Quick Answer: A hemp Certificate of Analysis (COA) is a third-party lab report that verifies a hemp product’s potency, composition, and quality testing results. Retailers should read it to confirm ISO 17025 accreditation, match batch numbers, review required testing panels, and ensure the document is current, typically within 12 months, before stocking a single unit.
Every week, retail buyers at smoke shops, dispensaries, and CBD stores get pitched by suppliers presenting lab reports like winning lottery tickets. The problem is, many of those PDFs are pulled from a folder, not pulled from a real test on the batch sitting in the warehouse. Knowing how to read a Certificate of Analysis is the difference between stocking shelves with confidence and stocking them with a future inventory problem.
This guide is built for the retail buyer, not the individual shopper. It walks through the anatomy of a real COA, explains what ISO 17025 means, shows the red flags that may signal a questionable document, and covers how Section 781, effective November 12, 2026, changes what you need to verify on every report from here on out.
🔑 Key Takeaways
- A Certificate of Analysis, or COA, is a third-party lab report that tests and confirms cannabinoid potency, terpene data, and required quality testing results.
- ISO 17025 accreditation is the single most important credibility signal on any COA.
- COA expectations differ by product type: vapes need residual solvent testing, flower needs microbial testing, and edibles need serving consistency checks.
- Six red flags, including old dates, mismatched batch numbers, missing accreditation, and copy-paste letterheads, may reveal a questionable COA.
- After November 12, 2026, COAs must reflect total THC and screen for synthetic conversion markers where applicable.
Why Retailers Need to Read COAs Differently Than Consumers
A shopper reads a COA to decide whether to buy one jar of gummies. A retailer reads a COA to decide whether to commit a purchase order that lands on hundreds or thousands of shelves. The stakes, and the questions, are completely different.
When a retail buyer opens a lab report, they are really asking four things. Is this batch consistent with the last shipment I bought from this supplier? Is the testing lab credible enough that I can defend this product to a regulator, an insurance underwriter, or a curious customer? Does the document prove what the sales rep claimed in the pitch deck? And if a state inspector walks in tomorrow, will this COA hold up?
Consumer-facing COA guides often treat the document as a trust badge. Retailers need to treat it as evidence, because that is exactly what it becomes the moment something goes wrong with a product on your shelf.
The 7 Sections of Every COA
Almost every legitimate lab report follows the same structure. Once you know the seven sections, you can scan a new COA in under two minutes and know whether it deserves a closer look or a hard pass.
2.1 Product and Sample Information
The top of the document should clearly identify the product name, the batch number, the lot number, the sample collection date, and the manufacturing date. These five data points are how you tie the paper to the physical product in front of you. If the batch number on the COA does not match the batch number printed on the bag, jar, or carton, the report is not useful for that inventory, no matter how clean the test results look.
2.2 Lab Identification and Accreditation
This section names the testing facility, its address, its license number, and, critically, its accreditation marks. You are looking for ISO/IEC 17025 accreditation from a recognized body like A2LA or PJLA. Third-party testing matters here because in-house labs have an obvious conflict of interest. The supplier should not be grading their own homework.
License numbers are publicly verifiable in most states. If a lab claims to be licensed in Florida, California, or Colorado, you can search the state regulator’s database in about thirty seconds.
2.3 Cannabinoid Profile
This is the potency breakdown: Delta-9 THC, Delta-8, CBD, CBG, CBN, and other cannabinoids, usually reported in both percentage and mg/g or mg/unit. You will also see three abbreviations that confuse a lot of new buyers.
- ND means “not detected,” meaning the compound was not found above the detection threshold.
- LOD is the Limit of Detection, or the lowest amount the instrument can sense.
- LOQ is the Limit of Quantitation, or the lowest amount the instrument can reliably measure.
Pay close attention to total THC versus Delta-9 THC. Under the 2018 Farm Bill, hemp is defined by Delta-9 THC at or below 0.3% on a dry-weight basis. That equation is about to change. More on that below.
2.4 Terpene Profile
Not every COA includes terpenes, but the better ones do. Terpenes are aromatic compounds that influence flavor and aroma. For a retailer, a terpene panel is also a quality assurance signal: it suggests the supplier is investing in optional testing rather than only the bare regulatory minimum.
2.5 Quality Testing Panels
This is where COAs include the data that helps retailers review product quality and compliance. A complete testing section may address heavy metals, pesticides, residual solvents, microbials, mycotoxins, and, for some categories, foreign matter.
The COA’s metals and pesticides results should list each specific test analyte alongside its action limit and the measured value. Heavy metal limits typically focus on the “big four”: lead, mercury, cadmium, and arsenic. Residual solvent testing is non-negotiable for any product derived from isomerization or hydrocarbon extraction, including many Delta-8 and concentrates. Microbial and mycotoxin testing is particularly important for flower and pre-rolls, where storage and handling conditions can affect product quality.
| Testing Category | Why Retailers Review It | Common Action Limits |
| Heavy Metals (Pb, Hg, Cd, As) | Soil uptake and regulatory requirements | 0.5 to 2.0 ppm depending on metal and state |
| Pesticides | Crop protection residue | Varies by analyte; often <0.1 ppm |
| Residual Solvents | Extraction byproducts | Ethanol <5,000 ppm; hexane <60 ppm |
| Microbials | Yeast, mold, E. coli, Salmonella | Often “not detected” in 1g |
| Mycotoxins | Compounds associated with mold growth | Aflatoxins <20 ppb total |
2.6 Pass/Fail Markers
In regulated markets, each analyte gets a pass/fail designation against state action limits. “ND” in a testing row is generally the result retailers prefer to see. It means the compound was not detected at or above the LOQ. An overall “Pass” does not mean the product contains none of the tested substances; it means the measured values are below the applicable regulatory threshold.
2.7 Verification and Signoff
The bottom of a credible COA includes a lab director signature or authorized reviewer signature, full lab contact information, and increasingly, QR codes that link back to the original report hosted on the lab’s domain. Scan the QR code. If it does not resolve to the testing lab’s actual website, that is a problem.
How COA Expectations Differ by Product Type
A common mistake among new retail buyers is treating every COA the same. The reality is that each product category has its own testing priorities, and a COA missing the right panels for the product type is functionally incomplete.
| Product Type | Must-Have Panels | Why |
| Flower & Pre-Rolls | Cannabinoids, terpenes, microbials, mycotoxins, pesticides, heavy metals | Plant material requires careful quality review |
| Vape Carts | Cannabinoids, residual solvents, heavy metals, pesticides | Hardware and extraction-related factors |
| Edibles & Gummies | Cannabinoids, serving consistency, microbials, heavy metals | Consistency across units |
| Tinctures | Cannabinoids, residual solvents, heavy metals, pesticides | Carrier oil and ingredient quality |
| Concentrates | Cannabinoids, residual solvents, isomerization byproducts | Conversion-process review |
If a vape COA shows no residual solvent data, walk away. If an edible COA shows no serving consistency result, sometimes labeled “uniformity of serving units,” you do not actually know whether the stated amount per gummy is consistent across the bag.
📦 For Retailers Vetting New Suppliers
Most COA guides teach you to read the document. This guide teaches you to evaluate the document, the lab behind it, and whether it actually proves what the supplier claims. That distinction is what separates a confident retail buyer from one who has been burned.
ISO 17025 and Why It Matters More Than the Lab’s Name
ISO/IEC 17025 is the international accreditation standard for testing and calibration laboratories. In plain English, it is the rulebook that says a lab follows documented procedures, calibrates its instruments on schedule, runs proficiency tests, and produces results that can be trusted across jurisdictions.
A lab without ISO 17025 is not necessarily a bad lab, but it is not held to the same verifiable industry standards by an outside body. That is a meaningful gap. Two labs can test the same sample and report different numbers if one is using validated methods and the other is improvising.
For a retail buyer, the practical takeaway is simple. Treat ISO 17025 the way a restaurant treats an inspection grade. It is not the whole story, but it is the floor. Any COA that does not show the accreditation mark, with the certificate number visible, deserves a follow-up email before you place an order. Reputable suppliers expect that question and answer it quickly.
6 Red Flags That Signal a Fake or Unreliable COA
Fraudulent lab reports circulate constantly in the hemp wholesale market. Some are crude, like a different product’s COA with a new logo pasted on. Others are sophisticated, using real lab letterhead, real format, and fabricated numbers. Here are the signals to watch for.
- Report date older than 12 months. A two-year-old COA tells you little about the batch you are about to buy.
- Batch number on the COA does not match the product. This is the most common giveaway. Always cross-check.
- No ISO 17025 accreditation mark or certificate number. A credible lab displays this prominently.
- Missing quality testing panels for the product category. A vape COA with no residual solvents, or a flower COA with no microbial testing, is incomplete.
- Copy-paste lab letterhead with formatting inconsistencies. Look for mismatched fonts, misaligned tables, or a logo that does not match the lab’s current branding on its website.
- QR code that does not resolve, or links to a PDF on the supplier’s server instead of the lab’s. A real verification QR code points to the lab’s domain, not the brand’s.
Any one of these is a reason to pause. Two or more, and you should assume the document is unreliable until proven otherwise.
How the New Hemp Law Changes COA Reading
Section 781 of the federal appropriations package takes effect November 12, 2026, and it materially changes how hemp products are defined. The headline shift: hemp will be measured by total THC, not just Delta-9 THC. Total THC accounts for converting to Delta-9 when heated, which means a flower that passed the old 0.3% Delta-9 test could fail the new total THC threshold.
Practically, that means retailers should already be asking suppliers for COAs that report total THC explicitly, a 2026 COA only shows Delta-9 in isolation, it is not future-proof.
The new law also increases scrutiny on synthetically derived cannabinoids. COAs should screen for synthetic conversion markers and isomerization byproducts, particularly for Delta-8 and other products. Retailers stocking these categories should ask their suppliers, in writing, whether their lab’s methods include the relevant byproduct panel. State laws vary, this is not legal advice, and the regulatory landscape will continue to shift, so build supplier relationships that can adapt with you.
The 7-Point COA Checklist for Retailers
Before any new SKU enters your purchase order, run the report through these seven checks. It takes about three minutes per COA once you have done it a dozen times.
- Batch number and lot number match the product physically in hand.
- Manufacturing date and report date are both within the last 12 months.
- Lab shows current ISO 17025 accreditation with a verifiable certificate number.
- Cannabinoid profile matches the label claim within reasonable tolerance, such as ±10%.
- All quality testing panels appropriate to the product type are present and passing.
- Total THC is reported, not just Delta-9, especially for any product produced after November 2026.
- QR code or hyperlink resolves to the report on the lab’s own domain.
If a COA passes all seven, you have completed a strong review step. If it fails any one, ask the supplier for clarification before committing inventory dollars.
Conclusion
COAs serve as one of the most important compliance and quality documents in the hemp wholesale supply chain. Reading them well helps retailers avoid compliance problems, noncompliant inventory, and the reputation damage that follows a bad batch on the shelf. Now that you know how to read a Certificate of Analysis, sourcing decisions become quicker, more transparent, and easier to defend when a regulator or a customer asks a hard question.
The retailers who win the next two years will be the ones who treat lab reports as evidence, not paperwork.
🎯 See What a Real COA Looks Like
Every product in the THD Wholesale catalog ships with a current, third-party, ISO 17025 lab report. Browse our published COAs or apply for a wholesale account to start sourcing transparently.
View Lab Results | Apply to Become a Wholesaler
