Lab testing in the hemp industry sits at an awkward intersection of consumer protection, marketing, and regulatory compliance. A Certificate of Analysis, or COA, is the document that connects all three. Done well, a COA is one of the most useful transparency artifacts in the consumer goods economy: an independent, batch-level record of what's actually in a product. Done poorly, it is a brochure with decimal points.
This essay is a practical guide to reading a COA. It assumes no chemistry background. It focuses on what a good report should contain, what omissions should make you skeptical, and how to tell a genuinely informative document from a dressed-up one.
What a COA should contain
A complete COA typically reports on four things: cannabinoid potency, residual pesticides, residual solvents (for extracts), and microbiological contamination. Heavy metals and mycotoxins are often included as well, depending on the state's testing regime and the lab's panel.
In addition, a COA should identify:
- The laboratory name and accreditation (ISO 17025 is the standard).
- The sample identifier, including a batch or lot number.
- The sample collection and analysis dates.
- The methodology used for each test (HPLC, LC-MS, GC-MS, etc.).
- The limit of detection (LOD) and limit of quantification (LOQ) for each analyte.
- A named, signed reviewer.
If you are looking at a document that calls itself a COA and it doesn't have those fields, you are looking at marketing material formatted to resemble a lab report.
Reading the cannabinoid panel
The cannabinoid panel is usually the first table and the one customers read most carefully. A good panel reports each cannabinoid in both its acidic and neutral form, plus a total for each class. This is important because the distinction between acidic and neutral forms is the difference between raw plant chemistry and post-heat chemistry — the two have different pharmacology.
Watch for:
- Consistency between the headline value and the underlying numbers. If the product marketing says "25% total cannabinoids" and the panel shows 18%, the marketing is wrong. This happens more often than it should.
- Explicit reporting of minor cannabinoids. A honest panel shows CBG, CBC, CBN, and others with their actual values — even when those values are below the limit of detection. A panel that only shows the big three is either using a narrow assay or hiding the minors.
- Units. Most panels report in percent (by weight) and mg per gram. Both should appear; a single-unit panel is incomplete.
Pesticides, solvents, metals, and microbials
Consumer safety panels are boring to read, which is why brands don't emphasize them, and is also why they matter. For each category, the standard is the same: the report should show every analyte tested, the result, the limit of detection, and a pass/fail against a stated threshold.
The threshold is where state regulation meets the lab. California and Oregon set particularly strict action limits for certain pesticides; other states use different frameworks. A COA that reports "pass" without identifying which threshold is being applied is less useful than it looks.
For extracts, the residual solvents panel is critical. Ethanol and hydrocarbons (butane, propane) are common extraction solvents and show up at varying residual concentrations in the finished product. Any detectable result that exceeds the action limit is, by definition, a fail.
Common omissions and why they matter
Three patterns we see regularly in bad-faith or incomplete reports:
Missing LOD/LOQ. Without a stated limit of detection, a "not detected" result is meaningless. The question is: not detected at what level? A pesticide assay with a 1 ppm LOD is not the same as one with a 0.01 ppm LOD.
No methodology disclosure. Different analytical methods have different strengths and weaknesses. HPLC with UV detection is standard for cannabinoid potency. GC-MS is common for pesticides. If the methodology is not listed, you cannot evaluate whether the assay was appropriate.
Cropped or edited PDFs. It may sound paranoid to notice this, but it's common. Legitimate labs distribute COAs as signed PDFs, often with a QR code linking to the lab's own database for verification. A screenshot or cropped image of a report is not a COA; it is a picture of one.
How to verify a COA
The gold standard is verification at the lab level. Reputable labs maintain customer-facing portals where you can enter a sample ID or scan a QR code and retrieve the original report from the lab's own database. If a brand publishes COAs that cannot be verified this way, ask why.
A second, weaker check is reviewer signature and date. Most accredited labs sign their reports with a named analytical chemist and a date. Unsigned reports, or reports signed by generic roles ("Lab Director") without a name, are lower-confidence than signed ones.
What transparency looks like in practice
The best operators we've profiled publish COAs by batch and link every product to the specific report for the specific lot the customer received. They retain old reports publicly; they don't delete older batches when new ones come in. They redact nothing except customer-facing lab account numbers. They use accredited, third-party labs with no financial relationship to the producer.
You can browse our affiliated producer's current and historical lab reports on our lab page.