Hemp & Cannabinoid Science / Reading a Certificate of Analysis / Red Flags: A Practical COA Checklist
Red Flags: A Practical COA Checklist
Fourteen checks a buyer, retailer or formulator can run on a certificate of analysis without a chemistry background, with what each one means and what to do about it.
At a glance
| Use | run the list against the COA and the package together; most checks take seconds |
|---|---|
| Hardest stop | no COA at all, or a batch or lot that does not match the product |
| Most-missed check | verify the report with the laboratory by sample identifier, using the lab's own lookup |
| Most consequential category | a potency-only report on a converted or novel cannabinoid product |
| Documented base rate | product surveys repeatedly find label potency that does not match assay, in edibles and in CBD products |
On this page
How to use this list
These are the checks that catch real defects, ordered roughly from hardest stop to most subtle. None of them requires chemistry. Most require reading two documents side by side — the certificate and the package — and one requires opening a web page. A single flag is a question, not a verdict; several together are a pattern. Where a flag has a section elsewhere on this shelf, it is cross-referenced rather than repeated. This is education and harm reduction, not legal or medical advice, and it is written for the reader who is going to buy or formulate something regardless and would rather do it with the document read properly.
The checklist
| Flag | What it means | What to do |
|---|---|---|
| 1. No COA at all | nothing about the contents has been verified by anybody outside the seller; the label is an unsupported assertion | request it; a seller who cannot produce one for the lot has not tested the lot |
| 2. Batch or lot on the COA does not match the package | the report describes different material; potency varies between runs and contamination is batch-specific | treat as no COA for your unit and request the report for your lot |
| 3. No dates, or a test date before the batch existed | either a clerical failure or a reused document; in both cases the report does not describe your product | request a dated report for your lot; check date received, date tested and date of report separately |
| 4. COA much older than the product | cannabinoids oxidise, terpenes evaporate, microbial counts can rise; the report is weak evidence about current contents | compare test date to purchase date; ask for stability data or recent testing on the lot |
| 5. Potency-only panel on a converted or novel cannabinoid product | the panel least able to reveal what goes wrong with that category; by-products, process residues and process metals are all outside it | require a full panel plus an expanded elemental screen and full-scan chromatographic data; see the panels page |
| 6. Unaccredited laboratory, or accreditation scope that does not cover this panel or matrix | the accreditation logo may be real and irrelevant; scope is method-, matrix- and analyte-specific | find the accreditation body and certificate number, open the public scope annex, confirm the method and matrix appear |
| 7. COA is an image or PDF with no lab-verifiable reference | an unverifiable document is trivially forged or altered, and altered COAs circulate | use the laboratory's own lookup by sample identifier; if the lab has no lookup, telephone or email the lab and confirm the sample identifier |
| 8. Named cannabinoid that no method could have quantified | a novel cannabinoid with no commercially available certified reference standard has no calibration curve, so the number cannot be a quantitation | ask which reference standard established the figure; an honest lab answers directly; see the K2 lesson on the panels page |
| 9. Label potency that does not match the assay | the documented failure mode in the survey literature, in both directions — underlabelled and overlabelled | do the arithmetic yourself from the COA, per unit and per package; see the total-THC page |
| 10. Not for human consumption on something clearly meant to be consumed | a labelling posture adopted to sidestep a regulatory framework while the product is sold and used as a consumable; it usually travels with the absence of the testing that framework would require | read it as a statement that the product was not qualified for consumption, and ask which panels were run |
| 11. ND results with no detection limits printed | not detected is a statement about the method floor; without the floor the result is uninterpretable | request the LOD and LOQ for the analytes that matter to you |
| 12. No measurement uncertainty on a result near a regulatory line | a point estimate cannot support a compliance decision at the margin | request the expanded uncertainty; see worked example 4 on the total-THC page |
| 13. No sampling statement | the report describes material selected by an interested party; representativeness is undocumented | ask who sampled, under what plan, and how many increments; independent sampling is the strong case |
| 14. Input or research-use report presented as a finished-product report | a distillate or isolate COA says nothing about what was added downstream, about finished-product solvents, or about homogeneity | request the finished-product COA on the finished lot; check the matrix field |
Sources: International Organization for Standardization 2017 · International Council for Harmonisation of Technical Requirements for Pharmaceuticals for Human Use 2023 · Vandrey R 2015* · Bonn-Miller MO 2017* · Babalonis S 2021* · Auwarter V 2009* · Compiled from United States state cannabis 2026* · United States Department of Agriculture 2021*
Verify the report with the laboratory — the check almost nobody runs
A certificate of analysis is a PDF or an image, and both are trivially editable. Altered COAs — with potency figures changed, failing results removed, dates moved, or an entire document rebuilt around a different product name — are a known problem in this market, and the countermeasure is simple and underused. Many laboratories publish a public lookup where a sample identifier, an order number or a QR code returns the laboratory's own copy of the report, and comparing that copy against the one the seller supplied detects alteration immediately. Where a laboratory has no lookup, it will still confirm a sample identifier by telephone or email. Three practical notes. A QR code printed on a package is not itself verification: check where it leads, because a code that resolves to a seller-controlled page proves nothing and a code that resolves to the laboratory's own domain proves a great deal. Compare the laboratory copy field by field, not by overall impression — dates, batch, panel set and every result. And a laboratory that cannot be found in any accreditation directory or contacted at all should be treated as a laboratory that does not exist.
Sources: International Organization for Standardization 2017 · Compiled from United States state cannabis 2026*
Label accuracy: the base rate is documented, not anecdotal contested human data
The suspicion that labels and contents diverge is not cynicism, it is a finding. Vandrey and colleagues, reporting in JAMA in 2015, assayed edible medical cannabis products from dispensaries and found that a minority were accurately labelled for cannabinoid content, with both underlabelled and overlabelled products among the failures — a result that matters because an edible's label is the only dose information the consumer has. Bonn-Miller and colleagues, also in JAMA, assayed cannabidiol extracts sold online and found widespread mislabelling of CBD content, again in both directions, together with products containing detectable tetrahydrocannabinol that the labels did not disclose. Hazekamp's review of the CBD oil market describes the same picture from the quality-systems side. Two conclusions follow. First, treat a label claim as a claim and the COA as the evidence for it, and do the arithmetic yourself from the COA rather than trusting the front of the package — the total-THC page gives the conversions. Second, note the direction of the risk: underlabelling is a dosing hazard for the consumer, overlabelling is a value and efficacy problem, and undisclosed THC in a product sold as non-intoxicating is a hazard of a third kind entirely, with consequences for anyone subject to drug testing or caring for someone who is.
Contested — caveat. These surveys sampled specific markets at specific times — dispensary edibles in 2015 and online CBD extracts in 2017 — and the mislabelling rates they report should not be treated as the current rate in any particular market. The finding that mislabelling is common and bidirectional is robust across the literature; the specific percentages are not current.
Sources: Vandrey R 2015* · Bonn-Miller MO 2017* · Hazekamp A 2018*
What a good COA package looks like
It helps to know what you are aiming at rather than only what to avoid. A strong documentation package for a consumable cannabinoid product has: an accredited third-party laboratory whose published scope covers this method and this matrix; a batch or lot identifier that matches the package; test dates close to the production date; the full panel set required for the destination market, on the FINISHED product rather than on an input; detection and quantitation limits printed for every analyte; measurement uncertainty on anything near a limit; units and basis stated unambiguously, with moisture content where a dry-weight basis applies; an explicit sampling statement naming who sampled and under what plan; an authorised signatory; and a working laboratory-side lookup by sample identifier. For a converted or novel cannabinoid product, add two more: an expanded elemental screen rather than the standard four metals, and full-scan chromatographic data with a statement of identified versus unidentified area. That list is achievable — plenty of operators already meet it — and the gap between it and what is typically offered is the real state of the market.
Sources: International Organization for Standardization 2017 · International Council for Harmonisation of Technical Requirements for Pharmaceuticals for Human Use 2023 · United States Pharmacopeial Convention 2026 · United States Pharmacopeial Convention 2026 · Babalonis S 2021*
See also
- What a Certificate of Analysis Is, and What It Is Not — Reading a Certificate of Analysis
- The Panels: What Each One Covers, and What It Does Not — Reading a Certificate of Analysis
- Total THC: The Decarboxylation Arithmetic, Shown — Reading a Certificate of Analysis
- Buyer and Vendor Checklist — Product Safety and Analytical Integrity
- Converted Cannabinoid Products: What the Surveys Found — Product Safety and Analytical Integrity
- K2 and Spice: What Actually Went Wrong — Product Safety and Analytical Integrity
- Adulterants: What Has Actually Been Found in Products — Formulation and Dosing Safety
- Dose Arithmetic: Mass Fraction, Volumetric Dosing and What a Scale Can Actually Weigh — Formulation and Dosing Safety
- Market and Product-Safety Consequences of a 0.4 mg Threshold — Regulatory and Legal Analysis
- State Research Positioning: Terpene Sciences and Hemp Sciences — Regulatory and Legal Analysis
References
- Compiled from United States state cannabis and hemp testing regulations across multiple jurisdictions (2026) Panel scope, action limits, water activity and moisture requirements — jurisdictional compilation Compilation for orientation only; limits differ by state and change frequently, so verify against the rule in force where the product is sold. [identifier unverified]
- International Organization for Standardization and International Electrotechnical Commission (2017) ISO/IEC 17025:2017 — General requirements for the competence of testing and calibration laboratories International standard.
- International Council for Harmonisation of Technical Requirements for Pharmaceuticals for Human Use (2023) ICH Q2 — Validation of Analytical Procedures ICH harmonised guideline; source of the detection-limit and quantitation-limit definitions used here.
- Vandrey R, Raber JC, Raber ME, Douglass B, Miller C, Bonn-Miller MO (2015) Cannabinoid dose and label accuracy in edible medical cannabis products JAMA 313(24):2491-2493. [identifier unverified]
- Bonn-Miller MO, Loflin MJE, Thomas BF, Marcu JP, Hyke T, Vandrey R (2017) Labeling accuracy of cannabidiol extracts sold online JAMA 318(17):1708-1709. [identifier unverified]
- Babalonis S, Raup-Konsavage WM, Akpunonu PD, Balla A, Vrana KE (2021) Delta-8-THC: legal status, widespread availability, and safety concerns Cannabis and Cannabinoid Research 6(5):362-365. [identifier unverified]
- Auwarter V, Dresen S, Weinmann W, Muller M, Putz M, Ferreiros N (2009) Spice and other herbal blends: harmless incense or cannabinoid designer drugs? Journal of Mass Spectrometry 44(5):832-837. [identifier unverified]
- United States Department of Agriculture, Agricultural Marketing Service (2021) Establishment of a Domestic Hemp Production Program, final rule, codified at 7 CFR Part 990 — total THC sampling and testing requirements, post-decarboxylation measurement, and the acceptable hemp THC level concept incorporating measurement uncertainty United States federal rulemaking, January 2021. Federal Register page number omitted deliberately rather than guessed. [identifier unverified]
- Hazekamp A (2018) The trouble with CBD oil Medical Cannabis and Cannabinoids 1(1):65-72. [identifier unverified]
- United States Pharmacopeial Convention (2026) USP General Chapters 232 and 233, Elemental Impurities — Limits, and Elemental Impurities — Procedures United States Pharmacopeia and National Formulary.
- United States Pharmacopeial Convention (2026) USP General Chapter 467, Residual Solvents United States Pharmacopeia and National Formulary; chapter content is revised periodically, so cite the edition in force.
11 references, of which 7 carry no resolved identifier and are marked as such. A DOI is only recorded here when it was resolved against Crossref and the returned title matched the one printed. None was guessed.
Absence is not safety. A substance or a pair that is not in this section was not checked and is not thereby safe. This is a curated mechanism reference built from primary literature and regulatory reference works — not a comprehensive interaction database, and not a substitute for a clinician or a pharmacist.
Posture
Education and harm reduction. Not medical, legal or financial advice. Every factual claim carries a source; contested and single-source claims are marked as such on the page.
The boundary. This section teaches separation, purification, formulation, dosing arithmetic and analytical chemistry with real parameters, because withholding that detail from someone who will proceed anyway is the harm this library exists to prevent. It does not publish preparative routes for converting one cannabinoid into a more intoxicating one; those are described structurally and cited to the literature, without procedures.