How to Read a Certificate of Analysis (COA)

Every quality THCa flower bag, vape cartridge, and hemp gummy sold in the US should come with a COA — a Certificate of Analysis from an independent laboratory. Most buyers either skip it entirely or open it, stare at a wall of numbers and abbreviations, and close the tab. This guide changes that. By the end, you'll be able to read any THCa COA in under two minutes and know exactly whether a product is worth your money — and safe to consume.

Quick Answer: A Certificate of Analysis (COA) is a third-party lab report that verifies what's actually in a hemp product — the cannabinoid percentages, terpene profile, and whether it passed safety testing for pesticides, heavy metals, mold, and more. It's the only objective evidence that a product contains what its label claims and nothing harmful it doesn't mention. If a brand can't show you one, don't buy from them.

Why You Should Actually Read COAs

The US hemp market is largely self-regulated at the retail level. Unlike state-licensed dispensary products, which must pass mandatory regulatory testing before hitting shelves, hemp products sold online don't face the same standardized federal oversight. A JAMA study that analyzed commercially available hemp products found a significant percentage were mislabeled — some overstating cannabinoid content, some containing unmentioned compounds.

A real COA from an accredited independent lab is the only tool you have to verify what you're actually buying. The marketing on the bag means nothing. The potency claim on the website means nothing. The COA is the evidence — it can't be changed, and it's independently issued.

Section 1: The Header — Who Tested It and When

The top of every legitimate COA tells you the most important contextual information about the report. Here's what to look for:

• Laboratory name and contact information. The lab that conducted the testing should be clearly identified with their full name, address, and ideally a website you can look up to verify they're a real, operating laboratory.
• ISO/IEC 17025 accreditation number. This is the gold standard for analytical testing labs in the US. ISO 17025 means the lab has been independently audited and certified to international quality standards. It should be listed directly on the COA. If there's no accreditation listed — or you can't verify it — treat that as a serious red flag.
• Client/brand name. The company that commissioned the testing — this should match the brand you're buying from.
• Product name and batch/lot number. The COA is batch-specific. The batch number on the COA must match the batch number on the product packaging you received. If they don't match, the COA doesn't apply to your product.
• Sample date and report date. When was the sample collected and when was the analysis completed? For flower, look for a test date within the last 6–12 months. A COA from two years ago doesn't tell you much about the product currently in stock.

Quick check: Before reading anything else, confirm the batch number on the COA matches your product, and confirm the test date is recent. These two checks alone will catch the most common COA problems buyers encounter.

Section 2: The Cannabinoid Potency Panel — Potency and Compliance

This is the section most buyers look at first. It lists every cannabinoid detected in the sample and its concentration, expressed as a percentage of dry weight. Here's how to read the numbers that matter most for THCa products:

THCa %

The raw, unactivated THCa content of the product. For flower and vapes, this is your primary potency indicator — it tells you the maximum amount of active THC the product can produce when smoked or vaped. To estimate equivalent active THC, multiply the THCa% by 0.877 (this accounts for the molecular weight lost when the carboxyl group breaks off during decarboxylation).

Example: A flower listed at 26% THCa delivers approximately 22.8% equivalent active THC when smoked — highly potent.

Delta-9 THC %

This is the compliance number. Under the 2018 Farm Bill, any hemp product sold in the US must contain 0.3% or less delta-9 THC by dry weight to be federally legal. This is the number that determines whether the product can legally be sold and shipped. It must show ≤0.3%. No exceptions.

If you see delta-9 THC above 0.3% on a COA — the product is not legally compliant hemp. Do not buy it.

Total THC

Many COAs calculate Total THC using the USDA formula: (THCa × 0.877) + Delta-9 THC = Total THC. This projects the maximum amount of active THC the product could produce post-decarboxylation. Some states apply this total figure to their own compliance assessments rather than just raw delta-9 — so if you're in a state with stricter hemp regulations, this number may be relevant to your legal situation.

Minor cannabinoids

You'll often see small amounts of CBD, CBG, CBN, and CBC listed. These are minor cannabinoids that contribute to the entourage effect. Their presence in a whole-flower product is a positive sign — it indicates the product is genuinely full-spectrum rather than a stripped concentrate. Don't worry too much about their exact percentages; just note that they're there.

Reading	What it means	Good / Bad?
THCa: 25%	High potency — ~21.9% active THC when smoked	✓ Good
Delta-9 THC: 0.18%	Well within 0.3% federal limit — compliant	✓ Good
Delta-9 THC: 0.45%	Above 0.3% federal limit — not compliant hemp	✗ Red flag
CBD, CBG, CBN present	Full-spectrum — entourage effect compounds present	✓ Good sign

Section 3: Terpene Panel — Flavor and Effect Prediction

Not every COA includes terpene testing, but the best ones do. The terpene panel lists each detected terpene and its concentration, usually expressed as a percentage of total weight.

This section is more useful than most buyers realize. Terpene content tells you two things: how the product will smell and taste, and — more importantly — what direction the effects will lean. A terpene panel dominated by myrcene points toward sedating, body-heavy effects. One heavy in limonene and pinene trends uplifting and clear-headed.

A total terpene content of 1–3%+ generally indicates a fresh, well-preserved flower with a rich aromatic profile. Very low or absent terpene content on a flower COA can signal improperly stored or aged product — even if the THCa number still looks good.

Section 4: Safety Testing — The Section That Actually Protects You

This is the section most buyers skip — and it's the most important one for your health. Every result in this section should show PASS. Here's what each category covers:

Pesticides

Hemp is an excellent absorber of whatever is in its growing environment, including agricultural chemicals. The pesticide panel tests for dozens of specific compounds — each with an established safe limit — and confirms they are either not detected or below those limits. A PASS here means the product is free of harmful pesticide residues at detectable levels.

Heavy metals

Lead, mercury, arsenic, and cadmium can be absorbed from contaminated soil or water into the plant. At elevated concentrations, these are toxic. A heavy metal panel should show all four major metals at or below established safety thresholds. This test is particularly important for products grown in unknown or unverified soil conditions.

Residual solvents

Most relevant for vape cartridges and extracts. Chemical solvents are sometimes used during extraction. If not fully purged, they can remain in the final product. The panel should confirm all solvents are below safe limits — ideally not detected at all. For vape products especially, never buy without solvent testing results.

Microbial contaminants

Tests for mold, yeast, E. coli, Salmonella, and other bacteria. Hemp is an agricultural product that can harbor microbial growth if improperly dried, cured, or stored. A PASS confirms the product is free of organisms at levels that pose a health risk.

Mycotoxins

Toxins produced by certain molds — particularly dangerous when inhaled. Should be not detected or below limits on any legitimate COA for smokable or vapeable products.

Moisture content and water activity (flower only)

Some COAs for flower include moisture percentage and water activity (Aw). Flower moisture should be roughly 6–13%. Water activity should be below 0.65 to prevent mold growth. These numbers tell you whether the product was properly dried and will burn cleanly.

How to Spot a Fake or Problematic COA

Not every COA you encounter is legitimate or current. These are the red flags that should stop you from buying:

• No accredited lab identified. Any COA without a named, verifiable ISO 17025-accredited lab is unverified. Walk away.
• Old test date. A COA from 18+ months ago doesn't reflect the current product. Look for tests within the last 6 months for flower.
• No batch or lot number. Without this, you can't confirm the COA applies to the product you received.
• Potency-only testing with no safety panels. A COA that only shows cannabinoid percentages but no pesticide, heavy metal, or microbial results is incomplete. This is a common shortcut taken by low-quality brands.
• Any test showing FAIL. A single failed safety test means the product should not be sold or consumed. No exceptions.
• Delta-9 THC above 0.3%. Not compliant hemp — regardless of what the label says.
• THCa% significantly different from what was advertised. If a product is marketed as 28% THCa and the COA shows 14%, that's a major mislabeling issue.

How Canapuff Makes COA Access Simple

Every Canapuff THCa product — flower, vapes, liquid, and gummies — is tested by accredited independent third-party laboratories. COAs are available directly on product pages, batch-specific, and current. When your order arrives, the batch number on the packaging should match the COA accessible on the product page. If you ever have a question about a specific batch's lab results, Canapuff's customer support team is available to help.

Your 60-Second COA Checklist

1. ✓ Is there a named, ISO 17025-accredited lab on the document?
2. ✓ Does the batch number match your product?
3. ✓ Is the test date recent (within the last 6–12 months)?
4. ✓ Is delta-9 THC at or below 0.3%?
5. ✓ Does the THCa% match what was advertised (within ~10%)?
6. ✓ Are there terpene results? (bonus — not always required)
7. ✓ Do pesticide, heavy metal, microbial, and solvent panels all show PASS?
8. ✓ Is there any FAIL result anywhere on the document? (if yes — stop)

If all eight check out, you're holding a verified, safe, compliant hemp product. That's what a legitimate COA looks like — and now you know how to read one.

Frequently Asked Questions

Do all hemp products legally require a COA?

Federal law does not mandate COAs for all hemp retail products in the same way state-licensed cannabis dispensaries are required to provide them. However, federal hemp compliance (specifically the 0.3% delta-9 THC limit) must be verifiable — and a third-party COA is the standard method of demonstrating that compliance. Reputable brands provide COAs voluntarily as a transparency commitment, not just a legal obligation.

What's the difference between HPLC and GC testing methods on a COA?

HPLC (High-Performance Liquid Chromatography) is the preferred method for cannabinoid testing because it doesn't use heat — so it measures THCa and THC separately, giving you the complete, accurate picture. GC (Gas Chromatography) uses heat during analysis, which converts THCa to THC before measurement, meaning it can only report THC — not the THCa content. For THCa flower specifically, you want a COA generated via HPLC.

Can I verify that a lab result is real?

Yes. Most accredited testing labs publish their credentials publicly and have verifiable websites. You can look up the lab by name, confirm their accreditation status, and even contact them directly to verify a COA's authenticity if you have the batch number. Reputable labs like ACS Laboratory, ProVerde, Confident Cannabis, and others are easy to verify this way.

What does "<LOQ" mean on a COA?

LOQ stands for Limit of Quantification — the smallest concentration the lab can accurately measure. "<LOQ" means the compound is present at such a trace level that it falls below what the lab can precisely quantify. For safety tests (pesticides, heavy metals), a "<LOQ" result is essentially a PASS — the amount detected is below the threshold of meaningful measurement.

This article is for general informational purposes only and does not constitute legal or medical advice. All Canapuff hemp products contain less than 0.3% delta-9 THC and are tested by accredited third-party laboratories. These statements have not been evaluated by the Food and Drug Administration. This product is not intended to diagnose, treat, cure, or prevent any disease.