How to Read a Cannabis COA (Certificate of Analysis)

Walk into any dispensary or browse any online hemp shop and you’ll see bold numbers on every label: 28% THCA, 3.1% terpenes, “lab tested.” But those numbers are only as trustworthy as the lab report behind them — the Certificate of Analysis, or COA.

A COA is the single most important document a cannabis product can have. It’s the independent lab report that tells you what’s actually in the jar: how potent it is, what it smells like on a chemical level, and — most importantly — whether it’s clean. Yet most buyers have never actually read one.

This guide will change that. By the end, you’ll be able to open any COA, read every section with confidence, match it to the product in your hand, and spot a fake or inflated report in under a minute.

What Is a Cannabis COA?

A Certificate of Analysis is a report issued by an independent, accredited laboratory after testing a sample from a specific production batch. It documents:

• Potency — the measured levels of THCA, THC, CBD, and other cannabinoids
• Terpene content — the aromatic compounds that shape flavor and character
• Safety results — screening for pesticides, heavy metals, residual solvents, mold, bacteria, and mycotoxins
• Traceability — the batch number, test dates, and lab credentials tying the report to your exact product

Legitimate brands publish COAs for every batch and make them easy to find — usually linked on the product page or accessible by scanning a QR code on the packaging. If a brand won’t show you a COA, treat that as your answer.

Why the COA Matters More Than the Label

Labels are marketing. COAs are measurement. That distinction matters because potency inflation is one of the cannabis industry’s worst-kept secrets.

Because shoppers gravitate toward the highest THC number, some brands engage in “lab shopping” — sending samples to whichever lab returns the most flattering numbers, or cherry-picking results. A jar labeled 33% THC might deliver a noticeably weaker experience than a honestly-labeled 24% jar from a rigorous lab.

The COA is your defense. It shows you measured values from a specific batch, tested on a specific date, by a lab whose name and accreditation are printed right on the page. When the label and the COA disagree, trust the COA — and consider buying from a different brand.

The 6 Sections of a COA, Explained

Every full-panel COA follows roughly the same structure. Here’s how to read each part.

1. Sample and Lab Information

The header of the COA is its ID card. Check for:

• Product name and type — strain name, and whether it’s flower, a vape, an edible, or a concentrate
• Batch or lot number — the unique identifier for the production run that was tested. This is the single most important line on the page (more on matching it below)
• Sample received and test dates — when the lab got the sample and when analysis was completed. Recent dates (within the last 6–12 months) indicate fresh, relevant testing
• Lab name, license, and accreditation — a legitimate COA names the lab and shows its credentials. Look for ISO/IEC 17025 accreditation, the international standard for testing laboratories. The lab should be independent — not owned by the brand selling the product
• Testing methodology — you’ll often see HPLC (high-performance liquid chromatography) for cannabinoid potency, and GC-MS for terpenes and residual solvents. These are standard, reliable methods

2. Cannabinoid Profile (Potency)

This is the section most people jump to. It lists each detected cannabinoid, usually as a percentage (%) and sometimes as milligrams per gram (mg/g). Quick conversion to remember: 1% = 10 mg/g.

Typical entries include:

• THCA — the raw, non-intoxicating precursor found in fresh flower. This is the big number on THCA flower (often 15–30% in quality products)
• Delta-9 THC — the already-active THC. For federally compliant hemp products, this must be below 0.3% by dry weight
• Total THC — the estimated maximum THC after heating (see the formula below)
• CBD, CBDA, CBG, CBGA, CBN, CBC — minor cannabinoids that round out the profile. Their presence in meaningful amounts often signals a fuller, better-cured product
• Total cannabinoids — the sum of everything detected

The Total THC formula. COAs list THCA and THC separately because they’re different compounds — until heat is applied. When you smoke or vape, THCA converts to THC (decarboxylation), losing some molecular weight in the process. Labs estimate the maximum potential THC with this standard formula:

Total THC = (THCA × 0.877) + THC

Example: flower testing at 25.0% THCA and 0.2% THC has a total THC of (25.0 × 0.877) + 0.2 = 22.1%. If a product’s marketing claims a number much higher than what this formula gives from its own COA, that’s a red flag.

3. Terpene Profile

Terpenes are the aromatic compounds behind cannabis’s smell and flavor — citrus, pine, gas, berry. A good COA lists individual terpenes with their percentages and a total terpene figure. A total above 2% generally indicates a rich, aromatic profile; below 1% often means older, poorly stored, or heavily processed product.

Common terpenes you’ll see:

• Myrcene — earthy, musky; the most common terpene in cannabis
• Limonene — citrus; bright and uplifting aroma
• Caryophyllene — peppery, spicy; unique among terpenes for interacting with cannabinoid receptors
• Pinene — pine; sharp and clear
• Linalool — floral, lavender-like

Why bother reading this section? Because terpenes explain why two strains with identical THC levels can feel completely different. Shoppers who learn their preferred terpene profiles buy more consistently satisfying products than shoppers who chase THC percentage alone. Missing terpene data isn’t automatically a dealbreaker — some isolates and distillates legitimately have none — but for premium flower, a blank terpene section is a yellow flag.

4. Pesticide Screening

This is where COAs earn their keep on safety. Cannabis is an effective bioaccumulator — it readily absorbs chemicals from soil and water — so pesticide screening is essential, especially for products you inhale.

Strict states like California screen for 60+ pesticide compounds, each with a defined action level measured in micrograms per gram (µg/g). Results are typically reported per compound as “ND” (not detected), a measured value, or PASS/FAIL against the limit. A clean panel shows ND or PASS across the board.

Pay special attention to infamous offenders like myclobutanil (a fungicide that can convert to hydrogen cyanide when heated) and chlorpyrifos. Any detection above the action level means the batch fails — it legally cannot be sold in a regulated market.

5. Heavy Metals

Lead, arsenic, cadmium, and mercury can all end up in cannabis through contaminated soil, water, or fertilizers. Because these metals accumulate in the body over time, even small amounts matter — and inhaling them is worse than ingesting them, so limits are stricter for smokable products.

California’s action levels for inhalable cannabis products, for reference:

On the COA, each metal should read PASS or show a result below the action level. Any FAIL here is an instant dealbreaker — heavy metal contamination is not something a “good deal” justifies.

6. Microbials, Mycotoxins, and Other Safety Tests

The final safety section covers the living (and once-living) contaminants:

• Microbial impurities — screening for harmful bacteria and fungi. California requires inhalable cannabis to be free of Aspergillus species (fumigatus, flavus, niger, terreus) and Salmonella. Aspergillus spores can cause serious lung infections when inhaled, which is why this test is non-negotiable for flower and vapes
• Mycotoxins — toxic compounds produced by mold, notably aflatoxins (B1, B2, G1, G2) and ochratoxin A. These survive heating, so “I’ll just smoke it” doesn’t neutralize them. California caps total aflatoxins at 20 micrograms per kilogram
• Residual solvents — relevant for extracts, concentrates, and vape oils. Tests for leftover butane, propane, ethanol, and similar processing chemicals. Not typically run on raw flower
• Foreign matter — visual inspection for hair, dirt, insects, or debris
• Moisture content and water activity — flower should sit around 10–15% moisture with water activity at or below 0.65. Too wet invites mold; too dry means harsh, degraded product

A full-panel COA passes every one of these categories. A COA that shows potency only — no safety testing at all — tells you the brand is cutting corners on the part that protects your health.

Matching the COA to Your Product: Batch Numbers and QR Codes

A perfect COA is worthless if it doesn’t belong to the product in your hand. Here’s the 30-second verification:

1. Find the batch or lot number on your packaging. It’s usually printed near the manufacturing or expiration date.
2. Find the batch number on the COA. It should match exactly — same characters, same format.
3. Check the test date. It should predate your purchase and ideally fall within the last year. A COA from three years ago for a “fresh drop” is meaningless.
4. Scan the QR code if there is one. Reputable brands print a QR code on the package linking directly to the batch-specific COA. If the QR code leads to a generic page, a dead link, or a different batch’s report, walk away.

This is also why buying the same strain twice can mean buying two different COAs — every harvest batch is tested separately. Good brands update their published COAs with each new batch.

7 Red Flags That Mean “Put It Back”

1. No COA available at all. The brand won’t share lab results, or the “lab results” page is empty. This is the biggest red flag there is.
2. Potency-only testing. The COA shows cannabinoids but no pesticide, heavy metal, or microbial data. Safety testing is not optional.
3. THC above 35%. Flower testing above 35% total THC is extraordinarily rare. Sky-high numbers usually signal lab shopping or outright fabrication.
4. Label doesn’t match the COA. The package claims 29% but the COA says 21%. Trust the lab report — and question the brand.
5. Missing lab identity or accreditation. No lab name, no license number, no ISO 17025 accreditation — or a lab owned by the brand itself.
6. Stale or mismatched batch data. The batch number doesn’t match your package, the test date is years old, or the same COA is recycled across “new” drops.
7. Sloppy or inconsistent document. Typos in strain names, mismatched units, numbers that don’t add up (total THC wildly off from the 0.877 formula), or a report that looks edited in Photoshop. Real COAs come straight from lab software and look like it.

Quick COA Checklist Before You Buy

• ☐ COA is published and easy to find (product page or QR code)
• ☐ Batch number on the COA matches your packaging exactly
• ☐ Test date is recent (within ~12 months)
• ☐ Lab is named, licensed, ISO/IEC 17025 accredited, and independent
• ☐ Total THC checks out via (THCA × 0.877) + THC
• ☐ Terpene profile is listed (for flower and full-spectrum products)
• ☐ Pesticides: ND or PASS on every compound
• ☐ Heavy metals: PASS on lead, arsenic, cadmium, mercury
• ☐ Microbials and mycotoxins: PASS, no Aspergillus or Salmonella
• ☐ Nothing failed, nothing is missing, numbers look realistic

Frequently Asked Questions

What does “ND” mean on a COA?

ND stands for “not detected.” It means the lab’s instruments found none of that compound down to their limit of detection. It’s the result you want to see in every contaminant section — pesticides, heavy metals, microbials, and mycotoxins should all read ND or PASS.

What’s the difference between THCA, THC, and Total THC on a lab report?

THCA is the raw compound present in fresh flower; THC is the already-active form. Total THC estimates the maximum THC you’d get after heating, calculated as (THCA × 0.877) + THC. The 0.877 factor accounts for weight lost when THCA converts to THC during decarboxylation.

Can I trust a COA from the brand’s own website?

Yes — as long as the testing lab is independent and accredited (look for ISO/IEC 17025). The lab’s name, license number, and contact details should be printed on the report. Be skeptical if the “lab” is owned by or shares an address with the brand.

How recent should a COA be?

Ideally within the last 6–12 months, and it must correspond to the batch you’re buying — match the batch number on your packaging to the one on the report. Cannabis degrades and batches change; a three-year-old COA tells you nothing about today’s jar.

Do edibles and vapes need COAs too?

Absolutely — arguably more so. Vape oils and concentrates should additionally show residual solvent testing (leftover butane, propane, or ethanol from extraction), and edibles should show per-serving cannabinoid content so dosing is verifiable. Any product you inhale or ingest deserves a full-panel COA.

What should I do if a brand refuses to share a COA?

Don’t buy it. In regulated markets, testing is legally required and COAs are standard practice. A brand that hides its lab results is telling you everything you need to know — spend your money with a company that’s proud of its testing.

Disclaimer: This article is for educational purposes only and is not medical advice. Cannabis laws vary by state and locality — always check your local regulations, and consult a qualified professional with health questions.

Once you know how to read a COA, you’ll never shop for cannabis the same way again. The label tells you what the brand wants you to believe; the COA tells you what the lab actually measured. Bookmark this guide, pull up the COA on your next purchase, and run the checklist — it takes two minutes, and it’s the simplest quality upgrade a cannabis buyer can make.