What a COA Is, and Why It Matters
If you've spent any time shopping for CBD, you've seen the acronym COA thrown around. It stands for Certificate of Analysis, and it's basically the lab report card for a CBD product. Every reputable brand sends batches of finished product to an independent, third-party lab and gets back a detailed PDF that tells you exactly what's inside — how much CBD, how much THC, how much of every other cannabinoid, and whether it's clean of contaminants like pesticides, heavy metals, residual solvents, mold, and mycotoxins.
Think of a COA as a receipt for honesty. The CBD industry is still loosely regulated compared to mature categories like food and supplements, which means not every product on every shelf is what it claims to be. A COA is the single best tool you have as a consumer to verify quality. It takes about two minutes to read one once you know what you're looking at, and it can save you from wasting money on something that's underdosed, mislabeled, or worse.
At The CBD Store, every product we carry has a current COA on file. We've already done the screening — we don't stock brands that won't share their lab work. But the more our customers know about how to read these reports themselves, the better off the whole industry gets.
The First Things to Check
Before you get into the test results, look at the top of the COA. There are a few non-negotiables.
Product name and batch number. A COA covers a specific batch of product, not every bottle that brand has ever made. The batch number on the COA should match the batch number printed on your bottle or pouch. If the brand has a COA from 2022 still posted for a product they're selling in 2026, that's a yellow flag — it might just mean their site is out of date, or it might mean they aren't testing new batches.
Test date. Reasonable COAs are usually less than a year old. CBD doesn't suddenly turn dangerous, but old test data doesn't necessarily reflect what's in the bottle you're actually buying.
Lab name and accreditation. The COA should clearly identify the testing laboratory, and that lab should be independent of the brand. The gold standard is ISO/IEC 17025 accreditation, which is an international standard for laboratory testing competence. Most reputable cannabis labs in Colorado are 17025-accredited, and most will say so directly on the report. If a "lab" is owned by the brand it's testing, or if you can't find any information about who actually ran the tests, that defeats the entire purpose of third-party testing.
The Cannabinoid Profile
The first major section of any COA is the cannabinoid profile. This is the chart that breaks down how much of each cannabinoid is in the product. You'll see entries for CBD, CBDA, CBG, CBGA, CBN, CBC, Delta-9 THC, Delta-8 THC, THCA, and sometimes more obscure cannabinoids like THCV or CBL.
The numbers are usually expressed in two units: a percentage by weight (%) and a milligrams-per-serving or milligrams-per-gram figure. The one that matters for you depends on the product. For a tincture, you want to see total CBD per bottle (or per milliliter). For an edible, you want to see milligrams per gummy or per piece. The COA gives you the math directly — you don't have to estimate.
Why this matters: If the bottle says "1500mg of CBD" and the COA shows it actually contains 1300mg, that's a problem. A small variance (within 10%) is normal because hemp is a plant and batches vary, but anything beyond that — especially if the actual content is lower than what's printed on the label — is the brand selling you less than you paid for. The reverse happens too. Some sketchy operators inflate the label on a low-content product to make it look stronger. The COA is the only way to know.
The THC Compliance Line
For a product to be legally sold as hemp-derived CBD in the United States, it has to contain less than 0.3% Delta-9 THC by dry weight. The COA shows you the exact number. For most hemp-derived CBD products, you'll see a Delta-9 THC reading of less than 0.1%, often "non-detect" entirely — well below the legal limit.
This number is especially important if you're tested for drugs at work. Even at the legal limit, the THC in a full-spectrum product can show up on a sensitive workplace drug test if you're using it consistently. If that's a risk for you, you want either a broad-spectrum product (where the COA should show THC at "non-detect" or "ND") or a pure CBD isolate.
Contaminant Testing — Where Quality Really Shows
This is the part of the COA that separates well-made products from sketchy ones. A complete COA tests for at least five contaminant categories:
Pesticides
Hemp is a bioaccumulator, which means it pulls things out of the soil — including residual pesticides and herbicides. Outdoor-grown hemp from poorly regulated farms can carry surprising amounts of agricultural chemicals into the finished product. A clean COA shows pesticides at "non-detect" or well below regulatory limits across a panel of dozens of substances. Look for words like "PASS" or "ND" across the row.
Heavy Metals
Same idea as pesticides — hemp pulls heavy metals (lead, arsenic, mercury, cadmium) out of the soil where it's grown. Some of the highest-contaminant hemp comes from regions with industrial soil pollution. Reputable COAs test for at least the "big four" heavy metals, and a good product passes all of them comfortably below limits.
Residual Solvents
Most CBD products start as a crude extract from hemp flower, and that extraction is often done with solvents — ethanol, butane, CO2. After extraction, those solvents are supposed to be purged out. The residual solvent panel verifies that. CO2-extracted products generally have very little to worry about here (CO2 is just gas), but anything that started with butane or ethanol extraction needs a clean residual solvent panel.
Microbials and Mold
Hemp is a plant. Plants can host mold, yeast, salmonella, E. coli, and other microbes — especially if they're stored poorly or processed in unsanitary conditions. A good COA includes a microbial panel that checks for total yeast and mold counts, plus specific pathogens. You want all of those marked "PASS" or below detection.
Mycotoxins
If mold has grown on the hemp at any point, even if the mold itself has been killed off, the toxins it produced can remain. Mycotoxin testing — usually for aflatoxins and ochratoxin A — catches this. Not every COA includes mycotoxin testing, but the better ones do.
Bonus: Moisture and Water Activity
For flower products specifically, COAs often include moisture content and water activity readings. These predict shelf stability — flower that's too wet will develop mold; flower that's too dry will be harsh and lose terpenes. This won't apply if you're buying edibles or tinctures, but it's worth knowing about if you ever shop for CBD flower.
Red Flags to Watch For
A few patterns that should make you pause:
- No COA available at all. Hard stop. Walk away.
- COA is from the brand's own internal "lab" rather than an independent third party. The whole point is independence.
- Generic COA that isn't tied to a specific batch number. That means it could have been pulled from any batch ever produced, and the bottle in your hand has never actually been tested.
- Missing test sections. If a COA only shows cannabinoid potency and skips pesticides, heavy metals, and microbials, the brand is hiding something or paying for an incomplete panel.
- "Pass" with no actual numbers. A real lab report shows you the measured values. A vague "PASS" stamp with no detail is weaker.
- COA from a different product than the one you're holding. The product name on the COA should match the bottle.
How to Find a Brand's COA
Most reputable brands make their COAs easy to find. The two most common methods:
- QR code on the package. Scan it with your phone and it should pull up the current COA for that batch.
- Brand website. Look for a "Lab Results," "COA," or "Transparency" section. Most brands keep a current archive.
For everything we carry, you can browse the COAs we have on file on our lab results page. If you ever want to see one in person, just ask any of us at the counter and we'll pull it up and walk you through it.
The Short Version
When you're holding a COA, you want to confirm five things:
- It matches the product and batch in your hand.
- The lab is independent and accredited.
- The cannabinoid content matches the label (within 10%).
- Delta-9 THC is below 0.3%.
- Pesticides, heavy metals, residual solvents, and microbials all PASS.
If all five check out, you've got a quality product. If anything looks off — wrong batch, missing tests, suspicious lab, label mismatch — put it back on the shelf and find something else. The good brands make this easy on purpose, and the ones that don't are telling you what they are.
If you want to talk through a specific COA or compare two products side by side, that's literally one of our favorite things to do. Stop into the shop on Eisenhower in Loveland or reach out any time.
These statements have not been evaluated by the Food and Drug Administration. These products are not intended to diagnose, treat, cure, or prevent any disease. Consult your healthcare provider before starting any new supplement.