How to Read a Certificate of Analysis (COA) for THCa Products

Why COAs Matter More Than Anything Else

Here’s the reality: the THCa market is largely unregulated at the retail level. Unlike licensed dispensaries in recreational cannabis states, hemp-derived THCa shops don’t always face rigorous oversight. That means the Certificate of Analysis (COA) is your single best tool for verifying that a product is safe, potent, and legal.

A COA is a lab report from a third-party laboratory that tells you exactly what’s in a product and what’s not. It’s the difference between knowing you’re consuming tested, compliant THCa flower and gambling on something that might contain pesticides, heavy metals, or synthetic cannabinoids.

If a shop can’t show you a COA for the product you’re buying, walk out. There are over 5,700 shops in our directory. You have options.

What Is a Certificate of Analysis?

A Certificate of Analysis is a document produced by an accredited third-party laboratory that has tested a sample of the product. “Third-party” is the key word. It means the lab has no financial relationship with the manufacturer, brand, or retailer. They’re an independent entity paid to test a sample and report the results, good or bad.

A proper COA covers multiple testing panels, each examining a different aspect of the product. Let’s walk through every section you’ll encounter.

Section-by-Section Walkthrough of a THCa COA

1. Header / Lab Information

What you’ll see: The lab’s name, logo, address, phone number, website, and accreditation credentials.

What it tells you: Who performed the testing and whether they’re legitimate.

What to check:

• The lab name should be a real, searchable company (Google it)
• Look for an ISO/IEC 17025 accreditation number (the international standard for testing labs)
• The lab should be accredited by a body recognized by the International Laboratory Accreditation Cooperation (ILAC)
• The lab’s physical address should be in the United States
• A working website URL should be present

Red flag: No accreditation number, no website, or a generic lab name that doesn’t appear in online searches.

2. Sample / Product Information

What you’ll see: Product name, batch number, sample ID, date received, date tested, date reported, client name (the manufacturer or brand), and sometimes a product photo.

What it tells you: Which specific product and batch this COA applies to.

What to check:

• Batch number on the COA must match the batch number on the product packaging. This is non-negotiable. If the numbers don’t match, the COA doesn’t apply to your product.
• The test date should be recent. We recommend avoiding products with COAs older than 12 months. Cannabinoid content can degrade over time, and contaminants can develop in storage.
• The client name should match the brand on the product. If the COA says “XYZ Labs” tested a product for “ABC Brand” but the product in your hand is from “DEF Brand,” something is wrong.

Red flag: Missing batch numbers, test dates older than 12 months, or client names that don’t match the product brand.

3. Cannabinoid Profile (Potency Panel)

What you’ll see: A table listing cannabinoid concentrations, typically including:

• THCa (the main one you care about)
• Delta-9 THC (must be below 0.3% for legal compliance)
• Total THC (calculated as Delta-9 THC + [THCa x 0.877])
• CBD, CBDa, CBG, CBGa, CBN, CBC (minor cannabinoids)
• Total Cannabinoids (sum of all detected cannabinoids)

Each cannabinoid is listed with its concentration in percentage (%) and sometimes in mg/g.

What it tells you: How potent the product is and whether it’s legally compliant.

What to check:

• THCa percentage: Quality THCa flower typically tests between 15-30%. Concentrates should be 70-99%. Anything claiming to be THCa flower with 40%+ THCa is suspicious (that’s unnaturally high for flower).
• Delta-9 THC: Must be below 0.3% by dry weight for legal compliance under the 2018 Farm Bill. If it’s above 0.3%, the product is technically non-compliant hemp (or just marijuana, legally speaking).
• Consistency: The cannabinoid profile should make sense for the product type. THCa flower should show THCa as the dominant cannabinoid. A product claiming to be “high THCa” but showing CBD as the primary cannabinoid is mislabeled.

What a good potency panel looks like:

What a bad or suspicious potency panel looks like:

4. Contaminant Testing Panels

This is where safety lives. A comprehensive COA includes multiple contaminant panels:

Pesticide Panel

What you’ll see: A list of 60-100+ pesticides tested, with results showing either “ND” (not detected), “Pass,” or a specific concentration in parts per billion (ppb).

What to check: Every pesticide should show “ND” or “Pass.” Any pesticide detected above action limits is a hard fail. Common offenders include myclobutanil, bifenthrin, and abamectin.

Red flag: No pesticide panel at all, or a panel testing fewer than 50 pesticides.

Heavy Metals Panel

What you’ll see: Results for the “Big Four” heavy metals:

• Lead (Pb)
• Arsenic (As)
• Mercury (Hg)
• Cadmium (Cd)

Results are listed in parts per million (ppm) with action limits.

What to check: All four should be below their respective action limits. For reference, common action limits are:

• Lead: less than 0.5 ppm
• Arsenic: less than 0.2 ppm
• Mercury: less than 0.1 ppm
• Cadmium: less than 0.2 ppm

Red flag: Missing heavy metals panel, or any metal exceeding action limits. This is especially important for vape cartridges, where cheap hardware can leach lead.

Microbial / Microbiological Panel

What you’ll see: Tests for:

• Total Yeast and Mold (TYM count)
• E. coli
• Salmonella
• Aspergillus (a dangerous mold species)
• Sometimes: total aerobic bacteria, bile-tolerant gram-negative bacteria, coliforms

What to check: All results should show “Pass,” “ND,” or below action limits. Yeast and mold counts should be below 10,000 CFU/g for flower (some states set stricter limits).

Red flag: No microbial testing at all. Mold is one of the most common contaminants in cannabis and hemp flower, especially product stored in humid conditions.

Residual Solvents Panel (for concentrates and vapes)

What you’ll see: A list of solvents like butane, propane, hexane, ethanol, isopropanol, and others, with results in ppm.

What to check: All solvents should be below action limits or show “ND.” This panel is critical for concentrates and vape cartridges made using solvent-based extraction. Solventless products (rosin) technically don’t need this panel, but good brands include it anyway.

Red flag: Concentrates or vape cartridges without a residual solvent panel.

Mycotoxin Panel

What you’ll see: Results for aflatoxins (B1, B2, G1, G2) and ochratoxin A.

What to check: All should be “ND” or below action limits. Mycotoxins are toxic compounds produced by certain molds and can cause serious health issues.

5. Moisture Content (for flower)

What you’ll see: Percentage of moisture in the flower sample, along with water activity (Aw) measurement.

What it tells you: Whether the flower was properly cured and is at a safe moisture level.

What to check: Moisture content should be between 8-13% for properly cured flower. Water activity should be below 0.65 Aw. Higher moisture promotes mold growth. Lower moisture means the flower is overdried and will be harsh.

6. Terpene Profile (optional but valuable)

What you’ll see: A list of individual terpenes with their concentrations in percentage, often accompanied by a visual chart.

What it tells you: The flavor and aroma profile of the product, and potentially the type of experience it may provide.

Common terpenes:

• Myrcene: Earthy, musky. The most common terpene in cannabis.
• Limonene: Citrusy, bright.
• Caryophyllene: Peppery, spicy.
• Linalool: Floral, lavender-like.
• Pinene: Pine, forest-like.
• Terpinolene: Herbal, slightly floral.

What to check: Total terpene content above 1% is considered good. Above 2% is excellent. The presence of diverse terpenes indicates quality flower with a complex profile.

7. QR Code / Verification Link

What you’ll see: Many modern COAs include a QR code or URL that links directly to the lab’s website where you can view the report online.

What it tells you: Whether this COA is real and hasn’t been fabricated or altered.

What to check: Scan the QR code or visit the URL. It should take you to the lab’s official website (not a third-party file host) and display the same results as the printed COA. More on verification below.

Good COA vs. Bad COA: Side-by-Side Comparison

What a Good COA Looks Like

• Lab name, address, website, and ISO 17025 accreditation number prominently displayed
• Product name, batch number, sample ID, and recent test date (within 12 months)
• Client name matches the brand on the product
• Full cannabinoid profile with THCa, Delta-9 THC, total THC, and minor cannabinoids
• Pesticide panel testing 60+ pesticides, all passing
• Heavy metals panel (Pb, As, Hg, Cd), all below action limits
• Microbial panel including yeast/mold, E. coli, Salmonella, Aspergillus
• Residual solvents (for concentrates/vapes)
• Moisture content (for flower)
• Terpene profile (bonus, not required)
• QR code or verification URL linking to the lab’s website
• Signed and dated by the lab analyst

What a Bad COA Looks Like

• No lab accreditation number or a fake one
• Missing or illegible batch numbers
• Test date is over 12 months old
• Only a potency panel (no contaminant testing)
• No pesticide, heavy metal, or microbial testing
• Suspiciously perfect numbers (0.00% Delta-9 THC, exactly 30.00% THCa)
• No QR code or verification link
• Hosted on the brand’s website as a JPG/PNG image (easy to edit) rather than linked to the lab
• Lab name doesn’t appear in online searches
• No analyst signature

How to Verify a COA Is Real

This is the part most consumers skip, and it’s arguably the most important. Fake COAs exist. Altered COAs exist. Here’s how to verify that the lab report in your hand is legitimate.

Step 1: Find the Lab’s Website

The COA should list the lab’s name and website. Google the lab name independently (don’t just click a link on the brand’s website). Confirm the lab is a real, operating business.

Major THCa testing labs you’ll commonly see:

• ACS Laboratory (acslabcannabis.com)
• Kaycha Labs (kaychalabs.com)
• ProVerde Laboratories (proverdelabs.com)
• Botanacor (botanacor.com)
• SC Labs (sclabs.com)
• Encore Labs (encorelabs.com)
• Green Leaf Lab (greenleaflab.org)
• Columbia Food Laboratories (cflabs.com)

Step 2: Search for the COA on the Lab’s Website

Most accredited labs maintain a public database where you can look up COAs by batch number, sample ID, or QR code. Go to the lab’s website directly and search for the specific report.

• If the COA appears in the lab’s database with matching results, it’s legit
• If the COA doesn’t appear in the lab’s database, it may be fabricated
• If the results in the database don’t match the document you have, the physical COA has been altered

Step 3: Scan the QR Code

If the COA has a QR code, scan it with your phone’s camera. It should open a page on the lab’s website (not a random URL, not a Google Drive link, not the brand’s own website). The results displayed should match the document exactly.

Step 4: Check the Accreditation

Look up the lab’s ISO 17025 accreditation number with the accrediting body. In the US, common accrediting bodies include:

• A2LA (American Association for Laboratory Accreditation)
• PJLA (Perry Johnson Laboratory Accreditation)
• ANAB (ANSI National Accreditation Board)

These organizations maintain searchable databases. If the lab claims ISO 17025 accreditation, you should be able to verify it.

Step 5: Cross-Reference the Batch Number

The batch number on the COA should match the batch number on the product packaging. Check the label, the box, or the sticker on the product itself. If there’s no batch number on the product, that’s a problem. If the numbers don’t match, the COA wasn’t issued for that specific product.

Common COA Scams and How to Avoid Them

The THCa market has grown fast, and not all players are honest. Here are the most common scams we’ve seen:

Scam 1: The Recycled COA

How it works: A brand gets one batch tested, receives a clean COA, and then uses that same COA for every batch they produce. The product you buy might be from batch #500, but the COA is from batch #001 tested two years ago.

How to spot it: Check the batch number on the COA against the batch number on the product. Check the test date. If the COA is over a year old, ask the retailer if they have a more recent one for the current batch.

Scam 2: The Photoshopped COA

How it works: Someone takes a real COA from a different product and edits the potency numbers, product name, or batch number using image editing software.

How to spot it: Verify the COA directly on the lab’s website using the batch number or QR code. Altered documents won’t match the lab’s records. Also look for visual inconsistencies: mismatched fonts, blurry numbers, or text that doesn’t align properly.

Scam 3: The In-House “Lab”

How it works: A brand claims their products are “lab tested” but the testing was done by their own internal lab, not an independent third party. There’s an obvious conflict of interest.

How to spot it: Check if the lab name on the COA is a separate, independently accredited facility. If the lab shares an address with the brand, or if the lab’s website looks like it was made in five minutes, be skeptical. True third-party testing means the lab has zero financial relationship with the brand.

Scam 4: The Potency Inflation

How it works: A lab (usually an unaccredited one) consistently reports higher potency numbers than what the product actually contains. Brands seek out these labs because “27% THCa” sells better than “19% THCa.”

How to spot it: This one is harder to catch as a consumer. Your best defense is to buy from brands that use well-known, ISO 17025 accredited labs. If a product seems too good to be true (especially flower claiming 35%+ THCa), it probably is.

Scam 5: The Partial Panel

How it works: A brand provides a COA that only shows the cannabinoid potency panel. No pesticides, no heavy metals, no microbials. They’re hiding the fact that their product might fail contaminant testing.

How to spot it: A legitimate COA should include, at minimum: cannabinoid potency, pesticides, heavy metals, and microbial testing. If you only see a potency panel, the brand is either cutting corners on testing or has something to hide.

Scam 6: The Bulk Relabeler

How it works: A company buys bulk THCa flower from a wholesaler, relabels it under their own brand, and uses the wholesaler’s COA (if they bother to provide one at all). The product may have been stored improperly, mixed between batches, or degraded since the original testing.

How to spot it: Look for consistency between the COA’s client name and the brand on the product. Ask the retailer where the product comes from and who manufactures it. Reputable brands are transparent about their supply chain.

What to Do When a Shop Can’t Provide a COA

You’d be surprised how often this happens. You ask for a COA and get a blank stare, a “we don’t have that,” or a vague “it’s on the website somewhere.” Here’s your playbook:

1. Ask specifically: “Can I see the Certificate of Analysis for this specific product and batch?” Be specific about what you want.

2. Check the product packaging: Some products have a QR code printed on the label that links directly to the COA. Scan it.

3. Check the brand’s website: Many brands post COAs on their product pages. Look for a “Lab Results” or “COAs” section.

4. If none of the above works, don’t buy it. Seriously. An untested THCa product is a gamble with your health. You don’t know what’s in it, how potent it is, or whether it contains contaminants. Find a different shop. Our directory can help.

5. Leave a review. If a shop refuses to provide COAs, let other consumers know. Transparency should be the baseline, not a bonus.

COA Requirements by Product Type

Different products warrant different testing panels. Here’s what you should expect:

The Cost of Testing (And Why Some Brands Skip It)

Full-panel third-party testing costs brands between $200-500 per batch, depending on the lab and the number of panels included. For a small brand producing many SKUs across multiple batches, testing costs can add up quickly.

That’s the (understandable) reason some brands skip comprehensive testing. But it’s not an acceptable excuse. If a brand can’t afford to test their products, they can’t afford to sell them. Period. The cost of testing gets built into the product price, and it’s a cost that directly protects your health.

When you pay a few dollars more for a product from a brand that does full-panel testing, you’re paying for peace of mind. That’s worth it.

Frequently Asked Questions

What does “ND” mean on a COA?

“ND” stands for Not Detected. It means the substance was tested for but was not found at or above the lab’s limit of detection (LOD). This is the result you want to see for contaminants like pesticides, heavy metals, and residual solvents. ND doesn’t always mean absolute zero (trace amounts below the detection threshold might exist), but it means the product passed that particular test.

How old can a COA be and still be valid?

We recommend treating COAs as valid for up to 12 months from the test date. After that, the product’s cannabinoid content may have degraded, and storage conditions could have introduced contaminants (especially mold). Some states set their own expiration standards, but 12 months is a reasonable consumer guideline.

Can a product have a clean COA but still be bad?

Yes, in a few scenarios. The COA might be from a different batch. The product might have been stored improperly after testing (exposed to heat, light, or moisture). The COA might be from an unaccredited lab producing unreliable results. Or the COA might be outright fake. That’s why verification (checking the lab’s database directly) matters.

What THCa percentage should I look for in flower?

Quality THCa flower typically tests between 15-30% THCa. Here’s a general guide:

• 15-19%: Good entry-level potency, suitable for newcomers or light users
• 20-25%: Mid-range, the sweet spot for most consumers
• 25-30%: High potency, for experienced users
• Above 30%: Rare and should be viewed with skepticism for flower (concentrates are different)

Do edibles need COAs?

Absolutely. Edible COAs are especially important because they verify that the dosage per piece is accurate. If a gummy claims to contain 25mg of THCa, the COA should confirm that. Inaccurate dosing in edibles is a real problem with some brands, and it can lead to either underwhelming or overwhelming experiences.

What’s the difference between ISO 17025 and other certifications?

ISO/IEC 17025 is the international standard specifically for testing and calibration laboratories. It’s the gold standard for cannabis and hemp testing labs because it requires documented quality management systems, proficiency testing, measurement uncertainty evaluation, and regular audits. Other certifications (like ISO 9001) address general quality management but don’t specifically validate laboratory testing competence. When evaluating a lab, ISO 17025 is the one that matters.

Where can I find shops that always provide COAs?

THCa Nearby’s directory lists over 5,700 verified retailers. Look for shops with positive reviews that specifically mention lab testing and transparency. Our listings help you identify retailers that prioritize product quality. You can also check a shop’s website before visiting to see if they post COAs for their products.

Should I worry about “total THC” on a COA?

Total THC (Delta-9 THC + THCa x 0.877) is listed on most COAs for informational purposes. Under the current 2018 Farm Bill framework (still active as of March 2026), only the Delta-9 THC number matters for legal compliance (must be below 0.3%). However, the new federal rules taking effect November 2026 will use total THC as the compliance metric. Check our legal landscape guide for the latest on how this affects your state.

This guide is for informational purposes only and does not constitute medical or legal advice. Always verify product testing through the lab’s official website. For more information on THCa legality in your state, see our state-by-state legal guide. Find verified, lab-tested THCa retailers near you at THCa Nearby.