Hi,
There are actually several related documents you may want to think about. There is the Certificate of Conformance ( also the Certificate of Compliance, COC) you mentioned, the Certificate of Analysis (COA), and there may be others.
Although the specifications and expectations for the product may very well be contained elsewhere, such as a purchase order or contract, these "COx" documents put the specifications and the actual attributes together and serve as a way to ensure compliance, in theory. The way our system is set up, if a lot number is used to generate a COA, and there is a parameter that is found (by the software) to be out of compliance, the COA will process no further.
Hope this helps.