The traceability chain for a consumable has six links, and most certificates--Chromatography Supplier

A 0.10 mL lot of 8 mm crimp vials failed incoming inspection at 11.4 N pull-off force against a 15 N minimum, and the certificate of analysis said nothing about pull-off force at all. What it said was “glass: borosilicate 1.1, conforms.” That is the moment most labs discover that their ISO 17025 traceability for chromatography supplier consumables stops at the supplier’s front door. The certificate was real. The accreditation scope behind it covered the glass composition test. The crimp seal that actually failed was never in scope.

The accreditation itself is not the problem. ISO/IEC 17025:2017 is a well-built standard, and most suppliers of columns, vials, septa, and tubing hold some form of it. The problem is what falls inside the scope and what falls outside, and how that gap gets papered over with a certificate that looks authoritative. If you are buying consumables and you need traceability that holds up in a method audit or a data integrity review, you need to know where the chain breaks. In my experience it breaks in the same place almost every time.

The traceability chain for a consumable has six links, and most certificates cover three

An unbroken chain for a chromatography consumable runs from a reference standard or reference material down to the physical part in your autosampler tray. For a septum, a vial, or a column, the chain has these links:

Link 1: the reference. A certified reference material (CRM) or a calibrated artifact traceable to a national metrology institute (NIST, PTB, NPL). For dimensional checks this is a gauge block or a calibrated pin set. For chemical checks it is a CRM with a stated uncertainty.
Link 2: the measuring instrument. The caliper, micrometer, force gauge, or balance used to measure the product, with its own calibration certificate traceable to Link 1.
Link 3: the measurement. The actual test performed on the production lot, with the result, the method, and the uncertainty.
Link 4: the lot identity. A lot or batch number that ties the measured sample to the physical units shipped to you.
Link 5: the chain of custody. Records that show the lot was not substituted, mixed, or re-labeled between manufacture and your dock.
Link 6: the receiving verification. Your own incoming test, traceable through your own calibrated instruments, confirming the lot meets the specification you bought against.

Most supplier certificates cover Links 1 through 3 for a subset of attributes. They cover Link 4 loosely. Links 5 and 6 are where labs get caught, and Link 5 is the one almost nobody can produce on demand.

What “accredited” actually scopes

An ISO 17025 certificate from a supplier’s testing lab lists a scope. That scope is a fixed list of tests the accreditation body has assessed. A vial manufacturer might be accredited for glass hydrolytic resistance per USP <660> and for dimensional tolerances on body OD and height. It is almost never accredited for the crimp seal integrity of the finished, assembled closure, because that test is done on a sample of the assembled product and the assembly is a separate process. When you ask for “the ISO 17025 certificate,” you get the scope for the glass, and you assume it covers the seal. It does not.

So the first question to ask any chromatography supplier is not “are you ISO 17025 accredited?” It is “send me the scope schedule, and tell me which line items on your CoA are inside that scope and which are outside.” A supplier who cannot answer that in writing is telling you something useful.

The link most labs cannot produce is the one that ties the certificate to the box in their hand

Here is the failure I see repeatedly. A lab receives a CoA with a lot number. The lot number on the CoA matches the lot number on the carton. Everyone signs off. Six months later, during an audit or an OOS investigation, someone asks: “Show me that the units in this particular box came from the lot that was tested.” The lab cannot. Neither, often, can the supplier, because the supplier’s own records tie the CoA to a production batch, not to the individual inner pack, and the inner packs were filled from a hopper that drew from more than one batch during a changeover.

This is Link 5, chain of custody at the unit level, and it is the weakest link for a commodity consumable. For a column it is usually solid because columns are serialized. For a vial, septum, or cap it is usually not, because those parts are sold by the thousand and nobody serializes a vial.

What a defensible lot-to-unit trail looks like

A supplier that has actually thought about this will give you:

A lot number that is unique to a single production run, not a date code shared across a week of output.
A manufacturing date and a shelf-life or retest date printed on the inner pack, not just the carton.
A pack-to-lot mapping in the shipping documentation, so pack 14 of 40 is traceable to lot X and not “lot X or Y.”
For anything with a surface treatment (silanized glass, PTFE-lined caps), a treatment batch record because the treatment is where performance drifts and it is a separate process from molding.

If you cannot get the pack-to-lot mapping, you can still build Link 5 on your own side by quarantining each incoming pack, assigning it an internal sub-lot, and testing a sample from each pack rather than from the carton. That costs you a few vials and a few minutes per pack. It is the difference between a traceable consumable and an anonymous one.

Reading a CoA for traceability, not for reassurance

Every line on a CoA is one of three things: a measured value with an instrument behind it, a derived value calculated from a specification, or a statement of conformance with nothing behind it. Only the first kind carries traceability. The second kind is arithmetic. The third kind is a promise.

Take a septum CoA that lists “puncture resistance: passes.” That is a statement of conformance. It tells you nothing about the force gauge, the needle geometry, the puncture count, or the acceptance threshold. A traceable version of the same line reads: “Puncture force, first puncture, 20 mm/min crosshead, 0.63 mm OD needle: 4.2 N (spec 3.5 to 5.5 N), n=10, gauge serial 4471, calibrated 2024-03-11, traceable to NIST 1234.” That line you can audit. The first line you cannot.

I ask suppliers to mark up their CoA template with which lines are measured, which are derived, and which are conformance statements. The good ones do it without complaint. The ones who get defensive are telling you the whole document is closer to the third category than the first.

Uncertainty is the part that turns a number into a traceable result

A measured value without an uncertainty statement is not a traceable result under ISO 17025. It is a number. If your septum thickness is reported as 3.00 mm with no uncertainty, you do not know whether the measurement system can resolve the tolerance you care about. If the tolerance is ±0.05 mm and the measurement uncertainty is ±0.04 mm, the test is barely fit for purpose. This is the same principle the site covers in the measurement system before the certificate, applied to the supplier’s side of the transaction rather than yours.

Ask for the uncertainty budget on the critical dimensions. For a 0.10 mm bore tolerance, a supplier who cannot state the measurement uncertainty on bore diameter is not actually controlling that dimension, regardless of what the CoA says.

Two field cases where the chain broke and how we found it

Case 1: the septa that were traceable to the wrong batch

Symptom: A GC method running EPA SW-846 8260B on a headspace autosampler started showing a 6 to 9% RSD on the internal standard response across a tray, up from a historical 2 to 3%. It tracked with tray occupancy, which pointed at the consumable, but the septa were from a supplier with a clean CoA and a current ISO 17025 certificate.

The measurement that identified it: We pulled the CoA lot number and asked the supplier for the pack-to-lot mapping. It turned out the inner packs in our carton had been filled across a batch changeover, and one batch had used a different silicone cure. The CoA we had was for the first batch only. We confirmed it by measuring compression set on septa from three packs: the suspect pack ran 18% set after 30 minutes at 100 °C against 11% for the other two. Different cure, different set, different leak rate at the injection port.

The fix: We now require pack-level lot numbers and test a sample from each inner pack on receipt. The supplier moved to single-batch packing for our account. The RSD came back to 2.4%.

Case 2: the vial that failed pull-off and the certificate that never mentioned it

Symptom: The 11.4 N pull-off lot from the opening. Vials were crimped with a 20 mm aluminum seal and a butyl/PTFE septum, and about one in two hundred caps loosened enough in the autosampler to lose the seal during a 40-minute run.

The measurement that identified it: A pull-off test using a calibrated force gauge at 20 mm/min on 20 vials from the lot gave a mean of 11.4 N with a standard deviation of 1.6 N. The specification we had written into the purchase order was 15 N minimum. The CoA listed dimensional checks and glass hydrolytic resistance, both inside the supplier’s ISO 17025 scope. Pull-off force was not on the CoA and not in scope, because the seal is formed in the customer’s crimper, not at the supplier. The supplier was technically correct and practically useless.

The fix: We moved the pull-off test to incoming inspection with our own calibrated gauge and wrote the acceptance criterion into the purchase spec. We also specified the crimper setting: 1.0 mm crimp height and a cap torque equivalent measured at the seal that gave 18 to 22 N pull-off on our crimper. The vials were fine. The traceability of the seal was ours to own, and we had not owned it.

Both cases share a structure. The supplier was accredited for what the supplier controlled. The attribute that failed was controlled by a process nobody had put in scope.

Where the scope boundary sits for each consumable class

The practical question is which attributes you can rely on the supplier’s accreditation for and which you must verify yourself. The table below is the decision rule I use. It is not exhaustive, but it covers the parts that fail.

Consumable	Usually inside supplier’s ISO 17025 scope	Usually outside scope, verify yourself	Your incoming test
Glass vial body	OD, height, bore, hydrolytic resistance	Residual mold release, cosmetic defects affecting seal	Dimensional gauge check, n=10
Crimp seal / cap	Cap dimensions, septum thickness	Pull-off force after your crimp, seal integrity	Force gauge pull-off, n=20, 15 N min
Septum	Hardness, thickness, extractables screen	Compression set, puncture force, coring after n punctures	Puncture force and set, n=10
Screw cap closure	Thread dimensions, liner thickness	Torque-to-seal, leak rate after capping	Torque wrench check, leak test
Column	Retention, efficiency, asymmetry per CoA	Lot-to-lot selectivity on your method	System suitability per USP <621>
Tubing / fittings	ID, OD, material cert	Ferrule seal after installation	Leak test at operating pressure

The pattern is that the supplier’s scope covers the part as manufactured, and your scope covers the part as used. The seal, the crimp, the torque, the puncture, the installation: all of those are formed by your process, and no supplier certificate can trace them. That is not a supplier failure. It is a boundary you have to know about.

Writing the traceability requirement into the purchase order

Traceability you cannot enforce is traceability you do not have. The purchase order is where you make it enforceable. I write four clauses into every consumable PO that touches a regulated method:

Scope disclosure. The supplier must state, in writing, which CoA attributes are inside their ISO 17025 scope and which are not. This is a one-paragraph document and any serious supplier can produce it.
Pack-level lot identity. Every inner pack carries a lot number unique to a single production batch, with manufacturing and retest dates. No cross-batch packing without written notice.
Uncertainty on critical dimensions. For any dimension with a tolerance tighter than 0.10 mm, the supplier states the measurement uncertainty and the instrument calibration reference.
Change notification. Any change to resin, glass source, septum cure, or treatment process triggers a written notice and a re-qualification before shipment. This is the clause that catches the septa case before it reaches your autosampler.

For the parts where the seal is formed in your lab, the requirement belongs on your side. That means a calibrated crimper, a documented crimp setting, and a pull-off test on a defined sample size. The closure selection is only half the decision; the crimp and the test are the other half.

A receiving checklist that closes the loop

Match carton lot to CoA lot to inner-pack lot. If any of the three differ, quarantine.
Confirm the CoA attributes you depend on are inside the supplier’s stated scope. If not, they are yours to test.
Pull a sample per pack, not per carton. Ten units per pack for dimensional, twenty for force.
Run the critical test on your calibrated instrument and record the result against the PO specification.
Assign an internal sub-lot and record the test result in your own traceability record.
Release only when the internal sub-lot is linked to the supplier lot and your test result.

That checklist is the difference between a certificate on file and a chain you can defend. The analytical testing side of your operation should own steps 3 through 5, because those are the tests that carry your accreditation, not the supplier’s.

When to accept the supplier’s certificate and when to re-test

Not every consumable deserves a full receiving test. The decision rule is based on two things: whether the attribute is inside the supplier’s scope, and whether the attribute is formed by your process.

Inside scope, formed by supplier: accept the certificate. Spot-check dimensionally on a sample per lot. This is most glass and column attributes.
Inside scope, formed by your process: accept the certificate for the part, but test the assembly. This is the crimp seal and the screw cap torque.
Outside scope, formed by supplier: this is the dangerous quadrant. The attribute matters, the supplier controls it, and nobody is testing it under accreditation. Compression set and puncture force live here. Test every lot or require the supplier to bring it into scope.
Outside scope, formed by your process: your responsibility entirely. Calibrate the tool, document the setting, test the result.

Most labs over-test the first category and under-test the third. The third is where the OOS investigations come from.

The decision rule

ISO 17025 traceability for a chromatography consumable is only as strong as the link that ties the tested lot to the unit in your hand, and that link is almost never inside the supplier’s accreditation scope. So the rule is: buy against a written scope disclosure and pack-level lot identity, then own the attributes your process forms (crimp seal, torque, puncture after installation) with your own calibrated instruments and your own incoming test. If a supplier cannot tell you which CoA lines are inside their scope, treat every line as a conformance statement and test accordingly. The certificate is a starting point, not a chain.

References & further reading

Related resources from our lab consumables network:

External references and standards: