The four things to check first
The batch or lot number, which has to match the one printed on your package. A COA for a different batch is a document about a different product, however good it looks.
The date. Cannabinoids degrade. CBD converts slowly, THC oxidises to CBN, and terpenes evaporate. A COA from two years ago does not describe today's contents. We flag anything past twelve months on our own lab results page for this reason.
The lab name, which should be a third party and not the brand. An ISO/IEC 17025 accreditation is the meaningful credential; it means the lab has been audited for competence at the specific tests it runs.
The product name on the COA, which should match what you bought, including strength. A brand testing its 1000 mg tincture and attaching that COA to the 3000 mg version is a real thing that happens.
Reading the potency panel
The cannabinoid panel lists each compound with a percentage by weight and usually a milligram figure per unit or per container.
Do the arithmetic on the claim. A 30 mL bottle labelled 1500 mg CBD should show around 50 mg per mL. If the COA says 38 mg/mL, the bottle contains about 1140 mg and the label is overstating by a quarter. This is the most common discrepancy and it is easy to catch.
Total THC is calculated, not measured directly. The formula is delta-9 THC plus 0.877 times THCA, because THCA converts to THC on heating and loses about 12.3% of its mass as carbon dioxide. A product showing 0.1% delta-9 and 0.2% THCA has total THC of about 0.28%, which is compliant, whereas simply adding the two would give 0.3% and look borderline.
LOQ is the limit of quantitation, the lowest amount the lab can measure reliably. ND means the compound was below that threshold. Both are on the report and neither means zero.
The tests that are not potency
Potency is the panel everyone publishes. The safety panels matter more and appear less often.
Heavy metals, because hemp is a hyperaccumulator. It draws lead, cadmium, arsenic and mercury out of soil, which is a useful trait for remediating contaminated land and a bad one for something you ingest. The plant concentrates what the ground contained.
Pesticides, because hemp is often grown at agricultural scale with agricultural inputs, and residues concentrate during extraction along with everything else.
Residual solvents, which matters for ethanol and hydrocarbon extraction. CO2 extraction does not leave solvent residue, but the refinement steps afterward can.
Microbials and mycotoxins, covering mould, yeast, E. coli and salmonella. Most relevant for flower and for products that were not heat-treated.
A brand publishing only potency is not necessarily hiding anything. It is telling you it has not paid for the other panels, and you get to decide what that is worth.
Four ways a COA misleads while staying accurate
Testing one batch and reusing the document. The COA is real, and the bottle in your hand came from a run that was never tested.
Publishing potency only, so a clean-looking report says nothing about lead or pesticides.
Testing the isolate input rather than the finished product. The raw ingredient was clean; whether the finished gummy contains what the label claims is untested.
Reporting per serving where the label implies per container, or the reverse. Always check which unit the milligram figure refers to.
Where to find ours
Every product we carry has a COA and they are on the lab results page, organized by brand and batch, with expired and expiring documents flagged rather than quietly left up.
If a COA you need is missing or out of date, tell us and we will get it from the brand. That request is a normal part of the job and not an imposition.