What a Hemp COA Tests For: Potency, Heavy Metals, Pesticides, and More

A Certificate of Analysis is the lab report that tells you, and your customers, what is actually in a hemp product. Good hemp cbd lab testing measures far more than the CBD percentage on the front of the bag. A full-panel COA checks the cannabinoids, then screens for the contaminants that hemp is prone to carry: heavy metals, pesticides, microbes, solvent residue, mold toxins, and moisture. If you sell hemp or CBD on Shopify, knowing what each panel covers is the difference between publishing a document you understand and posting a PDF you hope looks official.

This post walks the full panel one section at a time. For each, you get what it measures and why a buyer should care.

Cannabinoid potency (and terpenes)

The potency panel measures how much of each cannabinoid is present: THC, CBD, CBG, CBN, and often their acidic forms like THCA and CBDA. Results are usually given as a percentage by weight and as milligrams per unit. This is the number that determines both your product's effect and its legal status, so it is the panel buyers read first.

Most labs run potency on HPLC (high-performance liquid chromatography) because it does not heat the sample. Heat converts acidic cannabinoids such as THCA to their neutral forms, which would distort the numbers. HPLC keeps the sample cool and reports what was really in the jar.

Total THC is now the figure that matters most for compliance. The 2018 Farm Bill capped only delta-9 THC at 0.3% on a dry-weight basis, which left room for intoxicating isomers like delta-8. H.R. 5371, enacted November 12, 2025 and effective November 12, 2026, closes that gap by defining hemp using total THC and by excluding finished products with more than 0.4 mg of total THC per container. If your current COAs only report delta-9, plan to re-test. Our hemp and CBD lab testing compliance guide covers the total-THC shift in detail.

Many COAs also report terpenes, the aromatic compounds that give a strain its smell and contribute to its character. Terpenes are not a safety test, but customers comparing products often look for them.

Heavy metals: lead, arsenic, cadmium, mercury

The four metals a hemp COA screens for are lead, arsenic, cadmium, and mercury. This panel exists because of a specific biological fact: hemp is a hyperaccumulator. The plant draws metals out of the soil and concentrates them in its tissue. That trait is so reliable that hemp has been planted to remediate contaminated land. For a consumable product, it means the metals in the dirt can end up in the extract.

Labs measure these metals by ICP-MS (inductively coupled plasma mass spectrometry), which detects them at very low concentrations. A clean result here tells a customer the product was not grown in tainted soil and concentrated into something harmful. It is one of the strongest trust signals a hemp brand can publish. For a deeper look at limits and methods, see our guide to hemp heavy metal testing.

Pesticides

Hemp can be sprayed during cultivation, and pesticide residue carries through extraction into the finished product. The pesticide panel screens for a long list of agricultural chemicals, often by LC-MS/MS (liquid chromatography with tandem mass spectrometry), which can pick out individual compounds at trace levels.

Which pesticides are screened and at what limits varies by state, so a COA that lists each analyte and its action level is more useful than one that just stamps "pass." For a buyer, this panel answers a simple question: was anything sprayed on this plant that I would not want to consume?

Microbials: yeast and mold, E. coli, Salmonella

The microbial panel checks for living contamination: total yeast and mold, plus pathogens like E. coli and Salmonella. Hemp is an agricultural product that can be exposed to moisture and poor handling during drying, storage, and processing, all of which let microbes grow.

This is a direct health-safety test. A failed microbial result is a reason to pull a batch, not a paperwork detail. Customers buying anything they will inhale or ingest have a real stake in a clean microbial screen.

Residual solvents

Many CBD products are made by extracting cannabinoids from raw hemp using solvents such as ethanol, butane, or propane. If extraction or purging is done poorly, traces of those solvents remain. The residual-solvent panel measures what is left.

This panel is usually run by gas chromatography (GC, often GC-MS or GC-FID), which heats the sample to separate volatile compounds. A clean result confirms the maker removed their extraction solvents properly. If a product is a solventless extract, this panel still belongs on the COA to show it.

Mycotoxins

Mycotoxins are toxic compounds produced by certain molds. They are distinct from the mold count in the microbial panel: a product can have a low live-mold count yet still carry mycotoxins from mold that grew and died earlier. The mycotoxin panel, often run by LC-MS/MS, targets the specific toxins, with aflatoxins and ochratoxin A among the most common.

For a customer, this panel closes a gap the microbial test alone leaves open. It confirms the product is free of mold byproducts even if visible mold is long gone.

Moisture, water activity, and foreign matter

The last group is about stability and cleanliness. Moisture content and water activity measure how much water the product holds. High water activity invites mold and microbial growth over time, so this panel speaks to shelf life, not just the moment of testing. Foreign matter screening checks for physical contaminants like stems, dirt, insect parts, or hair.

These tests rarely get attention, but they are the difference between a product that stays clean on the shelf and one that degrades. They round out the picture of a well-handled batch.

Full panel vs potency only: why the difference matters

A "potency only" COA tells you how much CBD or THC is present and stops there. A "full panel" COA adds every safety test above. The gap between them is large, and it is where most consumer risk lives.

A potency-only document can make a product look tested while saying nothing about whether it is clean. For brands selling to cautious customers, the full panel is what backs up the claim. If you are still mapping out which tests your products need, hemp testing 101 lays out the basics.

What makes a COA credible

A test result is only as trustworthy as the lab and the document behind it. Reputable COAs share a few traits:

• The lab is ISO/IEC 17025 accredited, meaning an independent body verified its methods and competence.
• Each analyte lists the test method used, so you can see how it was measured.
• The COA shows LOD and LOQ (limit of detection and limit of quantitation), which tell you how sensitive the test was.
• There is a batch or lot number tying the report to a specific production run, not just a product name.
• Each analyte carries a clear pass or fail against a stated limit.

If a COA is missing the lab's accreditation, the methods, or a batch number, treat it with caution. Learning to spot these details is a skill in itself, and our guide on how to read a CBD COA walks through a real report line by line.

Testing requirements vary by state and product type, so the federal definition of hemp is a floor, not the full set of rules you have to meet. Check your state's program for the panels and limits that apply to what you sell, and keep in mind the FDA has not approved CBD as a dietary supplement or food additive, so avoid making health claims regardless of what your COA shows.

Putting the COA in front of customers

A clean full-panel COA only builds trust if buyers can find it. The practical problem for most Shopify merchants is publishing the right batch report on the right product and keeping it current as batches change. LabLinks for hemp and cannabis brands handles that: upload a COA as a PDF or image, enter the batch or lot number, test date, lab name, and status, then link it to a Shopify product. A theme app block shows a lab-tested badge that opens the report in an on-page viewer, every store gets a searchable portal so customers can look up a result by product or batch, and QR codes connect packaging to the matching COA. Publish a new batch and the storefront updates on its own.

A short checklist before you publish any hemp product COA:

• Confirm it is a full panel, not potency only.
• Check the lab is ISO/IEC 17025 accredited.
• Match the batch or lot number to the product you are selling.
• Verify the potency panel reports total THC, not delta-9 alone.
• Make sure every analyte shows a pass against a stated limit.