How to Read a COA (Certificate of Analysis) for THCa Flower

A COA tells you what's really in the jar. Here's how to read the header, potency panel, total THC math and safety tests, and how to spot a fake.

Tree of Life Team

October 14, 2026

Illustrated certificate of analysis showing THCA, delta-9 THC and total THC rows with a magnifying glass

Short answer: A COA (Certificate of Analysis) is a lab report for one specific batch of product. To read one, first check that the batch number matches your package and that the lab is accredited. Then find THCa and delta-9 THC in the potency panel, calculate total THC as 0.877 × THCa + delta-9 THC, and confirm the safety panels (pesticides, heavy metals, microbials, mycotoxins) say pass. If any of those pieces are missing or don't match, treat the COA as a red flag.

What is a COA, and who issues it?

A COA is an independent lab's report on a sample from one batch. It isn't a general product sheet. California, for example, requires a COA for each representative sample, carrying the lab's name, address and license number plus the batch number (4 CCR § 15726). Hemp regulators also want results reported with their measurement of uncertainty (USDA testing guidelines).

Good labs are accredited to ISO/IEC 17025, the international standard for testing-lab competence. USDA strongly encourages it for hemp labs but doesn't require it (USDA). USDA also requires hemp THC testing to be done by DEA-registered labs, but has extended enforcement discretion on that rule through December 31, 2026 (USDA AMS).

What should be at the top of a COA?

The header proves the report belongs to your product. Look for:

Lab name, address, license or accreditation number
Product name and batch or lot number (it should match your package)
Sample ID and matrix (for example, "flower")
Dates collected, received and tested
A photo of the sample (many labs include one)
An overall pass/fail result and a signature from lab staff

California requires each of these on licensed cannabis COAs (4 CCR § 15726). Hemp COAs vary more, but the best ones match this standard.

How do you read the cannabinoid potency panel?

The potency panel lists each cannabinoid the lab measured. For THCa flower the key rows are THCA and Δ9-THC, usually alongside CBD, CBDA, CBG and CBN (4 CCR § 15724). Here's what the columns and codes mean:

You'll see	What it means
% (percent)	Share of the sample's weight. 1% = 10 mg per gram.
mg/g	Milligrams per gram of flower. 204.4 mg/g = 20.44%.
Dry weight	Result after moisture is accounted for. Federal hemp results are reported on a dry-weight basis (7 CFR 990.1).
ND	Not detected, or below the limit of detection
LOD	Limit of detection: the lowest level the method can tell is present
LOQ / <LOQ	Limit of quantitation: the lowest level the method can measure reliably. "<LOQ" means present but too low to put a number on (EFSA).
NT	Not tested

How do you calculate total THC from a COA?

Use the federal formula from USDA's hemp rules (7 CFR 990.1):

Total THC = (0.877 × THCA) + Δ9-THC

Worked example with a real batch from our shop:

Line	Value
THCA	20.44% (204.4 mg/g)
Δ9-THC	0.2682%
0.877 × 20.44	17.93%
Total THC	≈ 18.19% (about 182 mg/g)

Why 0.877? THCa loses a CO₂ group when heat turns it into delta-9 THC, so the THC weighs less than the THCa it came from. 314.46 ÷ 358.5 ≈ 0.877 (NIST; Cayman Chemical). Missouri's hemp COA guide uses the same formula and shows how a sample with "low" delta-9 can still exceed 0.3% total THC (Missouri Dept. of Agriculture). Want the chemistry? See THCa vs Delta-9 THC.

What safety tests should a THCa flower COA show?

Potency is only half the report. A complete flower COA also covers contaminants. Federal hemp rules mainly require THC testing, so the strongest benchmark is a state cannabis program. Here are California's limits for inhaled cannabis:

Panel	What it checks	California benchmark
Heavy metals	Arsenic, cadmium, lead, mercury	As 0.2, Cd 0.2, Pb 0.5, Hg 0.1 µg/g (§ 15723)
Microbials	Salmonella, STEC E. coli, pathogenic Aspergillus	Not detected in 1 g (§ 15720)
Mycotoxins	Aflatoxins, ochratoxin A	≤ 20 µg/kg each (§ 15721)
Pesticides	Dozens of pesticides, each with its own limit	Per-pesticide action levels, updated Oct 1, 2026 (DCC)
Water activity	Whether flower is dry enough to resist mold	≤ 0.65 aw (§ 15717)
Foreign material	Hair, insects, sand, mold	Visual limits (§ 15722)

These are California's rules for licensed cannabis, used here as a quality benchmark. They aren't legal limits for hemp sold in other states.

What do terpenes on a COA tell you?

Terpene testing is optional. When it's included, you'll see compounds like myrcene, limonene and caryophyllene in % or mg/g. Some labs show the top three on page one and the full profile later (SC Labs). Terpenes shape aroma and flavor, and they're a better guide to a strain's character than indica or sativa labels. Our strain guide lists the terpenes most often reported for each strain.

What are the red flags on a COA?

The batch number doesn't match your package, or the COA is for a different product.
No lab details: missing license, accreditation or contact information.
Delta-9 only: a flower COA that shows Δ9-THC but no THCA hides most of the potential THC.
Potency only, with no contaminant testing (ACS Laboratory).
Old test dates, or dates that don't fit the product's harvest.
A failed result on any panel.
A brand-made PDF with no way to confirm it on the lab's own site.

Mislabeling is common enough to take seriously. A JAMA study found about 70% of CBD extracts sold online were mislabeled (Bonn-Miller et al., 2017). A 2023 study found most Colorado flower samples tested well below their labeled THC (Schwabe et al., 2023).

How do you verify a COA is real?

Scan the QR code on the COA or package. It should open the report on the lab's own website (SC Labs).
Match the batch or lot number on your package to the COA.
Look up the lab's accreditation in the ANAB, A2LA or PJLA directories, and check that its scope covers the tests on the report.
Contact the lab using details from the lab's website, not the PDF, if anything looks off.

Every Tree of Life batch has its COA posted on our lab results page. For how total THC affects legality in 2026, see Is THCa Flower Legal in Your State?

Strain Guides Mentioned

Shop the Products in This Guide

Frequently Asked Questions

What does COA stand for?

Certificate of Analysis. It's an independent lab's test report for one batch of product, covering potency and, on a complete COA, contaminants like pesticides, heavy metals and microbes.

How do I calculate total THC on a COA?

Multiply the THCA percentage by 0.877 and add the delta-9 THC percentage. For 20.44% THCA and 0.2682% delta-9, that's about 18.19% total THC.

What does ND mean on a COA?

Not detected. The compound wasn't found, or it was below the lab method's limit of detection.

What is the difference between LOD and LOQ?

LOD (limit of detection) is the lowest level a method can tell is present. LOQ (limit of quantitation) is the lowest level it can measure reliably. A result of "<LOQ" means the compound is present but too low to put a number on.

How can I tell if a COA is fake?

Check that the batch number matches your package, scan the QR code to open the report on the lab's own site, and look up the lab in an accreditation directory such as ANAB, A2LA or PJLA. Missing lab details or a delta-9-only potency panel are red flags.

Should a THCa flower COA include safety tests?

Yes. Beyond potency, look for pesticides, heavy metals, microbials, mycotoxins and moisture or water activity. A potency-only COA doesn't tell you whether the flower is clean.

Sources

This article is for general information only and is not legal or medical advice. Laws change often; check your state and local rules before buying. These statements have not been evaluated by the FDA. Our products are not intended to diagnose, treat, cure or prevent any disease. For adults 21+ only. Keep out of reach of children and pets.