates on file; the common gaps are lot records at the bench and a real incoming inspection log. Close those first. For a deeper look at the two supplier documents people confuse most often, read CoA vs CoC, and when you’re ready to evaluate the suppliers behind those documents, the supplier audit checklist is the natural next step.
Frequently Asked Questions
What is the difference between a CoA and a CoC for lab consumables?
A CoA reports measured test results for a specific lot against a specification. A CoC is a declaration that the goods conform to the agreed requirements, usually without test data. Use the CoA when a measurable property matters to your method, and treat the CoC as the baseline declaration for commodity items.
How long should a lab keep CoAs and lot records?
Keep them for as long as your contracts, sponsors, or quality system require, with five years a common practical floor in GxP settings. ISO/IEC 17025 ties retention to contractual obligations and expects records to stay retrievable for that entire period.
Do I need a CoA for every box of pipette tips or vials?
You need lot traceability for every box, which usually means a CoC plus your own receiving record rather than a full CoA. If the product’s properties directly affect your results, ask the supplier for the lot-specific document and file it when the box is opened.
What traceability documents do auditors ask for first?
Auditors typically start with a CoA for a lot in use, then follow the chain: your receiving record, storage logs, and the calibration status of the instrument that produced the result. A closed chain of eight documents, all keyed to lot numbers, answers almost every request.
Are electronic CoAs and digital logs acceptable for traceability?
Yes, provided the records are trustworthy, attributable, and retrievable. If an electronic record replaces a paper one required by FDA rules, 21 CFR Part 11 controls such as access limits and audit trails come into play. A controlled spreadsheet beats an uncontrolled filing cabinet every time.
