How to Read a COA for Hemp Products: A Complete Guide

A Certificate of Analysis (COA) is the most important document in the hemp industry. It's a lab report from an independent, third-party laboratory that tells you exactly what's in a product — and what isn't. It confirms potency, verifies legal THC levels, and screens for contaminants like pesticides, heavy metals, and residual solvents.

In a state like North Carolina, where there's no mandatory testing or dispensary licensing, the COA is your only guarantee that a product is safe and legal. If a shop can't show you one, you should leave.

TL;DR: A COA is a third-party lab report showing what's in a hemp product. Look for five key sections: cannabinoid profile (confirms THC ≤0.3%), pesticide screening, heavy metals testing, residual solvents, and microbial contaminants. Always verify the lab is ISO 17025 accredited, the batch number matches the product, and the test date is recent (within 12 months). If a shop can't provide a COA, don't buy from them (FDA, 2022).

What Is a COA?

COA stands for Certificate of Analysis. It's a document issued by a laboratory after testing a sample of a product. For hemp, the lab tests for cannabinoid content (how much THC, CBD, CBG, etc.), contaminants (pesticides, heavy metals, solvents), and microbial safety (mold, bacteria).

The key word is third-party. A legitimate COA comes from an independent laboratory, not the company that manufactured the product. In-house testing creates an obvious conflict of interest — the manufacturer has a financial incentive to make results look good. Third-party labs have no such incentive.

Here's why this matters: a 2024 study published in Frontiers in Pharmacology tested 202 CBD products sold across the US and found that 74% deviated from their label claims by more than 10% — 46% contained more cannabinoids than labeled, and 28% contained less (Frontiers in Pharmacology, 2024). A 2025 analysis of 56 CBD gummy products found that 70% had CBD concentrations significantly different from labels, and 39% tested positive for unlabeled THC (NORML, 2025). This mislabeling problem isn't a fringe issue — it's the industry default. A COA is the only way to know what's actually in the product you're buying.

The FDA has documented over 300 adverse event reports related to Delta-8 products, with 55% of early reports requiring emergency room visits or hospital admission (FDA, 2022). National poison control centers received 2,362 Delta-8 exposure cases in just over a year, and 41% involved children.

The 5 Sections of a Complete COA

Every proper COA should contain at least these five test panels. Let's break each one down.

1. Cannabinoid Profile

This is the most important section. It shows the concentration of every cannabinoid in the product:

• Delta-9 THC — Must be ≤0.3% on a dry weight basis for the product to be legal hemp. This is the number that determines whether the product is legal under the 2018 Farm Bill and NC SB 455.
• THCa — Non-psychoactive in raw form but converts to Delta-9 THC when heated. Under current NC law, THCa content doesn't count toward the 0.3% limit. Under P.L. 119-37 (effective November 2026), it will.
• CBD — The most common non-psychoactive cannabinoid. Should match what's on the label.
• CBG, CBN, CBC — Minor cannabinoids with their own effects. Some products are formulated for specific cannabinoid ratios.
• Total THC — Calculated as: (THCa × 0.877) + Delta-9 THC. This number matters for federal compliance after November 2026.

What to look for: Does the Delta-9 THC percentage match the legal limit? Does the CBD or THCa content match what's on the product label? If the label says "25% THCa flower" but the COA shows 18%, someone is being dishonest.

Understanding the units: COAs report concentrations in different ways:

• Percentage (%) — Standard for flower. "25% THCa" means 250mg per gram.
• Milligrams per gram (mg/g) — Common for concentrates.
• Milligrams per serving or per package — Standard for edibles. A "10mg Delta-9 gummy" should show approximately 10mg on the COA per serving.

2. Pesticide Screening

Hemp plants can absorb pesticides from soil, water, and sprays used during cultivation. The pesticide panel tests for dozens of chemicals, including:

• Myclobutanil (a fungicide that releases hydrogen cyanide when heated — especially dangerous in flower meant for smoking)
• Bifenthrin (an insecticide toxic to the nervous system)
• Abamectin, chlorpyrifos, and dozens more

The COA will list each pesticide tested with a result: either "ND" (not detected), "Pass," or a specific concentration in parts per billion (ppb). You want to see "ND" or "Pass" across the board.

How common is pesticide contamination? The 2024 Frontiers in Pharmacology study found 26 different pesticides detected across 15% of the 202 CBD products tested (Frontiers in Pharmacology, 2024). That's roughly 1 in 7 products on shelves with detectable pesticide residues.

Why this matters: When you smoke flower, you're inhaling combustion byproducts. Pesticide residues concentrate during this process. A trace amount on a leaf becomes a more significant dose when smoked.

3. Heavy Metals Testing

Hemp is a bioaccumulator — it absorbs metals from the soil exceptionally well. That's actually useful for soil remediation, but it means hemp grown in contaminated soil can contain dangerous levels of:

• Lead — neurotoxic, no safe exposure level
• Arsenic — carcinogenic
• Mercury — damages nervous system, kidneys, immune system
• Cadmium — accumulates in kidneys, linked to cancer

The COA should show concentrations in parts per million (ppm) or micrograms per gram (μg/g), with each metal below the lab's action limit. "Pass" or "ND" is what you want.

A 2022 study in Science of the Total Environment tested 121 edible CBD products and found lead in 42%, mercury in 37%, arsenic in 28%, and cadmium in 8% (PubMed, 2022). The same Frontiers in Pharmacology study found heavy metals in 22% of all products tested, with 5 products exceeding regulatory thresholds for lead (Frontiers in Pharmacology, 2024).

4. Residual Solvents

This section is especially important for concentrates, vape cartridges, and tinctures — products made through extraction processes that use solvents to strip cannabinoids from plant material.

Common solvents include:

• Butane and propane — used in BHO (butane hash oil) extraction
• Ethanol — common in tincture production
• Hexane, pentane — industrial solvents
• Isopropyl alcohol — sometimes used in lower-quality extractions

Proper manufacturing removes these solvents through purging processes, but residual amounts can remain. The COA tests for their presence. Again, "ND" or "Pass" across the board.

The numbers here are sobering: the 2024 Frontiers in Pharmacology study detected residual solvents in 90% of the 202 CBD products tested — 446 solvent detections across 181 products (Frontiers in Pharmacology, 2024). That makes residual solvents the most common contaminant in hemp products by a wide margin.

Why this matters for vapes especially: Vape cartridges heat liquid to create vapor that you inhale directly into your lungs. Residual solvents in vape products are inhaled with every puff. The FDA specifically flagged concerns about Delta-8 vape products made with "potentially unsafe household chemicals" in uncontrolled settings (FDA, 2022).

5. Microbial Contaminants

This panel tests for biological contaminants:

• Total yeast and mold count — Hemp stored improperly can develop mold. Aspergillus species are particularly dangerous when inhaled.
• E. coli — indicates fecal contamination, typically from poor handling
• Salmonella — serious foodborne pathogen, especially relevant for edibles
• Total aerobic bacteria — general measure of microbial load

Results are reported in colony-forming units (CFU) per gram. Lower is better. "Pass" means the count is below the action limit.

Bonus panel: Mycotoxins. Some labs also test for mycotoxins — toxic compounds produced by certain molds. This is above and beyond the standard panel but indicates a more thorough testing approach. If a product's COA includes mycotoxin testing, that's a good sign about the manufacturer's commitment to safety.

How to Verify a COA Is Legitimate

Not all COAs are created equal. Here's how to spot a real one versus a fake or misleading report.

Check the Lab

The COA should clearly show the lab's name, address, and contact information. Look for:

• ISO 17025 accreditation — This is the international standard for testing laboratories. It means the lab has been independently audited for competence and accuracy. Many COAs will display the accreditation logo or number.
• DEA registration — Labs handling Schedule I controlled substances (which includes some forms of THC for testing purposes) need DEA registration.
• State licensing — Some states require labs to hold specific cannabis testing licenses.

You should be able to find the lab online. If the lab name doesn't return any results when you search for it, the COA may be fabricated.

Match the Batch Number

Every COA is linked to a specific batch or lot of product. The batch number on the COA should match the batch number on the product's packaging. If they don't match, the COA may be from a completely different product run.

Check the Date

COAs have a test date. A report from two years ago doesn't tell you much about what's in today's product. Look for test dates within the past 12 months. For flower products, fresher is better — within 6 months is ideal.

Verify the QR Code

Many products include a QR code that links to the COA. Scan it and check where it goes:

• Good: Links directly to the lab's website with the full report
• Questionable: Links to the brand's own website hosting a PDF
• Bad: Links to nothing, or to a generic page without actual test results

Red Flags on a COA

These should make you think twice:

• "Tested in-house" or no lab name — The manufacturer tested their own product. That's not independent verification.
• Only a cannabinoid profile — If the COA only shows potency without pesticide, metal, solvent, or microbial testing, the product wasn't fully screened.
• Results that are too perfect — Every product has some variation. A COA showing exactly 0.000% for every contaminant across multiple batches may be fabricated.
• Low-resolution or blurry images — Legitimate COAs are crisp documents. A blurry screenshot of a COA suggests it may have been altered.
• Batch number doesn't match — The COA might be from a different (possibly cleaner) batch than what you're buying.
• Very old date — Anything over 12 months old is essentially meaningless for the current product.

How to Read Cannabinoid Numbers: A Practical Example

Let's walk through what the numbers mean in practice. Here's what you might see on a COA for THCa flower:

Cannabinoid	Result	What It Means
THCa	24.5%	Main active cannabinoid. Converts to ~21.5% THC when smoked
Delta-9 THC	0.21%	Below the 0.3% legal limit — this product is legal hemp
Total THC	21.7%	(THCa × 0.877) + Delta-9. Matters after Nov 2026
CBD	0.08%	Very little CBD in this product
CBG	0.92%	Minor cannabinoid, may contribute to effects

The legal math: Under current law (2018 Farm Bill + SB 455), only the Delta-9 THC percentage matters. At 0.21%, this flower is legal. But under P.L. 119-37 (effective November 2026), the total THC of 21.7% would make this product illegal. For the full breakdown on this change, see our guide on hemp vs. marijuana in NC.

The potency math: THCa converts to THC at a ratio of 0.877 (it loses some molecular weight during decarboxylation). So 24.5% THCa × 0.877 = 21.5% THC when smoked. That's comparable to mid-shelf marijuana in dispensary states. For more on this conversion, see our THCa legality guide.

Where to Find COAs

COAs are available in several places:

• In the store — Ask staff directly. Good dispensaries like Sherlocks and Carolina Hemp Hut keep them accessible.
• QR code on packaging — Scan it with your phone camera. It should link to the full lab report.
• Brand website — Most reputable brands host COAs on their website, searchable by product or batch number.
• Dispensary website — Some shops post COAs for the products they carry.

If you can't find a COA through any of these channels, that product doesn't have verified lab testing. Move on.

Why NC Consumers Need to Be Especially Careful

North Carolina currently has no mandatory testing requirements for hemp products. Unlike states like California, Colorado, or Oregon — which require every cannabis product to pass specific lab tests before reaching store shelves — NC relies entirely on voluntary compliance.

Governor Stein acknowledged this gap in June 2025, noting that "today all across North Carolina, there are unregulated intoxicating THC products available for purchase: just walk into any vape shop" (Governor's Office, 2025). The proposed Chapter 18D legislation (SB 265) would establish mandatory testing for all hemp consumables — including heavy metals, mycotoxins, pesticides, residual solvents, and total THC content (National Law Review, 2025). But until it passes, the responsibility falls on consumers and responsible retailers.

North Carolina does have DEA-registered hemp testing laboratories. If you want to verify that a product's COA comes from a legitimate lab, the USDA maintains a directory at ams.usda.gov. NC labs include Delta 9 Analytical in Raleigh, NMS Labs in Winston-Salem, RTP Labs in Raleigh, and USDA National Science Labs in Gastonia.

That's why shopping at a dedicated dispensary matters. Shops that invest in lab-tested products and make COAs available are voluntarily meeting standards that may soon become law. Gas stations, convenience stores, and vape shops selling hemp products as a sideline are much less likely to maintain these practices.

For more on choosing the right shop, see our guide on what to look for in a NC dispensary.