How to Read a Cannabis Lab Report (COA): A Line-by-Line Guide

A certificate of analysis, or COA, is the lab report for a single batch of cannabis. In regulated markets, a licensed lab tests a sample from every batch before it can be sold, and the COA records what it found: how much THC and CBD is present, and whether the batch passed tests for pesticides, heavy metals, microbes, mold toxins and leftover solvents.

COAs look intimidating, but they follow a predictable layout. This guide walks through each section using California's rules as the reference, since the state spells out in detail what a compliance COA must contain. Other states and countries use similar panels with different limits, so always read the pass/fail column on the report in front of you.

The header: who tested what, and when

Before you look at a single number, confirm the report is about your product. California requires a compliance COA to include, among other things:

• "Regulatory Compliance Testing" — printed as a heading in the upper right corner.
• The lab — its name, licensed premises address and license number.
• The businesses — the name, address and license number of the distributor and of the cultivator or manufacturer.
• The batch number — for the batch the sample came from. This is the line you match to your package.
• Sample details — the sample type (matrix), a unique sample ID, and the dates it was collected, received and analyzed.
• A photo — of the sample, including its packaging if it was pre-packaged.
• Methods and limits — the analytical methods and instruments used, with their limits of detection and quantitation.

The cannabinoid panel: how to calculate total THC from THCA

Total THC is 0.877 times THCA plus Δ9-THC. California labs must report at least THC, THCA, CBD, CBDA, CBG and CBN. The two you will care about most are THCA and Δ9-THC (often written simply as THC).

Raw cannabis contains mostly THCA, the acid form. It is not very intoxicating until it is heated, which converts it into Δ9-THC. The U.S. Department of Agriculture's hemp rules define this decarboxylation as the chemical reaction that turns THCA into delta-9 THC, and they express the potential THC in a sample with a simple formula:

Total THC = (0.877 × THCA) + THC

7 CFR § 990.1, U.S. Department of Agriculture

The 0.877 factor exists because THCA is a heavier molecule than THC: when it converts, it loses part of its mass as carbon dioxide, so each milligram of THCA yields about 0.877 mg of THC. The same formula, with CBDA and CBD, gives total CBD. California's regulations now go one step further and include delta-8 THC and delta-8 THCA in their definition of total THC.

A worked example: 24% THCA becomes about 21.6% total THC

Suppose a flower COA reports 24.0% THCA and 0.6% Δ9-THC (illustrative numbers):

1. 24.0 × 0.877 = 21.05
2. 21.05 + 0.6 = 21.65, so total THC is about 21.6%

That explains why a jar can list "THCA 24%" and "Total THC 21.6%" without either number being wrong. Adding THCA and THC together without the factor would overstate the potency.

Units: %, mg/g, mg per serving

ND, LOD and LOQ: what "not detected" really means

Contaminant results are often full of "ND" and "<LOQ." These are not errors; they describe the limits of the test.

• ND: not detected. California requires labs to use "ND" for non-detects.
• <LOQ: detected, but below the level the method can put a reliable number on.

The contaminant panels: five safety tests and their California limits

Each panel is judged against an "action level," the threshold California defines as the value that decides whether a sample passes or fails. Here is what each panel checks in California and how strict it is:

Three things stand out:

• Inhaled products face stricter heavy-metal and microbial rules than edibles or topicals.
• A single failed panel is enough: in California, a failing sample means the whole batch cannot be released for retail sale.
• Units matter. Heavy metals and most pesticides are reported in µg/g (micrograms per gram, the same as parts per million), while mycotoxins use µg/kg (parts per billion), a thousand times smaller.

How to match a COA to the product in your hand: seven checks

1. Find the batch or lot number on the package
   Then find the same number on the COA. If they differ, the report is not about your product.
2. Check the producer
   The cultivator or manufacturer on the COA should be the company named on your label.
3. Check the dates
   Sample collection should come before the product's packaging or sale date, not after.
4. Look at the photo
   It should show the same product type and, for pre-packaged goods, the same packaging.
5. Verify the lab
   Look up the lab's license number, printed on the COA, in the state regulator's license search.
6. Read every pass/fail line
   Potency is only half the story. Make sure each safety panel passed.
7. Compare potency to the label
   A difference of more than about 10% is worth a question to the retailer.

Why potency numbers deserve skepticism: labels ran 23.1% high in a Colorado study

A COA is a measurement of one sample, and the incentives around high THC numbers are strong. In a peer-reviewed study published in PLOS ONE in 2023, researchers bought 23 flower samples from 10 dispensaries on Colorado's Front Range and had them retested.

The authors pointed to "lab shopping," where producers choose labs that report higher numbers, as one likely factor. The study was small, but it is a good reason to treat very high potency claims with caution and to value consistent, verifiable COAs over record-breaking ones. It also explains why Verdex's methodology looks at how sellers handle lab data rather than taking THC figures at face value.

An illustrative COA summary, line by line

The table below is illustrative only. It is not a real product or a real lab result; it shows how the numbers on a typical flower COA fit together.

For how terpene figures on a COA relate to aroma and effects, see our terpene guides, and browse lab-reported ranges on our strain pages.