How to read a COA: your six-step check for potency and safety
The single most important thing to check on any cannabis Certificate of Analysis is whether the tested material’s identity and lot number match what is physically in front of you. Everything else on the page, from potency to pesticide screens, is meaningless if the report belongs to a different batch.
Before you read another line of numbers, run through six checks:
Identity and lot match — the batch or sample ID on the COA matches the number printed on your product label
Lab accreditation — the testing lab states ISO/IEC 17025 accreditation and names the scope it covers
Cannabinoid potency — THCa, Δ9-THC, total THC, and CBD are listed with clear units
Safety panels — pesticides, heavy metals, residual solvents, and microbial results appear with pass/fail markers
Dates — the analysis date follows the production date, not the other way around
Signatures — an analyst or QA reviewer has signed off on the report
Skipping any one of these six checks is how consumers end up misjudging their dose, or worse, using a product contaminated with something a label never mentioned.
Key Takeaways
Verifying a cannabis COA protects both your health and your wallet, and it takes less time than reading a product review.
Point | Details |
Match the lot number first | Confirm the COA’s batch ID matches your product label before trusting any other result. |
Check accreditation scope | ISO/IEC 17025 accreditation is test-specific, so confirm the scope covers the results shown. |
Calculate total THC correctly | Use Total THC = (THCa × 0.877) + Δ9-THC, not the THCa number alone. |
Treat ND as a floor, not zero | ND or <LOD means the method’s detection limit was reached, not that nothing is present. |
Escalate on safety failures | A positive pathogen result or a metal above limit means stop use and contact the seller immediately. |
Table of Contents
How to read a COA: what it is and where brands publish it
A Certificate of Analysis is a batch-specific laboratory report confirming what is actually in a product, tested against the specific lot it accompanies, not a general claim about the product line. A COA issued for lot 4471 tells you nothing reliable about lot 4472, even if both came off the same production run days apart.
Brands typically publish COAs in one of four places:
On the product page itself, usually as a downloadable PDF
Behind a QR code printed on the packaging, which links directly to the lab’s portal
On a searchable lab portal where you enter a batch number
On request, if a seller emails or mails a copy when asked directly
Not every COA carries equal weight. A manufacturer’s in-house COA tells you the company tested its own product, which is useful but self-reported. A third-party COA, from an independent laboratory with no financial stake in the outcome, adds a layer of scrutiny the manufacturer’s own lab can’t provide. If a brand only offers an in-house report and resists requests for third-party verification, treat that as worth following up on rather than an automatic red flag.
It’s also worth knowing that a COA is not interchangeable with a Safety Data Sheet or Technical Data Sheet. An SDS covers handling and hazard information; a TDS describes typical, non-batch-specific performance. Only the COA proves what was found in the exact batch you’re holding.
Anatomy of a COA: the header fields that prove it’s credible
The header is where a COA either earns your trust or falls apart. Before you look at a single potency number, confirm the document actually ties back to your product.
A credible header includes:
Laboratory name, address, and contact information
An accreditation statement, ideally naming ISO/IEC 17025 and its scope
A unique report ID
The sample or lot number, matching the physical package
Production or packaging date
Analysis date
An analyst or quality assurance signature
Cross-referencing the lot number against your container label is a step worth doing every single time, because a COA that doesn’t match the batch in your hand offers zero assurance about that batch, regardless of how clean the rest of the report looks. Chain-of-custody identifiers, the sample ID trail from collection to testing, exist precisely so a lab can prove which physical sample generated which results.
Dates matter more than most readers expect. The analysis date should always fall after the production date. If a COA shows testing completed before the product was packaged, or an analysis date that’s suspiciously close to your purchase date months after the stated production run, something doesn’t add up.
Pro Tip: If a signature block looks like boilerplate text with no name, title, or date attached, or if the lab’s contact information leads nowhere when you search it, don’t assume it’s a formatting quirk. Contact the seller and ask for a version with a verifiable analyst signature before you rely on the rest of the report.
Understanding potency: cannabinoids, units, and calculating your dose
Reading potency correctly starts with knowing what each entry actually measures. THCa is the acidic, non-intoxicating precursor found in raw plant material. Δ9-THC is the active compound formed when THCa loses a carboxyl group through heat, a process called decarboxylation. Total THC accounts for both, using the formula: Total THC = (THCa × 0.877) + Δ9-THC. The 0.877 factor corrects for the mass lost as CO2 during conversion.
Units trip up more consumers than any other part of a COA. Flower is usually reported as a percentage by weight. Concentrates and infused products often switch to mg/g or mg per serving. Here’s how those numbers relate:
Reported Value | Conversion | Practical Meaning |
1% cannabinoid | 10 mg/g | 1 gram of flower contains 10 mg of that cannabinoid |
20% Total THC | 204 mg/g | A common upper-range flower potency |
5 mg/serving | 5 mg per unit | Standard edible dosing unit, independent of weight |
0.5% | 5 mg/g | Useful for minor cannabinoids like CBG or CBN |
Two worked examples show how this plays out in practice:
Flower: a COA lists THCa at 22.4% and Δ9-THC at 0.8%. Total THC = (22.4 × 0.877) + 0.8 = 19.6 + 0.8 = 20.4%, or 204 mg per gram of flower.
Edible: a COA lists total THC at 5 mg per serving, with the package specifying ten servings per unit. That’s 50 mg total in the package, so cutting a single serving in half yields roughly 2.5 mg, a reasonable starting point for anyone new to edibles.
Assay results also carry measurement uncertainty, typically expressed as a plus-or-minus range around the reported value. A result sitting right at a labelled specification’s edge, rather than comfortably within it, deserves more caution than one with margin to spare. Cannabinoids also degrade over time, particularly Δ9-THC converting to CBN, so a COA run at packaging may overstate potency by the time you actually consume the product weeks later.
Pro Tip: When planning a dose from COA numbers, build in a margin rather than dosing to the exact milligram. Potency naturally drifts downward with storage time, and assay uncertainty means the true value could sit slightly above or below what’s printed.
What the terpene profile and other panels reveal
Terpenes are the aromatic compounds behind a product’s smell and flavour, and they’re increasingly tied to how a strain’s effects are described. Myrcene tends to dominate in relaxation-associated strains, limonene shows up in citrusy, mood-lifting profiles, and pinene is linked to alertness and pine-forward aromas. A COA listing terpenes above roughly 1% total is generally considered aromatically potent; totals under 0.5% often signal a milder, less distinct profile.
Terpene results are usually reported in mg/g or as a percentage, mirroring how cannabinoids are expressed. Beyond terpenes, some COAs include flavonoid panels or, for concentrates specifically, residual solvent screens covering extraction chemicals like butane or ethanol. Flavonoid data matters less for most purchasing decisions, but residual solvents in a concentrate absolutely warrant a look before use.
Reading safety and purity panels without missing a problem
Safety panels are where a COA earns its keep, and they’re also where reading errors carry the highest cost. Five categories show up on virtually every complete report: pesticides (screened by class), heavy metals (lead, arsenic, cadmium, mercury), residual solvents, microbial counts (including yeast, mould, and pathogens like Salmonella or E. coli), and mycotoxins such as aflatoxins.
Units vary by panel. Pesticides and solvents are typically reported in ppm or ppb; heavy metals often appear in µg/g; microbial results use CFU/g (colony-forming units per gram). Two abbreviations you’ll see constantly are ND (not detected) and <LOD (below the limit of detection), meaning the lab’s equipment couldn’t reliably measure anything below that threshold, not that zero contamination is guaranteed.
A typical safety panel layout looks like this:
Panel | Typical Unit | What “Pass” Looks Like |
Heavy metals (lead, arsenic, cadmium, mercury) | µg/g | Below the published action limit for each metal |
Residual solvents | ppm | ND or below the specified threshold per solvent |
Microbial count (yeast, mould, pathogens) | CFU/g | Below the limit; pathogens like Salmonella must read ND |
Mycotoxins (aflatoxins) | ppb | Below the regulatory action level |
Peer-reviewed research on cannabis and hemp products has repeatedly documented contamination risks and potency variability, which is exactly why these panels exist rather than being a formality.
Some results should stop you cold. A positive detection for Salmonella or E. coli, any heavy metal reading above its published limit, or residual solvents exceeding threshold are not “proceed with caution” situations. They’re reasons to contact the seller immediately and avoid using the product until you get clarity.
Analytical methods and the trust signals worth checking
The method a lab names, HPLC (High-Performance Liquid Chromatography), GC (Gas Chromatography), ICP-MS (Inductively Coupled Plasma Mass Spectrometry), or LC-MS/MS, tells you how the numbers were generated and whether they’re comparable to another lab’s results run on different equipment. A COA that never names its method is harder to trust simply because you can’t check it.
LOD and LOQ are two terms every reader should recognize. The limit of detection is the lowest amount a method can reliably detect; the limit of quantitation is the lowest amount it can measure with confidence, not just spot. A result below LOD isn’t proof of zero, only that the equipment’s floor was reached.
ISO/IEC 17025 accreditation is the standard to look for, but accreditation is often test-specific. A lab accredited for microbial testing isn’t automatically accredited for heavy metals, so checking the scope listed alongside the accreditation claim matters more than seeing the ISO logo alone.
Practical trust signals to scan for:
The analytical method is named, not just implied
LOD and LOQ values appear next to each result
Accreditation body and scope are stated explicitly
An analyst or reviewer signature is present
The lab’s contact information is real and searchable
Pro Tip: If a COA claims ISO 17025 accreditation, search the accrediting body’s public registry directly rather than taking the logo at face value. If you can’t find the lab listed for the specific test in question, email the lab and ask them to confirm scope in writing.
How to verify a COA and spot red flags
Verification takes about five minutes once you know the sequence: match the lot number, confirm the accreditation and its scope, check that the method and LOD/LOQ are listed, verify the analyst signature, cross-check the dates, and, where available, ask for the raw chromatogram data behind the summary numbers.
Twelve red flags suggest a COA deserves closer scrutiny, in rough order of severity:
No lot or batch number at all
Positive pathogen result with no follow-up explanation
Heavy metal or solvent values above published limits
Missing analyst or QA signature
Analysis date that predates the production date
No testing method named anywhere
LOD/LOQ values absent from every result
All results reported as suspiciously round numbers
Inconsistent units between sections of the same report
Identical results across multiple, supposedly different batches
No third-party report available when one is requested
Lab contact information that can’t be verified independently
If you spot flags one through five, stop using the product and contact the seller immediately. Flags six through twelve warrant a follow-up email requesting clarification, raw data, or a retest through an accredited third-party lab before you write the product off entirely.
Annotated example: walking through a sample flower COA
Picture a COA for a flower product, lot number FL-2291. The header lists the testing lab, ISO/IEC 17025 accreditation scoped to cannabinoid potency and microbial testing, a production date of January 8, and an analysis date of January 19, both signed by a named QA reviewer. The lot number matches the jar label exactly, so the identity check passes before you even reach the numbers.
Running the conversion: Total THC = (21.6 × 0.877) + 0.6 = 18.9 + 0.6 = 19.5%, or roughly 195 mg per gram. For a standard 0.5-gram portion, that works out to about 97.5 mg of total THC, useful context if you’re planning how much to use in a single session.
The safety panel shows all pesticide classes as ND, heavy metals well under their limits, and a microbial count comfortably below threshold. Every safety line reads pass, with numeric values printed alongside the pass marker rather than just the word “pass” on its own.
Two subtle issues are worth flagging anyway. First, the terpene panel lists a total of 1.8% but never breaks down individual terpenes, an oddly vague presentation for an otherwise detailed report. Second, the LOQ for pesticides isn’t stated anywhere, meaning ND could reflect genuinely undetectable levels or simply a testing method with a high quantitation floor. Neither issue invalidates the COA, but both are worth a follow-up question to the lab before treating the report as airtight.
Why I check every COA before I trust the label
I check the lot number first, every time, because I’ve seen how easily a sharp-looking report can belong to the wrong batch. That habit matters more than any single test result on the page, since a mismatched COA tells you nothing about what you’re actually about to use.
If a lab won’t confirm accreditation scope or a seller stalls on providing a third-party report, that’s your cue to escalate, whether that means contacting the lab directly or flagging it to your local consumer protection office.
Sources
For deeper technical grounding, the ISO/IEC 17025 standard explains what testing lab accreditation actually requires, while the NIST glossary defines LOD and LOQ precisely. Canada’s accreditation guidance from Innovation, Science and Economic Development Canada clarifies why accreditation scope needs checking, not just the presence of a logo. For evidence on why label accuracy matters, the Penn study on mislabelled cannabidiol extracts remains a useful reference, alongside a practical step-by-step COA reading guide. When in doubt, ask the lab for raw chromatogram data rather than relying on summary numbers alone.
Readers working with reference-grade materials for lab protocols, rather than consumer cannabis products, can find analytical detail specific to alkaloid identity testing in 7ohyea’s guide to laboratory detection methods for 7-hydroxymitragynine, including how method selection affects result comparability. For teams sourcing 83% pure 7OH powder for analytical protocols, applying the same identity-first, accreditation-scoped reading habits covered here to any accompanying COA is the fastest way to confirm a batch is what it claims to be before it enters a study.
This article is general information, not a substitute for advice from a qualified doctor. Consult a qualified healthcare professional about your own circumstances before acting on anything here.
FAQ
How do I read a COA for peptides or research compounds?
The same core checks apply: confirm the lot number matches your sample, verify the lab’s accreditation scope covers the specific assay reported, and check that purity is listed with a method name and LOD/LOQ values rather than just a bare percentage.
What does a COA tell you?
A COA confirms what a specific, tested batch actually contains, covering identity, potency, and safety screens like heavy metals, pesticides, and microbial contamination, rather than making a general claim about an entire product line.
What does the COA number mean?
The COA number, sometimes called a report ID or batch number, is a unique identifier linking that specific report to the exact lot or sample it tested, which is why matching it against your product label is a mandatory first step.
What does COA mean in quality?
In quality assurance, a COA is the documented proof that a batch was tested against defined specifications, serving as the paper trail that confirms a product meets its stated identity, potency, and safety standards before it reaches a buyer.
Recommended
Comments