THCA COAs Explained: How to Read a Lab Test
A Certificate of Analysis (COA) is a third-party laboratory report that verifies what’s actually in a cannabis product — cannabinoid potency, contaminants, and microbial safety. Reputable THCA brands publish a current COA for every batch, sourced from an ISO/IEC 17025-accredited lab.
If you only learn one piece of cannabis literacy, make it this one. The Certificate of Analysis is the document that separates a regulated product from a guess. Reading it takes about a minute once you know which sections to scan, and it tells you everything: how potent the flower really is, whether it’s federally legal, whether it’s clean of pesticides and heavy metals, and whether the lab itself is credible.
This guide walks through every section of a real cannabis COA, the red flags that should kill a sale, and a 60-second routine you can use to verify any THCA product you’re about to buy.
What is a COA, exactly?
A Certificate of Analysis is a signed laboratory report that documents the chemical and microbiological profile of a specific batch of a product. In cannabis, it’s the third-party proof that what’s on the package matches what’s in the jar.
The COA is generated by a testing laboratory — not by the brand selling the flower. The lab receives a sample, runs a defined panel of tests, and issues a multi-page PDF with the results. The brand pays for the test, but the lab is independently accredited and bound by the protocols of its accreditation body, which is the firewall.
A real COA covers, at minimum: cannabinoid potency, pesticides, heavy metals, residual solvents (for concentrates), microbial contaminants, mycotoxins, and water activity. It also identifies the lab, the date of analysis, the sample submitter, and a unique batch identifier you can match to your physical product.
Why COAs matter
There are three reasons to care about the lab report.
Federal legality. The 2018 Farm Bill defines hemp as cannabis containing 0.3% or less delta-9-tetrahydrocannabinol on a dry-weight basis. The COA is the document that proves any given THCA batch falls under that threshold. No COA, no proof, no defense if a state inspector asks. Read more on the legality side at is THCA federally legal and your state-specific page.
Consumer safety. Cannabis is bioaccumulative — it pulls heavy metals out of soil, holds pesticide residue, and grows mold under the wrong storage conditions. A COA tells you whether any of that is in the flower you’re about to inhale. The risk isn’t theoretical: state regulators routinely pull batches over aspergillus (a mold that can colonize lungs) or arsenic levels above limits.
Potency truth. Brands have an incentive to round percentages up. The lab doesn’t. If the package says 28% THCA and the COA says 22.4%, the COA is what’s actually in the jar.
What’s on a COA — section by section
A typical cannabis COA runs 2–6 pages and is organized into discrete blocks. Here’s what each one tells you.
Sample info and batch ID
Top of the report. Identifies the sample by name, brand, date received, date analyzed, and a unique batch ID (sometimes called a “lot number”). The batch ID has to match what’s printed on your physical product — that’s the entire point of the document. If the COA says batch CG-2026-0118 and your jar says CG-2026-0205, you have the wrong COA.
Cannabinoid profile
The headline numbers. A good COA reports each cannabinoid as a weight-percent and as mg/g, broken out individually:
- THCA (the precursor — the big number on hemp flower)
- Delta-9 THC (must be ≤0.3% by dry weight to qualify as federal hemp)
- Total THC (calculated; see math below)
- CBDA / CBD
- Minor cannabinoids: CBG, CBN, CBC, THCV, occasionally delta-8 or THCP
“ND” means not detected — below the lab’s quantification limit. “<LOQ” means below the limit of quantification but possibly present. Both are functionally zero for purchasing decisions.
Terpene profile
Not all labs run terpenes — it’s an extra-cost panel. When present, you’ll see a list of the main aromatic compounds with concentrations: myrcene, limonene, caryophyllene, pinene, linalool, humulene, and a long tail of minors. Total terpenes above ~2% by mass is exceptional; 1.0–1.8% is typical for fresh top-shelf flower.
Residual solvents
Critical for concentrates (rosin, distillate, diamonds, wax, BHO). The lab tests for ethanol, butane, propane, hexane, benzene, toluene, and similar. Each must come back below the action level. Benzene and toluene should always read ND — those are Class 1 solvents and indicate a serious extraction problem if present at all. For non-extracted flower, residual solvents are typically not run.
Pesticides
A panel of 50+ regulated compounds. Cannabis state programs vary in which compounds they require, but California’s Bureau of Cannabis Control and Oregon’s OLCC publish the strictest panels and most labs follow one of those. Every entry should read “Pass” or “ND”. Any “Fail” is disqualifying.
Heavy metals
Arsenic, cadmium, lead, mercury — sometimes nickel and chromium. Cannabis bioaccumulates these from soil. State limits vary; FDA has not set cannabis-specific tolerances, but most labs use Health Canada’s limits or the USP <232>/USP <2232> elemental impurity limits as a benchmark. Pass/ND is what you want.
Microbials
Tests for living contaminants: total yeast and mold (TYM), total aerobic count (TAC), and species-specific pathogens. The most important entries are:
- Salmonella — must be absent
- E. coli (Shiga toxin-producing) — must be absent
- Aspergillus (specifically A. fumigatus, flavus, niger, terreus) — must be absent
Aspergillus is the one to take seriously. It causes invasive aspergillosis in immunocompromised people, and combustion does not reliably kill the spores.
Mycotoxins
Specifically aflatoxins (B1, B2, G1, G2) and ochratoxin A. These are produced by mold species and persist after the mold itself is killed. ND or “Pass” expected.
Moisture content and water activity
Moisture content is total water in the sample (% by mass). Water activity (Aw) is the unbound, biologically available water — the number that predicts microbial growth. Aw should be ≤0.65 for shelf-stable cannabis. Above that, mold and yeast can establish even after packaging.
Lab info and accreditation
Bottom of the COA. Lists the lab name, license number, address, ISO/IEC 17025 accreditation body and certificate number, and the analyst signature(s). This block is what makes the document a third-party report rather than a marketing claim.
ISO/IEC 17025 accreditation — what to look for
ISO/IEC 17025 is the international standard for testing and calibration laboratory competence. An accredited lab has been audited against the standard by an independent accreditation body and has demonstrated method validity, traceability of measurements, sample chain-of-custody, and ongoing quality control.
The three major accreditation bodies you’ll see logos for in the United States:
- A2LA (American Association for Laboratory Accreditation)
- PJLA (Perry Johnson Laboratory Accreditation)
- ANAB (ANSI National Accreditation Board)
If a COA doesn’t display one of those logos and a certificate number, it’s not third-party accredited and the document is a glorified self-report. Skip it.
Red flags on a COA
A handful of patterns recur on bad COAs. Treat any of these as a reason to walk away:
- No accreditation logo or certificate number. Single biggest red flag.
- “Total THC” reported as delta-9 only. Total THC must include the THCA contribution (see math below); reporting only delta-9 is hiding the post-decarb potency.
- “Pass” with no numerical limits printed. A real COA shows the action level, the measured value, and the pass/fail call. “Pass” alone is meaningless.
- Stale date. Standard freshness window is 12 months from analysis. Federal hemp testing rules have evolved toward annual re-testing for extended-shelf items; consumer-facing COAs older than a year are functionally expired.
- Generic or missing batch ID. “Lot 1” or “Sample A” with no traceability. The batch ID has to match the jar.
- No QR code or public lab portal. Most reputable labs let you re-verify the COA at the lab’s own URL. If the brand only hosts the PDF and the lab can’t confirm it, that’s suspicious.
- Photoshopped headers. Inconsistent fonts on the lab’s name, mismatched margins, an analyst signature that doesn’t match other reports from the same lab. A side-by-side with another COA from the same lab usually reveals a forgery in seconds.
How to verify a COA in under 60 seconds
A repeatable routine for the impatient:
- Locate the batch ID on the product packaging.
- Match it to the COA filename or QR code link on the brand’s site.
- Verify the lab name and ISO/IEC 17025 accreditation — logo plus certificate number.
- Check the analysis date — should be within 12 months.
- Confirm delta-9 THC ≤ 0.3% by dry weight on the cannabinoid table.
- Read the pesticide and heavy-metal sections — every analyte must be “Pass” or “ND”.
- Confirm microbial pass — especially aspergillus and salmonella.
- Cross-check potency claims on the package against the COA cannabinoid profile.
If all eight pass, the product is what it says it is.
Total THC math — why the formula matters
You’ll see two numbers on every cannabis COA that look like THC: delta-9 THC and Total THC. They’re not the same.
THCA is the acid-form precursor of THC. When heated — smoked, vaped, dabbed, baked — it loses a carboxyl group and converts to active delta-9 THC. The conversion isn’t 1:1 because the decarboxylation reaction sheds a CO₂ molecule. The standard formula is:
Total THC = delta-9 THC + (THCA × 0.877)
The 0.877 multiplier is the ratio of the molecular weight of THC (314.5 g/mol) to THCA (358.5 g/mol). After heat, you keep about 87.7% of the THCA mass as active THC; the rest leaves as carbon dioxide.
Why does this matter?
- Legally — the federal Farm Bill measures delta-9 THC, not total THC. THCA flower stays under 0.3% delta-9 even when total THC after decarb runs 20%+. Some states (Florida, Colorado, others) require total THC compliance, which changes the math entirely. See your state page on the legal directory.
- Practically — total THC is the number that predicts how high you’ll get. A jar at 24% THCA will hit roughly like a 21% THC marijuana product after combustion.
COA scams to watch for
The most common ones we’ve seen during brand audits:
- Photoshopped header on a legitimate template. A scammer takes a real Encore Labs or NaturaTest COA, rebrands the sample info, leaves the rest. Tells: misaligned text, slight color differences in logos, batch ID that doesn’t actually exist on the lab’s portal.
- Same lab name, different fonts. Lab logos and font stacks are stable across reports from a given lab. Two COAs from “Encore Labs” with different fonts means at least one is fake.
- Missing pages. A 4-page COA presented as a 1-page summary, with the contaminant pages “lost.” Always demand the full PDF, including the lab cover page and the analyst signature page.
- “Industry standard” with no number. Phrases like “meets industry standard” or “compliant” without a numerical action level are marketing copy, not test results.
Brands with above-average COA practices
Our brand directory tracks COA transparency as one of four scoring inputs. Brands that consistently publish full, current, ISO/IEC 17025-accredited COAs with QR-verifiable batch IDs land in our verified-COA tier. Browse the full list at /brands/ and filter on the verified-COA badge. A few that have scored well across multiple audits:
For ranked picks across categories see our best THCA flower and best THCA brands lists.
Frequently asked questions
What is a COA in cannabis?
A Certificate of Analysis is a third-party laboratory report documenting the cannabinoid content, contaminant levels, and microbial profile of a specific batch of a cannabis or hemp product. It’s signed by an ISO/IEC 17025-accredited lab and uniquely identified by a batch number that should match your physical product.
How do I verify a COA is real?
Match the batch ID on your product to the COA, confirm the lab is ISO/IEC 17025-accredited (look for an A2LA, PJLA, or ANAB logo and certificate number), check the analysis date is within 12 months, and ideally re-pull the COA from the lab’s own portal using a QR code or batch lookup. If the lab can’t confirm the document exists in their system, it’s not real.
What does “ND” mean on a COA?
“ND” means not detected — the analyte was below the lab’s lower limit of detection. For practical purposes, ND on pesticides, residual solvents, and pathogenic microbials is the result you want. “<LOQ” means below the limit of quantification, which is a slightly weaker statement (the compound may be present in trace amounts but cannot be measured precisely).
Why is total THC different from delta-9 THC?
Delta-9 THC is the active psychoactive cannabinoid. THCA is the non-psychoactive acid form that converts to delta-9 when heated. Total THC accounts for both: Total THC = delta-9 + (THCA × 0.877). The 0.877 is the molecular-weight ratio after the decarboxylation reaction loses a CO₂. Federal hemp law looks only at delta-9; some states use total THC for testing limits.
What’s an acceptable mold and yeast count?
State limits vary, but a common standard is <10,000 CFU/g for total yeast and mold, with all pathogenic species (specifically Aspergillus fumigatus, flavus, niger, terreus) absent. Water activity should be ≤0.65 to prevent ongoing microbial growth.
What are residual solvents I should avoid?
For solvent-extracted concentrates, the Class 1 solvents — benzene, 1,2-dichloroethane, 1,1-dichloroethene, carbon tetrachloride — should always read ND. Class 2 solvents (hexane, methanol, toluene) have action limits that vary by state. Butane and ethanol residues are common in legal extracts and have higher tolerated limits, but should still be well below the action level on the COA.
How recent should a COA be?
Within the last 12 months from the date of analysis. Cannabinoids degrade and microbial profiles can shift over time. Anything older than a year should be re-tested before sale. Some labs and brands re-COA on a 6-month cycle for shelf-stable items.
Related reading
- Cheap THCA flower without losing quality — value tier sourcing
- Best THCA flower 2026 — our ranked picks
- What is THCA? — primer on the cannabinoid
- Decarboxylation explained — the conversion math
- THCA dosage guide — translating COA potency to milligrams
- Browse all brands — verified-COA filter
Educational only — not medical or legal advice. 21+ only. THCAmap does not accept paid placement; brand rankings are computed.
Sources: ISO/IEC 17025:2017; USDA Hemp Production Program testing rules; A2LA, PJLA, and ANAB accreditation criteria; ASTM D8463-22 cannabis testing standards; AOAC Official Methods for cannabis. Last reviewed April 28, 2026.