Certificate of Analysis

The independent lab report for a specific production batch, showing what is actually in the bottle rather than what the label claims.

HempMy Pet tincture bottle on a laboratory bench beside sample vials and a pipette

Certificate of Analysis: How to Read a Hemp COA

A certificate of analysis, or COA, is the lab report for a specific batch of product. It is the only document that tells you what is actually in the bottle rather than what the label claims.

In a category with a documented mislabelling problem, knowing how to read one is the single most useful skill a hemp buyer can have. Here is what a real COA contains and what the red flags look like.

What Is a Certificate of Analysis?

A COA is issued by an analytical laboratory that tested a sample from one production batch. It reports what the lab measured, by what method, and whether each result passed the applicable limit.

The words "third-party" matter: the lab should be independent of the company selling the product. An in-house report from the manufacturer's own lab is not the same assurance.

What ISO 17025 Accreditation Actually Means

ISO/IEC 17025 is the international standard for testing laboratories, and accreditation to it means an independent body has assessed the lab and judged it technically competent to produce valid results. You can read the standard's scope at ISO.

Two details most articles miss. First, accreditation is not the same as certification — certification checks that documented procedures exist, while accreditation assesses technical competence, including proficiency testing and an on-site assessment. Second, accreditation is granted for a specific scope: a defined list of tests. A lab accredited for potency is not automatically accredited for heavy metals. Accreditation bodies publish searchable directories, and A2LA explains the distinction well.

A lab advertising ISO 9001 alone is a warning sign — that is a manufacturing quality-management standard, not a measure of analytical competence.

What a Complete COA Contains

The header should name the lab and its contact details, a sample ID, the batch or lot number, the date the sample was tested, the date the report was issued, the product name, and who submitted the sample.

The cannabinoid potency panel lists each cannabinoid measured — CBD, CBG, CBC, CBDV, CBN and THC — usually with both delta-9 THC and total THC, since total THC accounts for the acid form converting on heating. This panel is also how you tell full-spectrum from isolate: several cannabinoids present means full-spectrum, CBD alone means isolate.

Then the safety panels: pesticides, heavy metals, residual solvents, microbials and mycotoxins. A COA showing potency only is an incomplete picture.

Reading the Numbers

LOD is the limit of detection — the smallest amount the method can detect at all. LOQ is the limit of quantitation — the smallest amount it can measure reliably. "ND" means not detected, which means below the LOD rather than mathematically zero.

Results are reported against an action limit with a pass or fail. A report that says only "pass" with no numbers is not telling you much.

Match the Batch to the Bottle

This is the step almost nobody takes. Find the batch or lot number printed on the product in your hand, then confirm it matches the batch on the COA. A COA for a different batch tells you about a different production run.

If a company publishes one COA for an entire product line, or a report dated years before the bottle was made, that is worth questioning.

Why This Matters More Than It Should

Independent testing has repeatedly found label inaccuracy across this category. A 2017 analysis in JAMA of 84 products found roughly a quarter over-labelled and about 40% under-labelled, with only around 30% falling within 10% of the stated amount.

The pet-specific figures are worse. A 2020 analysis of 29 over-the-counter veterinary hemp products, published in Veterinary Medicine: Research and Reports and available in full here, found only 10 of the 29 within 90–110% of label claim, two with no detectable cannabinoids at all, and lead in three of them. Every product was under the 0.3% THC limit, but potency was a lottery.

That study is the reason we publish a COA for every batch rather than a representative one.

The Five Safety Panels, and What Each One Catches

Potency tells you what you are paying for. The safety panels tell you what you are not supposed to be getting.

Pesticides. Hemp is a bioaccumulator — it pulls compounds out of the soil it grows in, which is why the farming behind the plant matters as much as the lab report afterwards. This panel screens for residues carried through from the field.

Heavy metals. Lead, arsenic, cadmium and mercury, for the same reason. Soil quality shows up here in black and white.

Residual solvents. If an extract was made using butane, propane or ethanol, this confirms none of it stayed behind in the finished oil.

Microbials. Yeast, mould, E. coli and salmonella — contamination introduced during drying, handling or storage.

Mycotoxins. Aflatoxins and ochratoxin, produced by moulds. This is a separate test from the microbial count, because the mould itself can be gone while the toxin it produced remains.

A COA showing potency alone tells you nothing about any of these five.

Reading the Potency Table

Cannabinoid results are normally reported two ways: as a percentage by weight, and as milligrams per gram or per millilitre. To sanity-check a bottle, multiply the mg/mL figure by the bottle volume and compare it against the total on the label.

Watch the acid forms. CBDA and THCA convert to CBD and THC when heated, so a lab reports both the raw figure and a "total". Total THC is the number that determines legal compliance, and it is normally calculated as delta-9 THC plus 0.877 times the THCA.

If a label says 1000mg and the arithmetic on the COA lands materially short, you have your answer about that brand.

How to Check a Lab's Accreditation Yourself

Accreditation bodies publish searchable public directories. Find the lab named on your COA, open its scope of accreditation, and confirm that the specific tests on your report — cannabinoid potency, heavy metals, pesticides — actually appear on that scope.

It takes about two minutes and it is the check almost nobody performs. A lab can be genuinely accredited for one method and not for the others printed on the same page.

Red Flags

No batch number, or one that does not match the product. A potency-only panel with no contaminant testing. A lab owned by or affiliated with the manufacturer. No accreditation, or ISO 9001 quoted instead of ISO 17025. An undated report, or one older than the batch. Missing LOD and LOQ columns. Results given as "pass" with no measured values.

You can see ours alongside the products at CBD Hemp for Dogs, CBD Hemp for Cats and CBD Hemp for Horses.

Frequently Asked Questions

What is a COA in hemp and CBD? A certificate of analysis — the independent laboratory report for one specific production batch, showing cannabinoid content and contaminant testing.

How can I tell if a certificate of analysis is legitimate? Check that the lab is independent and ISO 17025 accredited for the tests shown, that the batch number matches your product, that the report is dated and recent, and that it includes contaminant panels with actual numbers rather than a bare "pass".

How do I get a certificate of analysis? As a buyer, from the brand — reputable companies publish them per batch, often behind a QR code on the packaging. If you have to ask twice, that is an answer.

How much does COA testing cost? That is a manufacturer's cost, not a consumer one, and it varies by how many panels are run. A full panel across potency, pesticides, heavy metals, solvents and microbials costs meaningfully more than potency alone — which is part of why some brands publish potency only.

What does ND mean on a lab report? Not detected — below the method's limit of detection.

What is the difference between LOD and LOQ? LOD is the smallest amount the method can detect; LOQ is the smallest it can measure reliably. A result between the two is present but not precisely quantifiable.

Why does a COA list delta-9 THC and total THC separately? Because the acid form converts to THC when heated. Total THC accounts for that conversion, and it is the figure that determines legal compliance.

Are COAs legally required? Requirements vary by state and product category, and there is no single federal mandate for hemp supplements. Treat a published COA as a sign of how a company operates rather than as proof it was forced to.