How to Read a Cannabis Certificate of Analysis (COA)

A plain-English guide to what's on a cannabis lab report, what actually matters, and how to tell a legitimate COA from a sketchy one.

What is a Certificate of Analysis?

A Certificate of Analysis — or COA — is a lab-issued document that reports the test results for a specific batch of cannabis or hemp product. Licensed cannabis products in regulated US and Canadian markets are required to ship with a COA that covers potency and contaminant screening. The COA is the receipt that says: "this batch was tested, here's what was in it, and here's what wasn't."

The header — sample and batch info

The top of any COA should identify five things:

  • Lab name and license — the accredited lab that ran the tests.
  • Sample ID — a unique ID for this specific tested sample.
  • Batch / lot number — links the COA back to the product on the shelf.
  • Client / producer — the cultivator, brand, or distributor who submitted the sample.
  • Collection and report dates — when the sample was pulled and when results were finalized.

If the batch number on the product label doesn't match the batch number on the COA, the COA doesn't apply to what you're holding.

Cannabinoid potency

The potency panel lists cannabinoids as a percentage by weight (flower) or as mg per unit (edibles, tinctures, concentrates). Watch for:

  • Total THC — usually calculated as THCa × 0.877 + Δ9-THC. That formula accounts for the mass THCa loses when it decarboxylates into THC.
  • Total CBD — same math: CBDa × 0.877 + CBD.
  • Minor cannabinoids — CBG, CBN, CBC, THCV. Small percentages, but they shape the effect profile.
  • LOQ / LOD — Limit of Quantitation and Limit of Detection. Anything below the LOQ is reported as "< LOQ" or "ND" (not detected), not as zero.

Terpenes

Not every COA includes terpene testing — it's often optional. When present, terpenes are reported as a percentage. The dominant terpene (myrcene, limonene, caryophyllene, pinene, linalool, etc.) is a better predictor of the experience than raw THC number.

Contaminant panels — the "PASS" columns

These are the panels that actually protect the consumer:

  • Pesticides — 60+ compounds screened against state action limits.
  • Heavy metals — arsenic, cadmium, lead, mercury.
  • Microbials — total yeast & mold, Aspergillus, Salmonella, Shiga-toxin E. coli.
  • Mycotoxins — aflatoxins and ochratoxin A.
  • Residual solvents — mostly relevant to extracts (butane, propane, ethanol, etc.).
  • Foreign matter — hair, insects, mammalian excreta.
  • Water activity & moisture — moisture content and Aw, which predict mold risk.

Each row should say PASS or list the measured value against the state's action level. A single FAIL means the batch shouldn't be on the shelf.

How to verify a COA is legitimate

  1. The lab is ISO/IEC 17025 accredited and licensed in the product's state.
  2. The QR code on the label leads to the lab's own domain — not the brand's.
  3. The sample and batch IDs on the COA match the label.
  4. Collection date is recent — old COAs (12+ months) on flower are a red flag.
  5. The document has a lab signature or digital seal.

Redacting a COA before you share it

If you're a dispensary, brand, or distributor sharing COAs with retail buyers, you usually want to hide the source lab, cultivator, and distributor blocks — while keeping the test results fully intact and verifiable.

That's exactly what BatchCOA does. Drop up to 50 COA PDFs into the browser, optionally swap the QR code, add a watermark, and download a ZIP of redacted, metadata-stripped, image-flattened PDFs. Nothing leaves your device.

Open the batch COA redactor