How to Read a Cannabinoid COA: What Every Brand Should Know

Quick Answer: A Certificate of Analysis (COA) is a third-party lab document that verifies the cannabinoid content, contaminant levels, and safety profile of a given batch of hemp-derived product.

Reading one correctly means checking potency results against label claims, confirming the testing lab holds ISO/IEC 17025 accreditation, and cross-referencing the batch number on the document with the lot you're receiving. A COA that doesn't match the product in your hands is not a COA — it's a liability.

Key Takeaways

• A cannabinoid certificate of analysis (COA) verifies batch-specific potency, contaminant levels, and safety results, but only if it matches the lot being purchased.

• A legitimate COA should include lab letterhead, sample ID, test dates, analytical methods, batch numbers, and ISO/IEC 17025 accreditation details.

• Potency panels should be checked against label claims and tested by validated methods such as high-performance liquid chromatography (HPLC).

• Safety panels should include residual solvents, heavy metals, microbial contaminants, mycotoxins, and pesticide testing appropriate for the product format and target states.

• Brands must cross-reference the COA batch number with purchase orders, shipping documents, and physical lot labels to confirm the document applies to the received material.

• Major red flags include old COAs, missing lab accreditation, incomplete testing panels, mismatched batch IDs, and suspiciously rounded potency numbers.

• Partner with Arvida Labs to source cannabinoid materials backed by current third-party COAs, ISO-accredited testing, batch-specific documentation, and compliance-ready transparency.

COA Basics: What This Document Is Actually Telling You

Most brands receive a COA from their supplier, glance at a few numbers, and file it away. That's understandable. They shouldn’t be treated as the terms and agreements of a random app you signed up for, but these documents aren't designed for casual reading either. 

But for any brand sourcing cannabinoid ingredients at scale, a COA is the primary mechanism of accountability between you and your manufacturer. It's the only document standing between your product line and a compliance failure, a consumer safety issue, or a retailer rejection.

What a COA does is confirm, in writing, that a specific batch of material has been tested by a laboratory and meets. or in some cases fails to meet. defined safety and potency parameters. 

What it cannot do is guarantee that every unit in a production run is identical to the sample that was tested, or that the testing methodology was rigorous enough to catch every potential issue. That gap between what a COA confirms and what it leaves open is where most sourcing decisions go wrong.

What a COA Confirms and What it Doesn’t

A properly structured COA will confirm cannabinoid potency levels for the tested sample, residual solvent presence or absence, heavy metal concentrations, microbial load, and, in many cases, mycotoxin and pesticide screening results. It tells you what was in the sample at the time of testing, measured through specific analytical methods using equipment calibrated to a defined sensitivity threshold.

What a COA does not confirm is whether the lab that tested the material is credible, whether the sample submitted was representative of the full batch, or whether the document you're looking at was generated from a test of the material you're actually buying. 

These are all questions you have to answer separately, and the sections below will show you how.

Legitimate COAs vs. Documents That Should Raise Questions

A legitimate COA is issued on the laboratory's official letterhead, includes the lab's accreditation credentials, names the client and product being tested, specifies the method used to run each test, and provides a unique sample ID and collection date. If any of those elements are missing, the document's reliability is immediately in question.

Documents that should raise concern include COAs with no lab contact information, no listed test method, result dates that are months or years old, or potency numbers suspiciously rounded to even figures across every cannabinoid. 

Labs produce measurements with decimal precision. A result showing exactly 95.0% purity across an entire panel without any instrument variance is a strong indicator that the document wasn't generated by an actual instrument, which is a huge red flag against that lab result.

COA Sections Explained: What to Look For and Why It Matters

Once you've confirmed a COA is structurally legitimate, the next step is reading each section with the right questions in mind. Not all panels carry equal weight for every product type, and what matters for a distillate destined for vape production differs meaningfully from what matters for a CBD isolate going into a food-grade gummy. 

Potency Testing and What the Numbers Mean

The potency panel is almost always the first section on a COA, and it's the one most brands focus on exclusively. It lists the measured concentration of each cannabinoid detected in the sample, typically expressed as a percentage by weight. 

For most hemp-derived ingredients, you're looking at how much CBD, THC, THCa, CBG, CBN, or other target cannabinoids are present, and whether those numbers match what the supplier told you to expect.

The testing method matters here. Research published in PMC and a systematic review in PubMed both confirm that High-Performance Liquid Chromatography with UV or diode array detection (HPLC-UV/DAD) is the accepted gold standard for cannabinoid potency analysis. 

It is preferred specifically because it keeps acid-form cannabinoids like THCa intact, allowing for more accurate reporting before any heat-induced conversion occurs. If a COA lists potency results without specifying the analytical method, that's information worth asking your supplier to clarify.

This is what the potency section looks like on one of our COAs:

Residual Solvents and Heavy Metals Testing

Solvents are introduced into cannabinoid products during extraction and purification. Even when production teams run post-processing steps like vacuum purging and heat application, trace solvent levels can persist. Depending on which solvents were used and at what concentrations, that residual presence carries a real toxicity risk for end consumers.

Regulators classify residual solvents into three categories based on health risk. 

• Class 1 solvents, including benzene and chloroform, are known or suspected human carcinogens, and PMC research on cannabis contaminants found chloroform and benzene among the most frequently detected solvents in cannabis extract samples. These should be completely absent in any compliant product. 

• Class 2 solvents carry potential for irreversible toxicity and are subject to defined exposure limits.

• Class 3 solvents carry low toxic potential and are the preferred choice for compliant hemp extraction. 

On a COA, look for an explicit pass/fail designation on the solvent panel, and confirm that any detected solvents are Class 3 and within the stated limits for your target market. Colorado's residual solvent testing guidance provides a useful reference for how state regulators approach these thresholds.

Heavy metals testing uses Inductively Coupled Plasma Mass Spectrometry (ICP-MS) to screen for contaminants absorbed from soil, fertilizers, and growing media. What you're looking for on a COA is a clear pass designation for each metal listed, with reported concentrations well below the applicable action levels for your product format and target state. Some states have expanded their required panels beyond the standard four, so confirm the panel covers your distribution footprint.

Residual solvents to look for:

• Class 1 (Must Be Absent): Benzene, chloroform, 1,2-dichloroethane. These are either known or suspected carcinogens with no safe exposure threshold in consumer products

• Class 2 (Must Be Within Limits): Methanol, hexane, acetonitrile. These are subject to defined exposure limits; detectable levels must fall below state-specific action levels

• Class 3 (Low Risk, Preferred): Ethanol, isopropanol. These are the preferred solvents for compliant hemp extraction, but they should still appear on the panel with confirmed concentrations

Residual solvent section on one of Arvida Labs’ COAs:

Heavy metals to look for:

• Arsenic: A naturally occurring soil contaminant readily taken up by cannabis; inorganic arsenic is a known human carcinogen

• Cadmium: Accumulates in kidney tissue with repeated exposure; cannabis is a known bioaccumulator of cadmium from phosphate-heavy soils

• Lead: No safe level of lead exposure exists in consumer products; older agricultural soils carry an elevated risk

• Mercury: Less commonly detected but included in standard panels due to its acute neurological toxicity

Here’s what heavy metal testing looks like with our products:

Microbial and Mycotoxin Results

Microbial testing is among the most consequential panels on a COA, particularly for products being sold to wellness brands or into markets with immunocompromised end users. 

Research published in ScienceDirect notes that microbial contamination in cannabis often originates from environmental and procedural conditions throughout the entire seed-to-sale pipeline. This may include events like elevated humidity during storage, improper handling, or cross-contamination during processing.

The targets and thresholds vary meaningfully by state. Medicinal Genomics' microbial testing resource documents how California sets absolute zero-tolerance thresholds for specific pathogens, including four species of Aspergillus plus Salmonella and Shiga toxin-producing E. coli, while Massachusetts applies quantitative limits across broader categories of microbial load. 

Here’s what an in-depth microbial testing section looks like on our COAs:

If your brand sells across multiple states, the COA's microbial panel needs to satisfy the most restrictive state in your distribution footprint, not just the state where the product was manufactured.

Mycotoxins, produced by specific mold species, primarily Aspergillus, are tested separately from the general microbial load. Aflatoxins and ochratoxin A are the primary targets.

Cross-Referencing a COA Against What You're Actually Buying

A COA that's technically accurate but doesn't correspond to the material you're receiving is one of the most common problems in cannabinoid supply chains — and one of the most difficult to detect without specific verification steps. Suppliers may share COAs from prior batches, submit non-representative samples for testing, or, in some cases, share documents from entirely different products. None of these scenarios are detectable by reading the COA itself. This section addresses how to close that gap.

Batch Numbers, Sample IDs, and Chain of Custody

Every COA should include a batch number or lot ID that links the document to a specific production run. That same identifier should appear on your purchase order, your shipping documentation, and the physical label or packaging of the material you receive. If there's a mismatch at any point in that chain, you cannot confirm the COA you're holding applies to what's in the container.

Sample IDs serve a related but distinct function. They're the lab's internal identifier for the specific material submitted for testing. A legitimate COA will include both a sample ID assigned by the lab and the product or batch identifier provided by the submitting client. 

When reviewing a COA, check whether those identifiers are consistent and whether the sample collection date is recent enough to reflect the current batch rather than a previous production run. Our article on the chain of custody in cannabinoid manufacturing explains what a properly documented supply chain looks like from sourcing through delivery.

Third-Party Lab Accreditation and Iso/iec 17025 Certification

The single most important credentialing check on any COA is whether the issuing laboratory holds ISO/IEC 17025 accreditation. This international standard, administered in the U.S. by bodies including A2LA and ANAB, establishes minimum requirements for testing laboratory competence, including equipment calibration, personnel qualifications, method validation, and quality management systems.

A lab that holds ISO/IEC 17025 accreditation has been assessed by an independent third party and confirmed to meet those baseline standards. A lab that doesn't hold it has made no verified commitment to any of them. 

As the Cannabis Industry Journal notes, ISO/IEC 17025 provides the foundation, but compliance with Good Laboratory Practices and Good Manufacturing Practices remains essential for labs demonstrating genuine reliability. The accreditation is a necessary condition for trust, not a sufficient one. Verify accreditation status directly with the accrediting body before accepting COAs from any lab you haven't previously vetted.

COA Red Flags That Should Stop a Sourcing Decision Cold

Experienced purchasing managers develop instincts for COA quality over time, but there are specific red flags that should give any brand pause, regardless of how compelling a supplier's pitch sounds. These are the patterns that show up repeatedly in bad-actor supply chains, and they're worth scanning for before a single dollar changes hands.

• No Accreditation Information Listed: If a COA doesn't name the issuing lab, provide contact information, or reference an accreditation body, the document cannot be independently verified. Walk away until that information is provided in writing.

• Sample Date Doesn’t Match the Batch You’re Buying: COAs expire in the sense that an older test doesn't reflect current production conditions. A COA dated six to twelve months prior to your order is not documentation of what you're receiving — it's documentation of what someone else received.

• Potency Results With No Variance Across Cannabinoids: Real analytical instruments produce results with decimal-level precision and slight measurement uncertainty. Round numbers and perfectly clean panels without any trace-level detections should trigger a request for raw instrument data.

• Missing Panels for Your Product Format: A vape distillate COA that shows cannabinoid potency but has no residual solvent testing is not a complete safety document. Each product format has a corresponding test panel requirement — and a supplier who submits an incomplete panel may be avoiding results they don't want you to see.

How Arvida Labs Handles COA Transparency

At Arvida Labs, every batch of bulk cannabinoid material ships with a current, third-party COA from an ISO/IEC 17025-accredited laboratory. That means potency, residual solvents, heavy metals, microbials, and mycotoxins, not a partial panel selected for appearance. All the screenshots you saw in this article were taken from our CBD COAs done by KCA Labs.

COAs are matched to the specific lot number on your order, and our documentation is available before shipment, so your team can review and approve before the material arrives.

Failure rates are a problem, and that’s exactly why we don't recycle documentation between batches. Each production run is tested independently, and COA dates reflect the actual testing window for that material. 

For brands operating across multiple states, we can support compliance review by providing results against the applicable state thresholds in your distribution footprint, not just the default values from the lab's internal pass/fail criteria. You can review available COAs on our resources page or request batch-specific documentation directly.

Consistent documentation isn't a marketing claim. It's what you're actually buying when you source from a lab partner that takes quality seriously. Partner with Arvida Labs to learn more today.

Frequently Asked Questions

Can I Trust a COA Provided by the Supplier Directly?

A supplier-provided COA can be legitimate, but it carries an inherent conflict of interest. The more reliable approach is to request the lab's contact information and verify the document directly with the issuing lab using the sample ID. Any credible supplier should support that verification without hesitation.

How Old Is Too Old for a COA?

Most industry practitioners treat 12 months as the outer limit for a COA to remain relevant, and many buyers set tighter internal standards of 6 months. For compliance purposes, the COA date must reflect the batch you're purchasing, not a prior run produced under different conditions.

What Is the Difference Between a Pass and "Not Detected" on a COA?

"Pass" indicates the tested analyte was measured against a defined action level and came in below it. "Not Detected" (ND) means the analyte wasn't measurable at or above the lab's limit of detection (LOD). A COA should list the LOD for each panel. Otherwise, "not detected" doesn't tell you how sensitive the test actually was.

Do All States Require the Same COA Panels?

No. State testing requirements vary significantly in terms of which contaminants must be screened, at what concentration thresholds, and using which accepted methods. Brands distributing across multiple states need COAs that satisfy the most stringent applicable state standard in their footprint, which is often not where the product was made.

What Does It Mean If a COA Shows Results "Per Serving" Instead of "Per Gram"?

Results expressed per serving rather than by weight percentage can make meaningful comparisons between suppliers difficult. Potency results should be anchored to a consistent unit of measurement, typically percentage by weight or mg/g, so that you can accurately calculate dosing across your formulation. Ask for weight-based results if a supplier provides serving-based figures only.

Sources for This Article

• National Center for Biotechnology Information: "Potency Analysis of Medical Marijuana Products from New York State" - pmc.ncbi.nlm.nih.gov/articles/PMC6757241/

• National Center for Biotechnology Information: "The Effect of Different Extraction Methods on the Chemical Profile of Cannabis sativa L." - ncbi.nlm.nih.gov/pmc/articles/PMC12196272/

• National Center for Biotechnology Information: "Microbial safety of medicinal cannabis: a review of the current landscape" - pmc.ncbi.nlm.nih.gov/articles/PMC9472674/

• Colorado Department of Public Health & Environment: "Residual solvent testing" - cdphe.colorado.gov/residual-solvent-testing

• ScienceDirect: "A comparative study on the microbial contamination of medicinal cannabis in international markets" - sciencedirect.com/science/article/abs/pii/S0149291826000810

• Medicinal Genomics: "Cannabis Microbial Testing Regulations by State" - medicinalgenomics.com/resource/cannabis-microbial-testing-regulations-by-state/

• A2LA: "Cannabis Testing Laboratory Accreditation" - a2la.org/accreditation/cannabis-testing/

• ANAB: "ISO/IEC 17025 Cannabis Testing Laboratory Accreditation" - anab.ansi.org/accreditation/iso-iec-17025-cannabis-testing/

• Cannabis Industry Journal: "ISO/IEC 17025 Accreditation Falls Short for Cannabis Testing Laboratories" - cannabisindustryjournal.com/feature_article/iso-iec-17025-accreditation-falls-short-for-cannabis-testing-laboratories/