How to Read a CBD COA: A Step-by-Step Verification Guide | PureCraft CBD

By the PureCraft CBD Editorial Team  |  Updated 2026  |  12 min read

Why a COA Is the Most Important Document in CBD

A CBD Certificate of Analysis (COA) is a third-party laboratory report that documents what is — and what isn't — in a CBD product. It is the only objective verification that a product contains what it claims, is free from harmful contaminants, and genuinely meets the quality and safety standards it's marketed on. In a market where FDA oversight is limited, product mislabeling is common, and "third-party tested" appears on packaging that links to inadequate or outdated lab reports, knowing how to read and evaluate a COA is the single most important consumer skill in CBD purchasing.

This guide walks you through a real COA section by section — what each panel tests, what the numbers mean, what pass/fail looks like, and what a COA that should concern you looks like versus one that should give you confidence.

The Four Questions Every COA Must Answer

Before reading the numbers, assess any COA against these four gating questions:

• 1. Is it a third-party COA? The testing laboratory must be independent of the manufacturer. An "in-house" COA or a report from a lab owned by the CBD company is not third-party verification. The lab name should be identifiable as an independent accredited laboratory, not a subsidiary or related entity.
• 2. Is it batch-specific? The COA must reference a specific batch or lot number that can be matched to the product you're purchasing. A generic "brand-level" COA that isn't tied to a specific batch is meaningless — it tells you one batch tested clean, not the batch you're holding. PureCraft provides batch-specific COAs — this is the standard to require.
• 3. Is it current? COAs should be dated within the past 12 months for regular products, or specifically tied to the batch date for the product you're purchasing. A COA from 3 years ago on a current product label tells you nothing about today's product.
• 4. Does it include the full panel? A complete COA covers: cannabinoid potency (including THC), heavy metals, pesticides, residual solvents, and microbials (mold/bacteria). A COA that only shows the cannabinoid panel — missing contaminant testing — is incomplete and insufficient for full quality verification.

Section 1: Cannabinoid Potency Panel

What It Tests

The cannabinoid potency panel identifies and quantifies the cannabinoids present in the product — typically CBD, CBDA, CBG, CBN, CBC, delta-9-THC, delta-8-THC (if relevant), THCA, and THCV. Each cannabinoid is reported in milligrams per gram (mg/g) or milligrams per milliliter (mg/mL) for liquids, or milligrams per serving for edibles.

What to Look For

• CBD content matches the label: The CBD mg per serving on the COA should be within ±10–15% of the label claim. FDA consumer research has found that many CBD products are significantly under or over-labeled — some contain less than 50% of the claimed CBD content. If the COA shows 8mg/serving and the label claims 25mg/serving, the COA is the ground truth.
• Delta-9-THC level: For hemp-derived CBD, delta-9-THC must be at or below 0.3% by dry weight. The COA should report the specific measured THC level, not just "passes." For zero-THC broad-spectrum products, look for "ND" (not detected) or a specific quantified level below 0.01%. The reporting limit matters — a lab that reports "ND" with a limit of quantification (LOQ) of 1% has not actually confirmed zero THC at meaningful sensitivity.
• LOQ (Limit of Quantification): The LOQ is the lowest concentration the lab can accurately measure. For THC specifically, an LOQ of 0.01% or lower is required for meaningful "non-detectable" claims on broad-spectrum products. A COA reporting "ND" with an LOQ of 0.5% means anything below 0.5% THC would show as ND — which is not zero-THC verification.
• CBDA and other acidic forms: Raw hemp contains cannabinoids in their acidic precursor forms (CBDA, THCA). These are partially or fully decarboxylated during extraction and processing. High CBDA with low CBD suggests inadequate processing. Some products intentionally retain CBDA (raw hemp products); for standard extracts, CBD should be the dominant form.
• Minor cannabinoid profile for broad-spectrum claims: A product claiming broad-spectrum should show detectable levels of CBG, CBC, CBN — the minor cannabinoids that constitute the "broad-spectrum" claim. A product showing only CBD and no minor cannabinoids may be functionally isolate despite a broad-spectrum label.

Section 2: Heavy Metals Panel

What It Tests

Hemp is a hyperaccumulator — it absorbs and concentrates heavy metals from soil more efficiently than most crops. This makes heavy metal testing critical for CBD products in ways it isn't for many other supplements. The four metals of primary concern are lead, arsenic, cadmium, and mercury. Additional metals tested may include chromium, nickel, copper, and others depending on the lab panel.

Reference Standards

The primary reference standards for heavy metals in CBD are USP (United States Pharmacopeia) limits for dietary supplements. Common acceptable limits:

• Lead: ≤10 µg/day (USP Class 2A) — though some state regulations are stricter (California Prop 65: ≤0.5 µg/day)
• Arsenic: ≤15 µg/day
• Cadmium: ≤5 µg/day
• Mercury: ≤15 µg/day (inorganic mercury; organic mercury limits are lower)

COAs report heavy metals in micrograms per gram (µg/g) or parts per million (ppm) — equivalent units. To assess against daily limits, multiply the reported concentration by your daily CBD dose weight. A product with 0.1 µg/g lead in a 1g daily dose delivers 0.1 µg/day — well within limits. A product with 5 µg/g lead in a 1g daily dose delivers 5 µg/day — approaching limits.

Section 3: Pesticide Panel

What It Tests

Hemp cultivation uses pesticides — some legal, some illegal under state hemp regulations. The pesticide panel screens for residues of herbicides, fungicides, and insecticides. A comprehensive panel tests for 40–100+ individual pesticide compounds. A panel testing only 5–10 compounds is insufficient — it may miss commonly used pesticides not included in the abbreviated screen.

What to Look For

All reported pesticide levels should be "ND" (not detected) or below the action limits set by the testing state's hemp regulations (California, Colorado, and Oregon have the most stringent standards, which provide a good benchmark). For pesticides, "passes" on the COA summary should be backed by individual pesticide compound results — a summary "pass" without the underlying data doesn't confirm which compounds were screened. A complete pesticide panel lists each compound tested individually.

Section 4: Residual Solvents Panel

What It Tests

CBD extraction uses solvents — most commonly CO2 (supercritical carbon dioxide, which is solvent-free after extraction), ethanol, butane, propane, or hexane. After extraction, residual solvents must be removed to below safe limits. The residual solvents panel verifies this removal. The solvents of most concern are Class 1 solvents (hexane, benzene) which are toxic at low levels, and Class 2 solvents (butane, propane, ethanol) which are less toxic but still require removal to safe limits.

What to Look For

CO2-extracted CBD products should show ND for all solvents since CO2 extraction leaves no solvent residue. Ethanol-extracted products may show trace ethanol but should be below ICH Q3C limits (5,000 ppm). Butane/propane extraction should show both below 5 ppm per USP limits. Any Class 1 solvent detection above ND is a serious concern warranting rejection of the product.

Section 5: Microbial Panel

What It Tests

The microbial (microbiological) panel tests for bacterial and fungal contamination — primarily total aerobic plate count (TAPC), total yeast and mold count (TYMC), E. coli, Salmonella, and sometimes Aspergillus (particularly relevant for inhaled products). Hemp is harvested from outdoor fields and can carry significant microbial loads from soil, water, and environmental exposure — making microbial testing important even for well-processed products.

What to Look For

Pathogenic bacteria (E. coli, Salmonella) should be "absent" or ND. Total aerobic and total yeast/mold counts should be within limits appropriate for the product type — typically <1,000 CFU/g (colony-forming units per gram) for oral products. Levels above 10,000 CFU/g for oral products or any detection of pathogenic bacteria are disqualifying failures. Aspergillus species — which produce aflatoxin mycotoxins — should be ND for any oral product.

COA Red Flags: What Should Concern You

How to Verify a COA Is Authentic

COA fraud — fabricated or altered lab reports — occurs in the CBD market. Verification steps:

• Contact the lab directly: Most accredited labs will confirm whether a specific COA in their system is authentic if you provide the batch number and product name. This is the most reliable verification method.
• Check the lab's accreditation: ISO/IEC 17025 accreditation is the gold standard for testing laboratory competence. In states with cannabis/hemp testing programs, labs may also be licensed by state agencies — check the relevant state database.
• Look for the lab's letterhead and contact information: A legitimate COA includes the lab's name, address, phone number, accreditation number, and the lead analyst's signature or initials. Generic-looking reports without clear lab identification are a concern.
• QR code or unique report ID: Many labs provide a QR code or web link that retrieves the original report from the lab's system. If the COA has a QR code, scan it and verify it loads the same document from the lab's website — this is the most tamper-evident verification approach.

Reading PureCraft's COA: What to Confirm

When reviewing PureCraft's batch COA, confirm:

• The batch number matches your product label
• CBD content is within ±15% of the labeled claim
• Delta-9-THC reported as ND with an LOQ of ≤0.01% — confirming genuine zero-THC
• Minor cannabinoids (CBG, CBN) present for broad-spectrum verification
• Heavy metals all ND or well below USP limits
• Pesticides all ND across a comprehensive panel (not a summary-only result)
• Residual solvents ND (CO2 extraction)
• Microbials — pathogens absent, total counts within limits

Frequently Asked Questions

What does "ND" mean on a CBD COA?

ND stands for "not detected" — meaning the compound was not detected above the lab's limit of quantification (LOQ). It does not mean the compound is definitively absent at zero concentration; it means no detectable amount was found at the lab's measurement sensitivity. For THC, ND is only meaningful as a zero-THC claim if the LOQ is ≤0.01% — an ND at a 0.5% LOQ threshold still permits significant THC presence at lower concentrations.

How do I find the batch number to match to a COA?

Batch or lot numbers are typically printed on the product label — often on the bottom of the bottle or box, or on a side panel near the expiration date. It may be labeled "Lot#", "Batch#", "LOT", or similar. Match this number to the batch number on the COA header or product identification section. If the COA doesn't include a batch number or the numbers don't match, contact the company directly.

Is a QR code on a CBD product sufficient COA verification?

A QR code is a convenience feature — it may link to the COA, but the COA itself still needs to be evaluated against the criteria in this guide. A QR code that links to a complete, batch-specific, current, full-panel COA from an accredited lab is valuable. A QR code that links to a generic or summary COA doesn't become adequate verification just because it's scannable.

What's the difference between potency and purity on a COA?

Potency refers to the cannabinoid content — how much CBD (and other cannabinoids) the product contains. Purity refers to the absence of contaminants — heavy metals, pesticides, solvents, and microbials. A product can have accurate CBD potency on the label and still fail purity testing. Both panels are required for a complete safety and quality assessment — potency tells you what's in the product; purity tells you what isn't.

How often should a CBD company update its COAs?

Every production batch should have its own COA — batch-by-batch testing, not annual or periodic testing. For a company producing regular inventory, this means multiple new COAs per year. If a company's most recent COA is more than 12 months old, either they aren't testing regularly or they're displaying outdated results. Batch-level frequency is the standard; anything less frequent suggests inadequate quality control.

Does a passing COA guarantee the product is effective?

A COA verifies safety (contaminant testing) and label accuracy (potency testing) — it does not verify efficacy. A product can have a perfect COA and still not work for your specific application if the dose, formulation, or mechanism doesn't match your needs. COA verification is a necessary but not sufficient condition for product quality — it eliminates bad products but doesn't identify the best product for you.

The Bottom Line: Five Things Every COA Must Show

Reduce COA evaluation to five non-negotiable checkpoints: (1) batch-specific — the COA is tied to the batch you're purchasing; (2) current — dated within 12 months or matched to current batch; (3) third-party — from an independently accredited laboratory; (4) full panel — cannabinoid potency, heavy metals, pesticides, residual solvents, and microbials; (5) THC at LOQ-level sensitivity — "ND" for THC is only meaningful if the LOQ is ≤0.01%.

If a CBD product can't provide a COA that clears all five checkpoints, it doesn't merit your purchase regardless of how compelling the other marketing is. PureCraft's batch COA documentation meets all five — verify it before and after you purchase. CBD Oil and CBD+CBN Sleep Gummies — browse all PureCraft CBD products.