What Is a Certificate of Analysis (COA)?

A certificate of analysis is a lab report proving what's actually in your product — not what the label claims, what an independent lab measured. If you sell hemp, CBD, or any consumable product, customers and regulators both expect one to exist.

What it actually is

A COA is issued by a third-party testing lab — not you, not your manufacturer — after they run a physical sample of a specific production batch through their equipment. It reports back hard numbers: what compounds are present, how much, and whether anything unwanted (contaminants, pesticides, heavy metals) showed up.

The key word is independent. A COA only means something if the lab has no stake in the result. That's why reputable labs carry accreditation — most commonly ISO/IEC 17025, the standard for testing lab competence.

What's actually on one

A real COA typically includes:

• Batch or lot number — ties the results to one specific production run, not "the product in general"
• Test date — how recent the results are
• Cannabinoid profile — the percentage of each compound tested (THC, CBD, and others, depending on the product)
• Contaminant screening — pesticides, heavy metals, residual solvents, microbials — whatever's relevant to the product type
• The lab's name, accreditation, and signature — so the result is traceable and accountable

How to actually read one

Most COAs look intimidating — tables of compound names and decimal percentages — but reading one comes down to four checks, in order:

1. Match the batch number to the package. If they don't match, stop — the report doesn't describe the product in hand, whatever else it says.
2. Find the potency table and compare it to the label claim. A product labeled 1000mg CBD should test in that neighborhood — labs and regulators generally tolerate roughly ±10%. Way under is short-changing; way over can be its own compliance problem (for hemp, total THC must stay under the 0.3% federal line).
3. Scan the contaminant panels for "PASS" — and for "ND." "ND" means "not detected," which is what you want to see next to pesticides, heavy metals, and microbials. "<LOQ" (below the limit of quantitation) means a trace too small to measure — also fine. An actual number in those panels deserves a closer look against the listed limit.
4. Check the lab, the date, and the signature. An accredited lab's name you can Google, a test date in the recent past (not three years ago), and an analyst's signature or lab ID. No lab name, no date, no accountability — no COA.

Red flags on a COA (or the lack of one)

• No batch number, or one that matches nothing on the package. The single most common tell of a "decorative" COA.
• A COA hosted only as a group photo of many products, or one PDF recycled across every SKU in a store — real testing is per-batch.
• Potency only, no contaminants. A potency-only printout is cheaper to obtain and skips the panels customers actually worry about.
• The lab doesn't exist — or exists but is owned by the brand. Independence is the entire point.
• A dead link. If the label's QR code or URL opens nothing, regulators treat that the same as having no COA at all — and buyers assume the worst.

Why customers actually check

Hemp and CBD buyers have been burned by mislabeled products before — bottles claiming 1000mg that test at a fraction of that, or worse, contamination that never should have shipped. A visible, per-batch COA is how a buyer tells a serious brand from one cutting corners. It's also, increasingly, the law: several states now require the label to link straight to it — see our state-by-state rundown, and it's the norm in kratom and supplements too.