A Certificate of Analysis, or COA, is the single most important document in the hemp and cannabis industry. It is the lab report that tells you what is actually inside the bottle. Reputable brands publish a COA for every batch they make. Disreputable brands hide them, fake them, or use a single old report for years. Learning to read a COA is the most important skill a hemp consumer can develop.
What a COA Is
A Certificate of Analysis is a document produced by a third party laboratory that tests a specific batch of a hemp or cannabis product. It usually includes the cannabinoid profile, contaminant testing, and a header section identifying the lab and the product.
Two important rules. First, the COA must come from a third party lab, not the manufacturer's own facility. Second, it must be batch-specific. A COA for batch number 22A-001 does not tell you anything reliable about batch 23B-014.
No COA, No Sale
The single most important rule in hemp shopping is simple. If a product does not have a recent, batch-specific COA from a third party lab, do not buy it.
The Header: Identifying the Lab
A trustworthy COA starts with information about the lab itself. Look for:
- Lab name and contact information. A real address, phone number, and website.
- Accreditation. ISO 17025 accreditation is the gold standard for analytical labs. The COA should cite the accrediting body and the scope of accreditation.
- Lab signature or certification. A real lab director's name, often with a signature or initials.
- Date of testing. Recent dates, ideally within the last six to twelve months for a product currently on shelf.
- Sample information. Sample ID, batch or lot number, the product name, and how the sample was received.
A red flag is a COA without a lab name, without contact information, or with a generic header that could apply to any product. Some bad actors fabricate COAs in image editors. Reputable labs publish their COAs to a public portal where you can look up reports by batch number.
The Cannabinoid Profile
The cannabinoid profile is the heart of the COA for hemp products. It lists each cannabinoid the lab tested for, along with the concentration in milligrams per gram, milligrams per unit, or percentage by weight.
What to Look For
Compare the labeled cannabinoid content on the package with the COA. A 30 mL tincture labeled as 1500 mg CBD should have a COA showing roughly 50 mg CBD per mL (or 1500 mg per 30 mL). If the COA shows a meaningfully lower number, the product is underdosed.
Watch for the term LOQ, which stands for limit of quantification. A reading below LOQ means the lab could not measure it accurately, usually because the concentration is too low. ND means non-detected, below the limit of detection.
Pay attention to total Delta-9 THC. For hemp products in the United States, this number must be below 0.3 percent by dry weight. For most consumer products that means a tiny number per gram of finished product. Some COAs also report total THC, which is Delta-9 THC plus 87.7 percent of THCA, the realistic post-decarb value.
For full spectrum products, look for the broader cannabinoid panel including CBD, CBDA, CBG, CBN, CBC, and the various THC isomers. A real full spectrum extract will have several measurable minor cannabinoids. A product labeled full spectrum that only shows CBD and trace THC is closer to broad spectrum or isolate.
Reading Terpenes
Some COAs include a terpene profile. This is a strong positive signal of a quality brand. Look for measurable amounts of myrcene, limonene, pinene, linalool, caryophyllene, humulene, and terpinolene. The terpene profile should match the product's claimed strain or formulation character.
Contaminant Testing
The contaminant section of a COA is what protects you from bad product. Hemp is a bioaccumulator, meaning it pulls heavy metals, pesticides, and other contaminants out of the soil it grows in. Without proper testing, those contaminants end up in your tincture or vape.
Pesticides
Look for a pesticide panel that tests for at least 60 to 100 different pesticides. Each pesticide should have a Pass result and an action limit (the maximum allowed concentration). If any pesticide fails, the product should not be on the shelf. Glyphosate is sometimes tested separately, since it requires a different analytical method.
Heavy Metals
The standard heavy metal panel tests for arsenic, cadmium, lead, and mercury. All four should be below the action limits set by the testing jurisdiction (often based on US Pharmacopeia limits for inhalation or oral consumption). Vape products usually have stricter heavy metal limits because inhalation increases exposure risk.
Microbials
Microbial testing screens for bacteria, mold, yeast, and harmful pathogens. The standard panel tests for E. coli, Salmonella, Aspergillus species (which can produce dangerous mycotoxins), and total yeast and mold counts. A clean COA shows Pass or Below Limit for every line.
Mycotoxins
Some COAs include mycotoxin testing, which looks for aflatoxins and ochratoxin A produced by molds. This is especially important for flower and concentrates.
Residual Solvents
For extracts made with solvents like ethanol, butane, propane, or CO2, the COA should test for residual solvent levels. Class 1 solvents (benzene, butadiene, and others) should be below detection. Class 2 and Class 3 solvents have specific action limits. CO2-extracted products typically have very clean residual solvent profiles.
Most Important for Delta-8
Delta-8 THC is synthesized from CBD using acid catalysts. Residual solvents and acid byproducts are real safety concerns. Always check the residual solvents and full cannabinoid profile (looking for unintended byproducts) on a Delta-8 COA.
Red Flags
A few warning signs that should make you walk away from a product:
- No COA. The only acceptable answer here is to buy a different product.
- Outdated COA. A two-year-old COA does not reflect a product made last month. Trustworthy brands update COAs for each new batch.
- Mismatched batch numbers. The batch on the COA must match the batch on your actual product label.
- Missing contaminant testing. A COA that shows only the cannabinoid profile and skips pesticides, heavy metals, microbials, and residual solvents is incomplete.
- Failed tests on the COA. If the COA shows a fail on any contaminant, the product should not be in your hands.
- Cannabinoid content that does not match the label. Underdosed products are surprisingly common in low-quality brands.
- No lab name or contact information. A COA without a clear, verifiable lab is essentially a piece of paper.
- Unverifiable lab. If the lab does not exist on a quick search, the COA may be fake.
How to Check a COA
Most reputable brands print a QR code or batch number on the package. Scanning or entering the batch number on the brand's website should pull up the actual COA from the lab's portal. The cleanest brands link directly to the lab's public domain (not just a PDF on the brand's own server). Cross-checking the lab portal is the best protection against fabricated COAs.
If you have any doubt about a COA's authenticity, contact the lab directly. Real labs answer email and confirm whether they tested a specific batch.
The Bottom Line
A COA is the contract between a brand and its customer. It tells you what is in the product, that the product is safe, and that the brand is willing to be held accountable. Brands who hide their COAs are usually hiding something else.
Spend two minutes reading the COA before you spend money on a hemp or cannabis product. It is the single highest-value habit a hemp consumer can build.