Powered by StealthAgents
Lab Compliance and Inventory
A certificate of analysis is the document that travels with every cannabis product from the testing laboratory to your dispensary shelf. Reading it correctly is not optional for operators who want to run a compliant retail operation, because accepting product with a failed or incomplete COA exposes your license to the same risk as accepting untested product.
This guide explains each section of a cannabis COA, what passing and failing looks like, and the checks your receiving team should run before any transfer is accepted.
A cannabis COA is a structured laboratory report that documents the results of third-party testing performed on a specific batch of product. It is batch-specific: the COA for a batch of flower does not apply to a different batch from the same cultivar or the same farm.
The first thing to verify is that the COA matches the physical product. The batch or lot number on the COA must match the batch number on the package tag and the METRC manifest. A COA that does not match the package in your hand is not evidence of what is in that package.
The second thing to verify is the test date and the lab that issued the report. Most states require that lab testing occur within a specific window before sale. A COA that is more than six months old, for example, may not meet your state's currency requirements depending on product type and your state's specific rules.
The potency section is typically the most prominent part of a cannabis COA and the section customers ask about most often. For flower products, it reports total THC and total CBD as a percentage by weight, along with a list of minor cannabinoids that were detected and quantified.
Total THC is the relevant compliance figure for flower. It is calculated from the THCA content plus any delta-9 THC already present, using a decarboxylation conversion factor. The formula is: total THC = (THCA x 0.877) + THC. Most states set a maximum THC content for hemp products and use this calculation to determine whether a product crosses from hemp into cannabis classification.
For concentrate and edible products, pay attention to the per-serving and per-package totals, not just the percentage. A 500mg package with 10 servings means each serving contains 50mg, which may be above your state's single-serving limit. Verify that the product format meets your state's dosage rules before accepting it.
The terpene section lists the major terpene compounds detected in the batch, typically expressed as a percentage by weight. Terpene profiles have commercial value for product differentiation and customer education, but they also have compliance relevance in states that regulate terpene content or require disclosure.
For operators, the practical value of terpene data is product consistency. If your budtenders are training customers to expect a specific experience from a product, the terpene profile documents whether that product is consistent batch to batch. A significant change in the terpene profile between batches from the same supplier is worth noting.
Terpene testing is not universally required. In some states, it is optional and performed on request. In states where it is required, the COA for a flower product should include it. If a COA is missing terpene data that your state requires, that is a documentation gap to resolve with your supplier.
Residual solvent testing is required for any cannabis product manufactured using a solvent-based extraction process. This includes vape cartridges, wax, shatter, live resin, and similar concentrates. Flower products do not require residual solvent testing.
The COA lists the solvents tested and the detected levels in parts per million. Your state cannabis regulator publishes maximum allowable limits for each solvent class. A passing result means all detected levels are below those limits. A failing result means at least one solvent was detected at a level above the state limit.
When reviewing a concentrate COA, check that all the solvents appropriate for the extraction method were tested. A CO2 extract should show testing for CO2 extraction residuals. A butane hash oil (BHO) product should show testing for butane and propane. If the extraction method implies solvents that are not on the tested list, ask your supplier before accepting the transfer. For current residual solvent limit standards, the NCIA cannabis testing resources maintain industry guidance on testing best practices.
Heavy metals testing covers lead, arsenic, cadmium, and mercury. Cannabis plants are bioaccumulators, meaning they absorb heavy metals from the growing medium. Products grown in contaminated soil can accumulate heavy metals at concentrations that exceed safety limits even when the growing medium itself does not appear problematic.
Pesticide testing covers residues from agricultural chemicals used during cultivation. Most states test for a panel of pesticides that are not approved for use on cannabis crops. A failing pesticide result means the product cannot be sold and typically requires formal recall or destruction procedures.
Microbial testing covers bacteria and fungi including E. coli, salmonella, aspergillus, and total yeast and mold count. For flower and concentrates consumed by inhalation, microbial limits are typically stricter than for edibles. A COA that shows a passing microbial result for an edible product does not mean the same product would pass as an inhalable product. Verify that the testing panel and limits match the product type.
Cannabis COA fraud does occur. Fraudulent COAs are most often produced by doctoring a legitimate COA from a different batch by changing the batch number, the potency figures, or the test dates.
Request COAs directly from the laboratory rather than from the supplier when possible. Many state-licensed cannabis testing laboratories maintain portals where you can look up a COA by batch number and verify that the document matches what the lab issued. The state-specific laboratory portal for your market is typically accessible through your state cannabis regulatory authority's website.
Compare the laboratory accreditation information on the COA against your state's published list of licensed testing laboratories. A COA from a lab that is not on your state's licensed list is not a compliant COA regardless of what results it shows. For support managing your COA documentation and building a compliant intake workflow, see our COA management service.
A failed test result means the batch did not meet the applicable regulatory standard for one or more analytes. You cannot sell a failed product. Accepting a transfer with a failed COA creates compliance liability for your dispensary, not just for the supplier.
When a transfer arrives with a failed COA, reject the transfer in METRC and document the rejection with the specific reason. Notify your state compliance team if your state requires disclosure of rejected transfers with failed tests.
When a failed COA arrives after a transfer was already accepted, quarantine the product and contact your supplier and your state compliance team. Most states have a formal procedure for handling recalled or failed product that includes specific documentation, destruction requirements, and reporting timelines. The METRC compliance guide for dispensaries covers the transfer and adjustment workflow in the context of those scenarios.
Q: Does every cannabis product need a COA?
A: Yes, in all regulated cannabis markets. A COA documenting third-party lab testing is required for every cannabis product sold at retail. The specific testing panels required vary by state and product type, but the requirement for a current, passing COA from a licensed laboratory is universal across legal markets.
Q: How long is a COA valid?
A: COA validity is determined by your state's regulations, not by a universal standard. Most states require that COAs be from testing performed within a specific period before sale, typically six months to one year depending on product type. Some states have no expiration rule as long as the product from the batch is still in commerce. Check your state's current cannabis testing rules for the applicable validity window.
Q: Can I show COAs to customers?
A: Yes, and many customers specifically ask for them. Most states require that COAs be available upon request at the point of sale. Some states require QR codes on packaging that link to the COA. Training your budtenders to locate and share COAs for any product on the shelf is good practice and a compliance requirement in many markets.
Q: What if the COA potency is significantly different from the label?
A: Small variations between label claims and COA results are normal because different tests on the same batch can produce slightly different readings. Large variations, meaning more than a few percentage points, suggest either a labeling error or a batch inconsistency. Contact your supplier with the specific batch number and the discrepancy. States with strict labeling requirements may require corrective action if the label claim materially misrepresents the COA result.
Q: Should my dispensary keep copies of COAs on file?
A: Yes. Maintain copies of COAs for all product in your active inventory and retain them for as long as your state's record retention requirements specify. State auditors regularly ask to see COAs for products on your shelves, and missing COA documentation is a compliance deficiency even if the product itself passed testing.
