What a Certificate of Analysis Is, and What It Is Not

The one-sentence definition, and why it matters

A certificate of analysis is a laboratory report stating what a named analytical method found in a specific sample on a specific date. That is the whole of it. Every common misuse of a COA comes from quietly widening one of those three limits — from the sample to the batch, from the method to all possible analytes, or from the test date to the present. A COA does not certify a product, a company, a process, or a claim on a label. It certifies nothing at all in the ordinary sense of the word: it reports measurements, and the reader supplies the inference. The discipline this page is trying to install is the habit of asking, for every number on the page, what sample it describes, by what method, with what limit of detection, and how long ago.

Sources: International Organization for Standardization 2017

ISO/IEC 17025 accreditation: scope-specific, not a logo

ISO/IEC 17025:2017 sets the general requirements for the competence, impartiality and consistent operation of testing and calibration laboratories. An accreditation body assesses a laboratory against it and grants accreditation for a defined SCOPE — a specific list of test methods, on specific matrices, for specific analytes, with specific ranges. This is the single most misread fact in the industry. A laboratory can be accredited for cannabinoid potency in plant matrix and NOT accredited for pesticide residues, or accredited for potency in flower and not in an edible matrix, or accredited for a method whose range does not cover the concentration actually reported. The accreditation certificate and its annexed scope document are separate things, and the scope is the one that answers the question. What to do about it in practice: find the accreditation body and certificate number on the COA, look the laboratory up in the accreditation body's public directory, open the scope annex, and check that the specific method and matrix on your report appear in it. What accreditation does establish: that the laboratory has been assessed for technical competence, method validation, equipment calibration, personnel qualification, quality control, proficiency testing participation and impartiality, in the areas within scope. What it does not establish: that any given result is correct, that analytes outside the method were absent, that the sample was representative, or that the laboratory is competent in anything outside the scope. A logo on a PDF establishes none of it.

• Accreditation is granted for a scope — a list of methods, matrices, analytes and ranges.
• Check the accreditation body directory, not the logo on the report.
• Accredited for potency does not mean accredited for pesticides, metals, solvents or microbials.
• Accredited in flower does not mean accredited in concentrate, edible or topical matrices.
• Accreditation is about laboratory competence, not about the correctness of any single number.

Sources: International Organization for Standardization 2017

Accredited third party, in-house, and unaccredited

Three tiers exist and they are not interchangeable. An accredited third-party laboratory has no commercial interest in the result and has been externally assessed within a scope. An in-house laboratory may be technically excellent and is frequently the better-equipped facility, but it has an obvious interest in the outcome and is usually not externally assessed, so its results function as process control rather than as independent verification. An unaccredited third party is the ambiguous case: some are competent laboratories that have not pursued accreditation for a given method, and some are not competent at all, and the report itself rarely lets you tell which. There is also a fourth category that appears in practice — the report with no laboratory identity at all, or with a laboratory that cannot be found in any directory, which should be treated as no report. In the survey literature on product label accuracy, the failures concentrate where independent verification is weakest. The practical rule for a buyer: for anything going into or onto a human body, require an accredited third-party report whose scope covers the panel and the matrix, and treat in-house data as supporting evidence rather than as the answer.

Sources: International Organization for Standardization 2017 · Bonn-Miller MO 2017* · Vandrey R 2015*

Anatomy of the document, field by field

The fields below are what a usable COA contains. Missing fields are not cosmetic omissions; each one removes a specific inference the reader would otherwise be entitled to make. Read the table as a checklist and as an explanation of why each field is load-bearing.

Sources: International Organization for Standardization 2017 · International Council for Harmonisation of Technical Requirements for Pharmaceuticals for Human Use 2023

Full panel versus potency only

A potency-only report answers exactly one question: how much of the cannabinoids in the method's calibration set were in this sample. It says nothing about pesticide residues, residual process solvents, heavy metals, mycotoxins, microbial contamination, water activity, or any compound the method was not calibrated for. A full-panel report covers the set of panels required by the relevant jurisdiction, which is not the same set everywhere and is not the same set for every matrix. Two practical consequences. First, the phrase "lab tested" on a package is compatible with a potency-only report and therefore carries almost no information; ask which panels. Second, and much more important, a potency-only report on a converted or novel cannabinoid product is a specific and serious gap rather than a general one, because potency is the question least likely to reveal what went wrong with that category of product. The red-flags page treats this as its own item.

Sources: Compiled from United States state cannabis 2026* · Babalonis S 2021*

Sampling is the weakest link, and it is usually invisible

Everything downstream of sampling can be perfect and the report still be wrong about the batch, because the report describes the sample and nothing else. A COA is a statement about the batch only to the extent that the sample was representative of the batch, and representativeness is a property of the sampling plan, not of the laboratory. The failure modes are mundane and common: the producer selected the material to send rather than sampling it randomly; a single grab was taken from one location in a heterogeneous lot; the increments were not taken in proportion to lot size; the sample was taken from finished top-grade material and the lot includes material that is not; or the sample was homogenised in a way that destroyed the analyte being measured. Cannabinoid and contaminant distribution in a real lot is genuinely heterogeneous — plant material varies by plant, by position on the plant and by drying position, and an edible batch varies by how well it was mixed, which is the subject of the formulation homogeneity page. Regulatory hemp programmes address this directly by specifying who samples and how: the United States hemp rule ties compliance testing to sampling performed by an authorised sampling agent under a defined plan, precisely because producer-selected samples are not evidence about a crop. For everything outside such a programme, look for an explicit statement of who took the sample and by what plan. If the COA says nothing about sampling, the honest reading is that the report describes an unknown quantity of material selected by an interested party.

• Independent sampling by the laboratory or an authorised agent is the strong case.
• Producer-supplied sample, sampling plan documented, is the workable case.
• Producer-supplied sample with no sampling statement is the common case and is weak evidence about the batch.
• Heterogeneity is real: one grab from one location does not characterise a lot.

Sources: United States Department of Agriculture 2021* · International Organization for Standardization 2017

Batch and lot must match the product in your hand

This is the cheapest and most skipped check in the industry. Read the batch or lot identifier on the COA and read the batch or lot identifier printed on the package, and confirm they are the same string. A COA for a different batch of the same product is not evidence about your unit: potency varies between runs, contamination events are batch-specific, and the entire purpose of lot identification is to make a specific production run traceable. Related checks in the same family: the product name and matrix on the COA should match what you are holding, and the test date should postdate the production date. A COA whose test date precedes the batch it claims to describe is either a clerical error or a reused document, and in either case the report does not describe your product. Many laboratories publish a lookup by sample identifier — use it; see the red-flags page.

Sources: International Organization for Standardization 2017 · Compiled from United States state cannabis 2026*

Compliance testing versus research-and-development reports

A compliance COA is issued against a regulatory panel, with regulatory action limits, by a laboratory whose scope covers that panel, and it carries consequences. A research-and-development report — often labelled for informational purposes only, for research use only, or not for compliance — is a measurement performed outside that framework. It may be technically sound, and process chemists rely on such reports constantly and legitimately. What it is not is evidence that a product meets a standard, and it frequently omits the panels that a compliance report would have required. Two specific patterns worth recognising: a report that covers only the panels a producer wanted covered, and a report on an intermediate — a distillate, an isolate, a crude input — being presented as if it described a finished product. An input COA tells you about the input. It tells you nothing about what was added, what solvents were used downstream, whether the finished product is homogeneous, or what the finished dose per unit is. Ask for the finished-product report on the finished lot.

Sources: Compiled from United States state cannabis 2026* · Hazekamp A 2018*

A COA has a shelf life, even when nothing is wrong with it

Cannabinoids and terpenes degrade. Tetrahydrocannabinol oxidises to cannabinol; monoterpenes evaporate and oxidise; acid forms decarboxylate slowly at ambient temperature; microbial counts can rise in insufficiently dried material. A COA is therefore a statement about the sample at the test date, and its usefulness decays with the material. There is no universal expiry, because the rate depends on the matrix, the packaging, the light exposure and the storage temperature, but a report that is a year older than the product on the shelf is weak evidence about the current contents of the package and an old terpene figure is the weakest number on it. For a buyer, compare test date to purchase date and treat a large gap as a question. For a producer, the answer to that question is stability data on the actual package, not a reassurance.

Sources: Hazekamp A 2018* · Compiled from published cannabis 2026*