Can you verify every passing COA in under two minutes, or are you just trusting the lab?
What You’ll Learn
- How to read every section of a cannabis COA: header, cannabinoid profile, microbials, heavy metals, pesticides, and residual solvents.
- The Total THC formula (THCA × 0.877 + THC) and why Health Canada uses it for potency limits.
- Health Canada acceptable limits for microbial contaminants, heavy metals, and pesticide residues.
- How to verify ISO 17025 accreditation and Health Canada approval before accepting a lab’s results.
- A 10-point COA review checklist you can run every time a lab report lands in your inbox.
- How to turn COA data into an operational signal: potency trends, microbial drift, and lab turnaround as KPIs.
A Certificate of Analysis is the single most important document in a cannabis batch record. It is the evidence that what you are about to release meets the Cannabis Regulations, and it is the document Health Canada inspectors open first. Learning how to read a cannabis COA properly is not a “nice to have” skill for a QAP; it is the line between a clean batch release and a mandatory deviation report.
This guide is written for licensed producers in Canada, but the principles for how to read a cannabis COA apply anywhere cannabis is lab-tested against a regulatory limit. We will walk through every section of a typical cannabis certificate of analysis, explain what each number means in practice, and flag the details that most commonly trip up batch release.
What is a COA, really?
A cannabis COA is an official document issued by an accredited third-party laboratory that certifies the chemical composition and safety of a batch. It serves two functions at once: a compliance record tied to a specific lot number, and a quality assurance tool that tells you whether the flower or extract you grew or manufactured is fit for sale.
In Canada, licensed producers are required under the Cannabis Regulations (SOR/2018-144) to test every lot for potency, microbial contaminants, heavy metals, pesticides, and, for extracts, residual solvents before releasing product to market. The COA is how the lab communicates those results back to you. Everything downstream (packaging claims, Health Canada reports, medical sales, dried cannabis excise stamps) flows from this one document.
Who is allowed to issue a valid COA?
Not every lab that tests cannabis can issue a compliance-valid COA. Two conditions have to be true at the same time:
- The laboratory holds a current ISO 17025 cannabis lab accreditation covering the specific test methods used on your sample.
- The laboratory appears on Health Canada’s published list of approved cannabis testing laboratories.
Accreditation alone is not enough. A lab can be ISO/IEC 17025 accredited for environmental work and still have no scope for cannabinoid quantitation. Always confirm the scope of accreditation covers the exact analytes on your report (THC, CBD, heavy metals, pesticide panel, microbials) before you accept the COA as compliance-valid.
Anatomy of a Cannabis Certificate of Analysis
A typical COA has six parts: a header block, a cannabinoid profile, microbial results, heavy metals, pesticide residues, and (for extracts) residual solvents. The layout varies between labs, but the required content does not. Here is how to read each section.
1. Header Information: The Identity Check
Before you look at a single test result, reconcile the header. Every COA must identify the sample, the producer, and the dates. If any of these fields are missing or do not match your internal records, stop reading. The document cannot be used for batch release until it is reconciled.
| Field | What it Means | What to Check |
|---|---|---|
| Sample ID / Lab ID | The lab’s internal tracking number | Cross-reference with your submission paperwork |
| Client / LP Name | Your licensed producer name | Must match your Health Canada licence exactly |
| Lot / Batch Number | Your internal batch identifier | Must match seed-to-sale records exactly |
| Sample Type | Dried flower, oil, extract, pre-roll, edible, etc. | Confirm it matches what you submitted |
| Date Sampled | When the sample was collected | Relevant for stability and shelf-life calculations |
| Date Reported | When the COA was issued | Should fall within the lab’s stated turnaround time |
Watch Out: Batch Number Mismatches
Batch number mismatches between the COA and your seed-to-sale platform are one of the most common findings in Health Canada inspections. A typo, a dash instead of an underscore, or a re-used lot identifier can invalidate the entire chain of custody. Reconcile the lot number against your batch record before you sign off on the COA, not after.
2. Potency and Cannabinoid Profile
The cannabinoid profile is usually the section most people look at first. It is also the section most commonly misread, because the numbers on the report are not always the numbers you put on the label. A typical cannabis COA reports the following compounds:
| Cannabinoid | Abbreviation | What It Tells You |
|---|---|---|
| Tetrahydrocannabinolic Acid | THCA | Non-psychoactive precursor; converts to THC when heated |
| Delta-9-Tetrahydrocannabinol | THC | Primary psychoactive compound; tightly regulated |
| Total THC | (calculated) | THCA × 0.877 + THC (used for regulatory limits) |
| Cannabidiolic Acid | CBDA | Precursor to CBD |
| Cannabidiol | CBD | Primary non-psychoactive therapeutic compound |
| Total CBD | (calculated) | CBDA × 0.877 + CBD |
| Cannabinol | CBN | Degradation product of THC; indicates age or heat exposure |
| Cannabigerol | CBG | Precursor cannabinoid; increasingly valued in product lines |
The Total THC Formula and Why It Matters
The single most important calculation on any cannabis COA is Total THC:
Total THC = (THCA × 0.877) + THC
The 0.877 conversion factor accounts for the mass lost when THCA loses its carboxyl group during decarboxylation, essentially when the flower is heated or smoked. Health Canada uses Total THC (not raw THCA) for potency claims, package labelling, and excise calculations. If your lab reports 22% THCA and 0.6% THC, the regulatory Total THC is (22 × 0.877) + 0.6 = 19.89%, not the 22.6% a buyer might eyeball off the acid form alone.
The same math applies to Total CBD using CBDA. For a deeper walk-through of the calculation, edge cases, and how to audit a lab’s Total THC math, see our breakdown of the Total THC formula. And for an overview of how potency testing is performed in the first place, the cannabis potency testing guide covers HPLC methodology and sampling protocols.
3. Microbial Testing: Pass / Fail for Consumer Safety
Microbial testing is where quality defects on the grow side show up as compliance problems on the finished-product side. High microbial counts usually trace back to curing humidity, trim room hygiene, or handling practices, and the COA is the first place you will see it. Health Canada limits for dried cannabis flower are as follows:
| Test | Acceptable Limit (Health Canada) |
|---|---|
| Total Aerobic Count (TAC) | ≤ 105 CFU/g (dried flower) |
| Total Yeast & Mould (TYMC) | ≤ 104 CFU/g |
| E. coli | Absence in 1 g |
| Salmonella spp. | Absence in 25 g |
| Bile-tolerant gram-negative bacteria | ≤ 104 CFU/g |
These limits come from Ph. Eur. 5.1.8 Category C, which Health Canada deems acceptable for dried cannabis products (per the 2020 HC microbial-limits clarification). Irradiated or otherwise decontaminated flower may be assessed against the stricter Category B tier (TYMC 102, bile-tolerant GNB 102), but Category C remains the regulatory ceiling for untreated product. Always compare the limit on the COA against the intended consumption format of the product, not the generic “dried flower” row. For the full reference with product-category breakdowns and common failure modes, see our cannabis microbial testing limits guide.
Get the Complete Cannabis COA Guide
The full PDF includes every Health Canada limits table, a printable 10-point COA review checklist, a worked Total THC example, and the lab accreditation verification workflow, ready to drop into your batch release SOPs.
4. Heavy Metals: The Soil Signature
Heavy metals accumulate in cannabis primarily through the growing substrate and water supply. Because the plant is a known hyperaccumulator, even low environmental concentrations can push a finished lot over the regulatory limit. Health Canada’s oral-route acceptable limits are:
| Metal | Limit (Oral, Health Canada) |
|---|---|
| Lead (Pb) | ≤ 0.5 ppm |
| Arsenic (As) | ≤ 0.2 ppm |
| Cadmium (Cd) | ≤ 0.2 ppm |
| Mercury (Hg) | ≤ 0.1 ppm |
If a single lot fails heavy metals, do not just scrap it and move on. Treat it as a signal. Heavy metal failures are rarely random. They usually indicate a contaminated input (peat, coco coir, fertiliser amendment, irrigation water) that is being used across multiple lots. Pull the SDS on your growing media, cross-check against other lots from the same source, and consider a one-time environmental audit before the next crop cycle. Limits for inhaled products, edibles, and topicals differ from the oral limits above; our full cannabis heavy metals testing limits reference breaks these down by product category.
5. Pesticide Residues
Health Canada maintains an approved list of pest control products for cannabis. Any residue above the Maximum Residue Limit (MRL) results in a failed COA, full stop. There is no “technical pass” for pesticides. Results are typically expressed in ppm or ppb. A passing result will show one of three things:
- ND (Not Detected): the analyte was below the lab’s detection limit.
- <LOQ (Below Limit of Quantitation): detected but below the level where the lab can report a precise number.
- A numeric value below the MRL.
If your lot was produced using only approved PMRA-registered products applied at labelled rates, you should expect ND or <LOQ across the panel. A numeric detection, even one well below the MRL, is worth investigating; it can indicate drift from a neighbouring facility, contaminated inputs, or IPM protocol violations you need to surface with your cultivation team.
6. Residual Solvents (Extracts Only)
For cannabis oils, distillates, resins, and other extracts, labs test for residual processing solvents. The most common analytes are ethanol, butane, propane, hexane, heptane, and isopropanol. Limits are set by Health Canada and must be met before any concentrate can be released for sale. Residual solvent failures typically indicate an under-purged extract or a miscalibrated purge oven. They are almost always an operations fix, not a formulation one. If you are seeing repeat residual solvent flags on a specific extraction SKU, audit the purge cycle parameters before you audit the raw material.
What Does a Pass / Fail Verdict on a Cannabis COA Actually Mean?
Most COAs include a clear Pass / Fail summary per test category. Useful, but do not stop there. Three habits separate a working QAP from a rubber-stamping one:
- Read the raw numbers, not just the verdict. A result that sits at 95% of the limit today may exceed it on a retest tomorrow if there is normal sample variability. Flag near-misses for trend review even when they pass.
- Watch for rounding games. Some labs round results in ways that produce a technical pass but warrant a closer look. If a result is reported as exactly the limit (for example, lead at 0.5 ppm), treat it as if it failed and request an untransformed raw value.
- Trend across batches. A single COA is a snapshot. Ten COAs from the same cultivar and room across six months is a diagnostic. Rising yeast and mould counts, drifting cannabinoid ratios, or increasing lab turnaround times all tell you something before they become a compliance problem.
Action Required on a Failed COA
A failed COA triggers mandatory reporting obligations under the Cannabis Regulations. The product must be quarantined immediately, physically and in your seed-to-sale system. Do not release, transfer, or destroy the lot without following your written recall and deviation SOP and notifying Health Canada where required. Document the lot number, the failing analyte(s), the lab, and the date of quarantine in the batch record the same day the COA is received. Retesting without a documented root-cause investigation is not acceptable.
How Do You Verify Lab Accreditation on a Cannabis COA?
Before you accept any cannabis certificate of analysis as compliance-valid, confirm four things about the issuing laboratory:
- The lab holds a current ISO/IEC 17025 accreditation certificate (request a copy if you do not have one on file).
- The lab appears on Health Canada’s published list of approved cannabis testing laboratories.
- The accreditation scope explicitly covers the test methods run on your sample: HPLC cannabinoid analysis, ICP-MS heavy metals, GC-MS pesticide panel, microbial plating, etc.
- There are no outstanding compliance actions, scope reductions, or suspensions against the lab.
Accreditation is not a “set and forget” attribute. A lab’s ISO 17025 certificate has an expiry date, and the scope can be reduced after audit findings. If the last time anyone on your team looked at the lab’s certificate was two years ago, it is out of date. Build a quarterly check into your supplier management SOP, the same way you reverify your packaging suppliers or your cleaning chemical SDS library.
The 10-Point COA Review Checklist
Use this checklist every time a cannabis COA is received, before filing the document or releasing the lot. Most QAPs can run through it in under two minutes once it becomes muscle memory:
- Batch / lot number matches internal records and your seed-to-sale platform character-for-character.
- Sample type matches the submitted product (dried flower, pre-roll, oil, edible, extract).
- Lab is ISO 17025 accredited and appears on Health Canada’s approved testing lab list.
- Date sampled and date reported are both present and sit in a logical order.
- All required test panels are present for the product format: potency, microbials, heavy metals, pesticides, and residual solvents (for extracts).
- Total THC is calculated correctly using the THCA × 0.877 + THC formula.
- Every reported result shows Pass, ND, <LOQ, or a numeric value below the regulatory limit.
- No “ND” results are flagged for analytes that you would expect to be present (for example, zero CBN in a year-old flower lot warrants a second look).
- The COA is signed or electronically authorised by a qualified lab representative named on the accreditation scope.
- The COA is filed in the batch record with a unique document control number and hyperlinked to the lot in your seed-to-sale platform.
If you want a printable version formatted for your batch release SOP, the full PDF version of this guide includes the cannabis COA review checklist on a single page ready to hand to your QA team.
Using COA Data Strategically: Beyond Compliance
Most producers treat COAs as a cost of doing business: a document you generate to satisfy the regulator, file in a folder, and never look at again. That is a waste. Once you have 12 months of COA data centralised and searchable, it becomes one of the highest-signal datasets in your operation.
Potency trends by cultivar and room
If Cultivar A averages 21.4% Total THC in Room 3 but only 18.7% in Room 5 across a year, that is not noise. It is environmental signal. Overlay your room’s VPD, humidity, and temperature records against Total THC on a per-lot basis and the best rooms become obvious. So do the worst.
Microbial drift as an early warning
TYMC counts that are all well inside the limit but trending upward month-over-month are a sanitation problem announcing itself three months early. Catching a drift in week six and adjusting trim room cleaning cadence is orders of magnitude cheaper than waiting for a full failure at week 14 and recalling product.
Lab turnaround as an operational KPI
Lab turnaround time is one of the most overlooked levers in cannabis operations. If your average days-from-sampled to days-reported creeps from 7 to 14, your working capital tied up in quarantined inventory doubles, and you did not get a single warning on any one COA. Track it as a monthly KPI against your labs and renegotiate when drift becomes systemic.
How to Read a Cannabis COA as a Data Asset, Not a Form
A few patterns are worth watching across your first year of COA centralisation:
- Seasonal cannabinoid variability: Indoor facilities are not fully immune to seasonal swings. HVAC performance changes, outdoor humidity affects curing rooms, and cannabinoid yields can wobble 1 to 3 percentage points across the year even on the same cultivar.
- Lot size versus CV: Larger lots almost always show higher coefficient of variation on potency results because composite sampling cannot fully homogenise a 20 kg lot the way it can a 2 kg one. Keep this in mind when reviewing consistency claims.
- Microbial profile by drying method: Rack-dried, hang-dried, and freeze-dried flower show measurably different microbial baselines. None is inherently “better”; the point is that switching method is a change control event that will show up in your COA trends if you are watching.
None of this replaces compliance review. It sits on top of it. A COA that passes is the floor. What you learn from a year of passing COAs is the ceiling. Once your team has internalised how to read a cannabis COA the right way (reconcile the header, verify the math, check the accreditation, trend the data), the document stops being a gate and starts being a lens on your operation.
Frequently Asked Questions
What does a passing cannabis COA look like?
A passing cannabis COA shows a “Pass” verdict for every required test category (potency, microbials, heavy metals, pesticides, and for extracts residual solvents), with every raw result either below the Health Canada limit, reported as ND (Not Detected), or below the limit of quantitation (<LOQ). The header fields all match your internal batch record, the lab is ISO 17025 accredited and on Health Canada’s approved list, and the document is signed by a qualified lab representative. Our free guide above walks through a worked example of a passing COA section by section; download it for the full breakdown.
Is a hemp COA different from a cannabis COA?
Structurally, no. A hemp certificate of analysis uses the same sections (cannabinoid profile, microbials, heavy metals, pesticides, residual solvents) as a high-THC cannabis COA. The difference is the regulatory threshold: hemp is defined by a Total THC limit (0.3% in Canada and the United States), so the cannabinoid profile is where hemp COAs get scrutinised hardest. Everything else (the Total THC formula, ISO 17025 accreditation requirements, MRLs on pesticides) applies identically.
How do I read a CBD product COA?
A CBD product COA is read exactly like a cannabis COA, with two emphases. First, verify the CBD content matches the label claim within the lab’s stated tolerance (typically ±10%). Second, confirm the Total THC sits below the product’s regulatory ceiling for your market. Remember that Total THC = CBDA’s sister formula THCA × 0.877 + THC, so raw THC alone does not tell you compliance. For a full walk-through of the potency math and what to check on the full-spectrum vs. isolate distinction, download the complete guide above.
How long should I keep cannabis COAs on file?
Under the Cannabis Regulations, licensed producers must retain testing records for at least two years after the date the product is no longer in the licence holder’s possession. In practice, most QAPs keep COAs indefinitely in digital batch records. They are trivially small files and become valuable longitudinal data for potency trending, root-cause investigations, and customer complaint response. If you are using a seed-to-sale platform, attach the COA PDF directly to the lot so it travels with the batch record through its full lifecycle.
What do I do if a COA fails?
Immediately quarantine the lot both physically and in your seed-to-sale system, then notify your QAP and follow your written deviation and recall SOP. Document the failure in the batch record, investigate root cause before retesting, and notify Health Canada where the regulations require it (most commonly for microbial failures on product already in distribution). Do not retest-and-release without a documented investigation. A retest on its own is not evidence the lot is safe; it is evidence you got a different number on a different day.
Get the Complete Cannabis COA Guide
Everything you just read, plus the printable 10-point COA review checklist, full Health Canada limits tables for microbials, heavy metals, and pesticide MRLs, a worked Total THC formula example, and the ISO 17025 lab accreditation verification workflow, ready to drop into your batch release SOPs.
Ready to Take Your Operation to the Next Level?
See how GrowerIQ helps licensed cannabis facilities streamline compliance, reduce errors, and scale with confidence.
About GrowerIQ
GrowerIQ is changing the way producers use software - transforming a regulatory requirement into a robust platform to learn, analyze, and improve performance.
To find out more about GrowerIQ and how we can help, fill out the form to the right, start a chat, or contact us.