Laboratory Certificates of Analysis Demystified

Much of what occurs behind closed doors in an analytical laboratory might be rather daunting to clients of the lab. Discussions of error, significant figures, robustness, method optimization and validation, proper use of appropriate PPE (personal protective equipment), training records, reagent storage, limits of quantitation, and linearity, to highlight an ultra-limited few, are likely not the critical minutiae clients, such as cannabis farms or product manufacturers are combing through. The client sends the samples, and waits for the results.

What Must Be on a COA?

Those results come in the form of Certificates of Analysis (CoA). While the individual templates used may vary by laboratory, several states (e.g. Washington, California) have regulated requirements in place for what each document must, at a minimum, contain. In Washington, for example, a CoA should include the following elements:

• A title
• Contact information for the lab and the client receiving the report
• A unique identifier, such as the sample number
• The identification of the methods used (liquid or gas chromatography, for example)
• A description of the sample being analyzed (e.g. flower, concentrate, topical)
• The date the sample was received
• The test results (obviously)
• The names, job titles, and signatures of the people authorizing the release of the data to the client
• Whether or not the analyses are not covered under the lab’s certification
• Documentation that the results reported fall within the range of the analytical method used
• Documentation that any qualitative results, below the limit of quantification, but above the limit of detection, are reported as “trace” or an equivalent descriptor.

Reading a Real Report

Now that you have some indication of what should be on a CoA, let’s take a deeper dive into a real one. ACS Testing Laboratories, in Florida, provided the following example:

As can be seen, the report has a title, and clearly displays the logo and relevant contact information for the lab. There is also a field for customer information. There is a detailed box that collects other pertinent details, such as the date that this extract sample was collected, and when the report was generated. It includes identifying features, such as the internal lab order number, and even provides the specific methodology used for evaluating the sample (“SOP-3”). The lab has included relevant sample weights and the density used in calculating weight percentages for some of the specific analytes described below.

This particular laboratory has chosen to provide potency information using both a concentration in milligrams per milliliter (weight per volume) and as a weight percent (weight by weight), which is the customary number listed on product labels. They’ve also provided their limit of quantitation (LOQ), which is simply the lowest concentration of an analyte that the lab can accurately measure, as determined from the validation of the method.

Moving down the report, next up is pesticides, and the lab has provided qualitative (“passed”) and quantitative information (the actual numbers). This is the same nomenclature used for heavy metals and mycotoxins, although you’ll notice that the units have changed, and heavy metals are reported as parts per billion (ppb), while mycotoxins are reported in micrograms per kilogram (µg/kg). This particular report showcases a sample that is contaminant-free.

Up next is the terpene/terpenoid content. This particular sample contained myrcene, limonene, and α-pinene, reported in milligrams per gram and as a weight percent. Lastly, the same was found to be free of microbiological organisms like yeast, mold, coliform, and Enterobacteriaceae, the latter of which includes E. coli and Salmonella.

You’ll also notice along the right side of the report that the lab has provided the type of instrumentation used for measuring each analyte. As mentioned above, this can be required by the state, but the inclusion of this information may also be important should a laboratory choose to send the same sample to multiple labs, since, should the labs use different instrumental methods, the concomitant numbers output by the methods would be expected to also differ.

The laboratory director has clearly signed off on the report, which provides accountability and traceability, and also highlights that the report has been checked over by multiple people prior to its submission to the client. And perhaps, most importantly, the lab has defined what various terms used within the report correspond to, and has demonstrated the calculations used in converting THCA and THC, and CBDA and CBD, to total THC and total CBD. This calculation is necessary, since there is a loss of mass through the decarboxylation of acidic cannabinoids (e.g THCA, CBDA) to their neutral (i.e. THC, CBD) counterparts. The 0.877 factor comes from the differences in molecular weights of the acidic and neutral molecules. For example, the molecular weight of THC is 314.45 grams per mole. A mole is a unit of measurement that corresponds to 6.022 x 10²³ molecules. Given the cumbersome nature of that latter value, the shortened “mole” is used, much like a dozen corresponds to twelve things. The molecular weight of THCA is 358.478 grams per mole, and the ratio of THC over THCA leads to the 0.877 value. Another way to view this is that there is a 12.3% mass loss from the removal of the carboxyl group on the cannabinoid acids.

This report hits all of the relevant information in an easy to understand fashion. If the report you receive from your laboratory does not, ask them for clarification. Ultimately, if you don’t understand what your lab is telling you, the onus is on both the lab and you to rectify any confusion such that you can utilize the data that you’ve paid the lab to measure. Any laboratory worth sending your money to will take the time to help you understand what your data means.

Purity Versus Compliance: What a COA Actually Certifies

What a report like this does not say matters just as much. It is easy to read a cannabis certificate of analysis as a certificate of purity. It isn’t one. A COA answers a narrower question: did this sample, tested by these methods, fall inside the limits for the analytes on the panel? A “pass” means that, and nothing more.

California’s rules show how tightly that question is framed. A COA there must give the methods, instruments and detection limits used, a pass or fail for every test, and an overall pass or fail for the batch.^[1] Two notations deserve attention. “ND” means below the method’s limit of detection, not absent. “NT” means not tested at all. A clean report cannot clear something nobody looked for.

One Batch, One Certificate

A COA is evidence about one batch. In California the batch number on a package label must match the batch number on its COA, and every batch must be tested before it can be sold.^[1,2] A COA for last month’s batch or a sister product says nothing certain about the material in front of you. So the first check is not the potency figure. It is whether the batch ID, sample dates and product description match what was actually shipped.

What Accreditation Guarantees, and What It Doesn’t

California requires cannabis testing labs to hold ISO/IEC 17025 accreditation.^[2] The standard (third edition, November 2017, confirmed in 2023) sets requirements for the competence, impartiality and consistent operation of testing laboratories.^[3]

Accreditation is granted against a scope, though, not a lab as a whole. The certificate together with its scope, which lists the tests, ranges and boundaries assessed, is the definitive statement of what the lab is accredited to do.^[4] That is why the Washington list above asks about analyses outside the lab’s certification. Ask for the scope and check that your test is on it.

Nor does accreditation promise that two labs will agree; see why two labs give different THC numbers.

Who Writes the Methods?

Two standards bodies have done much of the method work for cannabis. ASTM International set up Committee D37 on Cannabis in 2017, with subcommittees that include Laboratory (D37.03) and Quality Management Systems (D37.02).^[5] AOAC INTERNATIONAL publishes Standard Method Performance Requirements (SMPRs), which set the performance a method must reach rather than prescribing the method itself. Its early cannabis SMPRs covered cannabinoids in concentrates and dried plant material, and pesticides in cannabis.^[6] An SMPR defines the target; method validation is how a lab shows its own method hits it.

From Sample Receipt to Signature: Data Integrity

A COA is only as good as the records behind it, and the clearest public standard for those records comes from drug manufacturing. In April 2016 the FDA issued a draft guidance, “Data Integrity and Compliance With CGMP,” and finalized it in December 2018 under a new title, “Data Integrity and Compliance With Drug CGMP: Questions and Answers.”^[7,8] Cannabis labs are not bound by it, but it is a fair yardstick.

The guidance says data should be attributable, legible, contemporaneously recorded, original or a true copy, and accurate: ALCOA.^[8] The international inspectors’ body PIC/S adds four more attributes: complete, consistent, enduring and available. Together they are known as ALCOA+.^[9]

In practice that means a trail covering a sample’s whole life: who received it and when, who prepared and ran it, whether any chromatogram was reprocessed (the FDA expects each reprocessed result to be kept), and who reviewed and authorized the result. The FDA defines the audit trail as a secure, computer-generated, time-stamped record that allows the course of events to be reconstructed.^[8]

The signature on the COA is the end of that trail. In California, a supervisory or management employee must check the COA, then sign and date it; no results may be released before every analysis is finished, and an issued COA cannot be changed without the regulator’s permission.^[1,2]

When a Result Fails

The hardest test of a lab’s integrity is a result the client won’t like. The FDA’s guidance on out-of-specification (OOS) results, revised in May 2022, calls retesting until a passing number appears “testing into compliance,” and “unscientific and objectionable.” A failing result may be invalidated only when a documented test event can reasonably be shown to have caused it, and averaging is no escape, since it hides variability among individual results.^[10] Failing and suspect data must stay in the record.^[8] For contract labs, the FDA recommends that OOS investigation reports go to the customer.^[10]

Cannabis has its own version. In California a failed batch can only be destroyed, or remediated by a manufacturer under a plan the regulator approves in advance and then retested.^[2] So a passing COA that follows a failed one should come with a paper trail. If you are buying at volume, it is a fair question whether a batch was ever retested, and why. For how results go wrong in practice, see our conversation with Josh Wurzer of SC Labs.

What the 2026 Hemp Changes Mean for a COA

The federal hemp redefinition arrives in two stages, each covered in our explainer on the 2026 hemp redefinition.

November 12, 2026. Intermediate and final hemp-derived cannabinoid products containing cannabinoids the plant cannot naturally produce fall outside the federal hemp definition. The question for a COA becomes which cannabinoids are present, not only how much, and a panel cannot clear a compound it does not test for.

December 11, 2026. The rest arrives: the total-THC standard, the THCA inclusion, the 0.4 mg cap, and the exclusion for cannabinoids synthesized outside the plant. The 0.3% dry-weight threshold now applies to total THC, THCA included, so the THCA line on a COA carries legal weight, through the 0.877 factor explained above. A final product also faces a combined cap of 0.4 milligrams of total THC per container, defined as the innermost retail package. That is milligrams per container, not a percentage, so a COA that reports only percentages leaves the buyer to do the arithmetic.

The advice above still stands: ask your lab. A cannabis certificate of analysis is a short document resting on a long chain of records, and the useful questions now are which batch, which scope, which methods, and what happened to any result that failed.

References

1. California Code of Regulations, Title 4, § 15726. Certificate of Analysis (COA). Via Legal Information Institute, Cornell Law School.
2. California Department of Cannabis Control. Testing laboratories.
3. International Organization for Standardization. ISO/IEC 17025:2017 General requirements for the competence of testing and calibration laboratories. Edition 3, November 2017.
4. Irish National Accreditation Board. PS 34: Policy Statement on Scope Format for Testing Laboratories Accredited to ISO/IEC 17025. Issue 3, May 2025.
5. ASTM International. Committee D37 on Cannabis: Fact Sheet. 2020. See also the committee page.
6. Coates S. AOAC INTERNATIONAL — At a Glance. AOAC Research Institute; May 31, 2019.
7. U.S. Food and Drug Administration. Data Integrity and Compliance With Drug CGMP: Questions and Answers; Guidance for Industry; Availability. Federal Register. December 13, 2018. Docket No. FDA-2018-D-3984.
8. U.S. Food and Drug Administration. Data Integrity and Compliance With Drug CGMP: Questions and Answers. Guidance for Industry. December 2018.
9. Pharmaceutical Inspection Co-operation Scheme (PIC/S). PI 041-1: Good Practices for Data Management and Integrity in Regulated GMP/GDP Environments. July 1, 2021.
10. U.S. Food and Drug Administration. Investigating Out-of-Specification (OOS) Test Results for Pharmaceutical Production. Guidance for Industry, Revision 1. May 2022.

Editor’s note: This article was originally published on June 7, 2019, by Jason S. Lupoi, Ph.D. In October 2026 the editors expanded it with new sections on what a COA does and does not certify, batch specificity, ISO/IEC 17025 accreditation, the standards bodies behind cannabis methods, data integrity, failed results, and the 2026 federal hemp changes. Dr. Lupoi’s original text is unchanged.

Last updated October 2026 · Originally published June 7, 2019.