How to Read a CBD Certificate of Analysis (COA)

A Certificate of Analysis, or COA, is the lab document that tells you what is actually in a hemp or CBD product. If you sell CBD on Shopify, reading one is a core skill: it is how you verify cannabinoid content, confirm a product is under the legal THC limit, and prove to a customer that the unit they hold was tested. Good cbd testing produces a COA you can read line by line, and this guide walks each field so you can do exactly that.

A COA is not a marketing certificate. It is a measurement report from an analytical lab, ideally one with ISO/IEC 17025 accreditation. The layout differs between labs, but the same blocks of information show up on almost every report.

The header block: what you are looking at

Start at the top. The header identifies the sample and tells you whether the document is even relevant to the product in your hand.

• Sample ID: the lab's internal tracking number for the specimen they tested.
• Batch or lot number: the manufacturer's production code. This is the most important matching field. The number printed on the package label must equal the number on the COA.
• Product name and matrix: the product (for example "Full Spectrum CBD Tincture 1000mg") and its physical form, such as oil, gummy, or flower. The matrix affects which methods and units apply.
• Date received and date tested: when the lab got the sample and when it ran the analysis. A COA from two years ago does not describe the batch you are shipping today.
• Lab name and accreditation: the testing facility and its credentials. ISO/IEC 17025 is the accreditation that signals the lab is competent to produce defensible results. If you see it, note the scope, because a lab can be accredited for potency but not for heavy metals.
• Methods: the analytical techniques used, often listed per test. Potency is typically run by HPLC. Heavy metals by ICP-MS. Residual solvents by GC. Naming the method is a sign of a serious report.

If the header is vague, has no batch number, or names no lab, treat the whole document with suspicion. For a deeper look at every section a reputable lab runs, see what a hemp COA tests for.

The cannabinoid potency table

This is the section most buyers go straight to. It reports how much of each cannabinoid the lab measured. Results usually appear as percent by weight (% w/w) and as milligrams per unit or per gram. Here is a small, realistic example for a 30 mL tincture labeled 1000 mg CBD:

A few things to read from a table like this. First, confirm the CBD figure roughly matches the label claim. Here the mg/unit for CBD is 1025, close to the 1000 mg on the package, which is a pass. A product that claims 1000 mg and tests at 400 mg is mislabeled.

Second, understand the two "total" rows, because they are calculated, not measured directly.

How total THC is calculated

Raw hemp contains mostly THCA, the acidic form, which is not intoxicating until heat converts it to delta-9 THC. That conversion is called decarboxylation, and it loses some molecular weight. Labs account for it with this formula:

Total THC = delta-9 THC + (THCA x 0.877)

The same logic produces total CBD from CBD and CBDA. The 0.877 factor is the ratio of the neutral cannabinoid's molecular weight to the acidic form's. In the table above, total THC of 0.030% comes from 0.021 + (0.010 x 0.877), which rounds to roughly 0.030%.

This math is no longer just academic. The 2018 Farm Bill capped only delta-9 THC at 0.3% on a dry-weight basis, which is why an isomer "loophole" emerged. H.R. 5371, enacted on November 12, 2025, redefines hemp using total THC at the same 0.3% threshold and excludes any finished product carrying more than 0.4 mg of total THC per container. It is law now but takes effect November 12, 2026. Practically, brands should expect to re-test against total THC and confirm the figure on the COA, not just the delta-9 row. The detail of that change is covered in our hub on hemp and CBD lab testing compliance.

LOD and LOQ: the numbers below the numbers

Two abbreviations sit near every result column, and they define how small a number the lab can trust.

• LOD (limit of detection): the lowest concentration the instrument can reliably tell apart from zero. Below this, the lab reports ND, meaning not detected.
• LOQ (limit of quantitation): the lowest concentration the lab can report as a precise number. Between LOD and LOQ, a compound is present but not measurable accurately, so you see <LOQ (less than LOQ).

So "ND" does not mean a substance is provably absent at zero. It means it fell below what the method can see. A lower LOD and LOQ means a more sensitive test, which matters most on the contaminant panels, where you want detection limits well under any action level.

Pass or fail: reading the contaminant panels

A full-panel COA goes well past potency. Each contaminant section should carry a pass or fail status per analyte, judged against an action limit. You do not need to memorize every limit. You need to scan the status column and stop on anything that is not a pass.

The panels you will see:

• Heavy metals: lead, arsenic, cadmium, and mercury are the big four. Hemp is a hyperaccumulator, meaning the plant draws metals out of the soil it grows in, so this panel earns real attention. Our guide to hemp heavy metal testing explains the limits and why they vary.
• Pesticides: screened by LC-MS/MS, typically a long list of compounds each with its own limit.
• Microbials: yeast and mold counts, plus pathogens like E. coli and Salmonella.
• Residual solvents: leftover extraction solvents such as ethanol, butane, or hexane, run by gas chromatography.
• Mycotoxins, moisture and water activity, and foreign matter: rounding out a complete report.

A "full panel" means all of the above. A "potency only" COA reports cannabinoids and nothing else, which is fine for a quick potency check but does not tell a customer the product is clean. The instruments behind these results, and why a lab uses different columns for different tests, are explained in hemp testing columns explained.

Confirm the COA matches the batch in hand

A COA is only meaningful for the exact batch it describes. Before you trust any result, run three checks:

1. Batch or lot number: the code on the package label must match the code on the COA, character for character. This is the single most common failure, and it is the one customers can verify themselves.
2. Product name: the COA should name the same product, not a similar SKU.
3. Test date: recent enough to represent the current batch. Each new production run needs its own COA, since potency and contaminants change batch to batch.

When all three line up, the COA is doing its job. When the batch number does not match, the document is irrelevant no matter how clean the numbers look.

Make the right COA easy to find

Reading a COA is one thing. Letting a customer read the correct one at the moment of purchase is another, and it is where most stores fall short. The COA should be the one that matches the batch on the shelf, and it should update when you produce a new run.

That batch-to-product link is the practical problem LabLinks solves. You upload the COA as a PDF or image, enter the batch or lot number, test date, lab name, and status, then attach it to the matching Shopify product. A theme app block shows a lab-tested badge that opens the report in an on-page viewer, and a searchable portal lets shoppers find a result by product or batch number. If you are wiring this up, the walkthrough on how to add COAs to Shopify product pages covers the publishing step end to end.

A quick read-the-COA checklist

• Header names a real lab with ISO/IEC 17025 accreditation and lists methods.
• Batch or lot number on the COA matches the package, exactly.
• Test date is recent and tied to the current batch.
• CBD mg/unit is close to the label claim.
• Total THC (not just delta-9) is under the applicable limit.
• LOD and LOQ are reported, and ND or <LOQ is understood, not assumed to mean zero.
• Every contaminant panel shows a pass, with nothing flagged as fail.