Cannabis COA Review Checklist: 10-Point QAP Batch Release Guide

A batch release signature only means something if the QAP ran the same review on every lot.

Every Canadian QAP should run the same cannabis COA review checklist on every lot before batch release. Most get through it in under two minutes once it becomes muscle memory. This article walks through the 10 point version, shows what each check catches, and gives the pass or fail criteria so anyone on the QA team can run it consistently.

For broader context on each analyte and why the limits exist, our complete cannabis COA guide covers the full document end to end: cannabinoids, heavy metals, pesticides, residual solvents, microbials, and lab accreditation.

What Should Be on Your Cannabis COA Review Checklist?

A compliant cannabis COA review checklist has 10 items covering identity, potency, safety, accreditation, and chain of custody. Run them in order. Every item is binary pass or fail. Any fail sends the lot to quarantine until the QAP resolves the finding.

1. Lot or batch number matches internal records and the seed to sale platform character for character. Compare the lot number on the COA to your production record and seed to sale batch identifier. Pass: exact match including dashes, underscores, leading zeros. Fail: any character mismatch, reused lot number, or handwritten correction.
2. Sample type matches the product submitted. Dried flower, pre-roll, oil, edible, extract, and topical test against different Health Canada limits. Pass: COA description matches the production record format. Fail: any ambiguity (for example, “cannabis” when the product is a chocolate edible).
3. Lab is ISO 17025 accredited and on Health Canada’s approved testing lab list. Confirm the lab appears on both the accreditation body register (SCC in Canada) and the current Health Canada list of authorised analytical testing labs. Pass: confirmation on both within the last 90 days. Fail: lapsed certificate, scope reduction covering your analyte, or removal from the Health Canada list. See ISO 17025 cannabis lab accreditation for the full workflow.
4. Date sampled and date reported are both present and in logical order. Sample date must precede report date, and the gap should match the lab’s published turnaround. Fail: missing date, reversed order, or a gap long enough to put sample stability in question.
5. All required test panels are present for the product format. Dried flower and pre-rolls require potency, microbials, heavy metals, pesticides. Extracts, oils, and cartridges also require residual solvents. Edibles add water activity and food-matrix microbial panels. Fail: any missing panel.
6. Total THC is calculated correctly using the THCA times 0.877 plus THC formula. Recompute Total THC from the reported values. The 0.877 factor is the molecular weight ratio 314.47 / 358.47. Pass: recomputed result within 0.1 percentage points of the reported value. Fail: wider variance, usually a wrong conversion factor or transposed number. See the Total THC formula article for worked examples.
7. Every result shows Pass, ND, less than LOQ, or a numeric value below the regulatory limit. Cross-check against Health Canada’s dried cannabis limits: lead 0.5 ppm, arsenic 0.2 ppm, cadmium 0.2 ppm, mercury 0.1 ppm, and Ph. Eur. 5.1.8 Category C microbial limits for non-irradiated flower. Fail: any value at or above limit, even marginally.
8. No ND results appear for analytes that should plausibly be present. Dried flower aged 12 months with zero CBN warrants a second look because CBN accumulates as THC degrades. A pesticide panel reporting absolute zero across 96 analytes with no less-than-LOQ qualifier is another flag. Fail: patterns that look too clean to be real.
9. COA is signed or electronically authorised by a qualified lab representative named on the accreditation scope. Signatory must be on the ISO 17025 scope annex as an approved signatory, or the technical director of record. Fail: unsigned, illegible, or a signatory not on the scope annex.
10. COA is filed in the batch record with a unique document control number and hyperlinked to the lot in seed to sale. Pass: COA retrievable from the lot record in under 30 seconds. Fail: COA filed only in email, filed under a different batch, or filed without a control number.

How to Use the Cannabis COA Review Checklist in Your Batch Release SOP

The checklist belongs in the SOP between lab results receipt and batch release signature. By the time the QAP is asked to sign, every item should already be green. The signature is where the review is attested, not where it starts.

A workable division of labour: a trained QA analyst runs the first pass against all 10 items. Pass results move to “ready for QAP review”. Fail results go to quarantine and open a deviation report. The QAP spot-checks every lot and personally runs items 3, 5, 8, and 9, because those require accreditation, analytical plausibility, or signatory knowledge that should not be delegated.

Target time once trained: two minutes per COA for the analyst pass, another minute for the QAP spot-check. A clean lot moves from “lab results received” to “released” in under five minutes. The bottleneck is usually not the review itself, it is the lack of a standardised sequence.

Escalation triggers: any fail, any near-limit result (for example, arsenic at 0.19 ppm against the 0.2 ppm limit), any mismatch with the production record, any new lab or method not previously qualified, and any COA revision re-issued after the original release. Treat a revision as a new release event.

What Do You Do When a Checklist Item Fails?

A fail triggers four actions in sequence: quarantine, deviation report, investigation, documented decision. None of them are optional.

1. Quarantine. Move the lot to system and physical quarantine within 24 hours of the fail. The lot must not be shippable from the seed to sale platform, and any downstream derivatives (pre-rolls rolled from a parent flower lot, for example) must follow.
2. Deviation report. Open a formal deviation record referencing the item that failed, the date, the analyst who identified it, and the physical quarantine location. Attach the COA and the production record.
3. Investigation. Determine root cause. The three common buckets are lab error (wrong formula, wrong limit table, typo), production defect (actual analyte out of specification), or specification mismatch (the COA is correct but does not match what was submitted). Each bucket has a different remediation path.
4. Decision and documentation. Common outcomes: retest at the same lab, retest at a second accredited lab, accept with a documented rationale signed by the QAP (rare and only defensible for clear clerical errors), or destroy. If any unit has already shipped, recall obligations under Part 6 of the Cannabis Regulations (SOR/2018-144) may apply, and Health Canada must be notified.

The most common audit finding on failed-checklist lots is not the failure itself but a missing or incomplete deviation report. Inspectors expect to see the fail, the investigation, and the resolution. A clean record of a caught and remediated failure is a quality system working as designed.

Five Most Common Cannabis COA Review Checklist Fails

Five failure patterns show up repeatedly across Canadian seed to sale operations.

1. Batch number mismatches. The COA shows LOT-2025-0041, the production record shows LOT_2025_0041, and the seed to sale platform shows LOT-25-0041. Same lot to a human reader, none match character for character. This breaks traceability under audit.
2. Total THC math error. The lab reported 22% THCA and 0.5% THC, then printed Total THC as 22.5% (raw sum). The correct number is (22 times 0.877) plus 0.5, which is 19.79%. Most impactful error because it flows straight to the package label and excise filing.
3. Lab scope does not cover the submitted test. The lab is ISO 17025 accredited with a current certificate, but the scope annex does not list the specific method for the analyte on the COA. Common example: cannabinoid potency scope covers HPLC on dried flower but not chocolate edibles. Catch at item 3.
4. Expired ISO 17025 certificate at the lab. Certificates run in four year cycles. Quarterly supplier re-verification should catch this, but it often slips because the lab did not proactively notify customers. See ISO 17025 cannabis lab accreditation for the routine.
5. Missing analyte panel. An oil COA arrives with potency, microbials, heavy metals, and pesticides, but no residual solvents. Mandatory for solvent-extracted products. Caught at item 5. For microbial detail by matrix, see cannabis microbial testing limits, and for metal limits, see cannabis heavy metals testing limits.

How Often Should You Re-Verify Your Lab’s Accreditation?

Quarterly, at minimum. An ISO 17025 certificate that looked current three months ago may be reduced, suspended, or expired today. Accreditation bodies do not proactively notify every customer of every lab, so the responsibility lives with the QAP.

The routine takes about 30 minutes per lab: SCC register lookup (or A2LA/ANAB for US labs), Health Canada approved list lookup, certificate expiry refresh, and scope annex comparison against the facility’s analyte list. Screenshot the register, file in the supplier record, sign and date. Next quarter’s refresh takes 10 minutes because the baseline is in place.

The biggest risk is treating accreditation as one-time qualification. Labs lose scope, get suspended, surrender licences, or restructure after audit findings, and none of that shows up in the PDF certificate filed initially.

Building the Cannabis COA Review Checklist Into Your QA Software

Six of the 10 items can be automated inside a seed to sale system with COA upload and required-field validation. Four remain human judgement. Knowing which is which keeps release time low without losing QAP oversight.

The automated items catch typographic errors, missing panels, and math mistakes. The human-judgement items catch failures requiring accreditation knowledge or analytical intuition. GrowerIQ’s potency testing workflow automates the six items above while keeping the QAP in the signing loop for the four that cannot be safely automated.

Frequently Asked Questions

What is a cannabis COA review checklist?

A standardised, repeatable sequence a QAP or qualified analyst runs against every certificate of analysis before a lot is released. The 10 point version covers identity, accreditation, completeness, accuracy, analytical plausibility, signatory verification, and chain of custody. The purpose is consistent decision making across every lot, plus an audit trail that demonstrates due diligence to a Health Canada inspector.

How long should a COA review take per batch?

Target two minutes per COA for the analyst pass, plus one minute of QAP spot-check on items 3, 5, 8, and 9. A clean lot moves from “lab results received” to “ready for release signature” in about three minutes of active work. Most time lost is not the review itself but the search for the production record, the seed to sale batch identifier, and the supplier qualification file.

Who on the QA team should run the cannabis COA review checklist?

A trained QA analyst runs the first pass. The QAP (named on the licence as Quality Assurance Person) spot-checks every lot and takes personal responsibility for items 3 (accreditation), 5 (panel adequacy), 8 (analytical plausibility), and 9 (signatory verification). Those four require accreditation knowledge, formulation knowledge, analytical intuition, or signatory cross-reference that should not be delegated. Training records for the analyst are themselves a Health Canada inspection item under Part 5 of the Cannabis Regulations.

Can a cannabis COA review checklist be automated?

Six of the 10 items can be automated inside a compliant seed to sale platform: lot number match, sample type match, date-order validation, Total THC recalculation, results-against-limits comparison, and document control. Four remain human judgement: accreditation verification, panel adequacy for the matrix, analytical plausibility, and signatory verification. A well-designed platform automates the six and flags the four for the QAP, which keeps release time low without compromising the regulatory signature only a human QAP can provide.

Get the Full Canadian Cannabis COA Guide

Everything you just read, plus every Health Canada limits table, worked Total THC examples, the ISO 17025 lab verification workflow, and a printable 10-point COA review checklist.

Download Free Cannabis COA Guide