Guide · Buyer guides
How to verify a supplier COA: lab accreditation, lot matching and the math
To verify a supplier’s COA, confirm four things in order: the lab is accredited to ISO/IEC 17025 for cannabinoid potency, the client lot on the certificate matches the lot you are buying, the numbers on the page are internally consistent, and the lab itself confirms the sample ID. A certificate that passes all four is evidence about your lot; one that fails any of them is a document, not proof.
Reviewed 2026-10-03.
The verification sequence
| Step | Check | Where to look | Fails when |
|---|---|---|---|
| 1 | Lab identity | Lab name, address, license number on page 1 | No address, no license, or the name does not resolve to a real lab |
| 2 | Accreditation and scope | Certificate number, accreditation body, scope document | Expired, or potency method not on the scope |
| 3 | Lot match | Client lot, sample ID, sample type, sample date | Lot differs from the listing, invoice or bag |
| 4 | Internal math | THCA, delta-9 THC, total THC, basis | Total THC does not equal 0.877 × THCA + delta-9 |
| 5 | Panels | Pesticides, heavy metals, microbials, mycotoxins, water activity | Panels missing or marked “not tested” |
| 6 | Authenticity | Lab portal, QR link, direct contact | The lab cannot find the sample ID, or the client name differs |
Step 1: the lab is a real lab
Page 1 of a COA should name the lab, its street address, and any state license number it holds. Search the lab’s name and address independently. Visit the lab’s own website rather than a link in the PDF. A certificate from a lab with no public presence is the first warning.
Step 2: accreditation and scope
ISO/IEC 17025:2017 is the international standard for the competence of testing and calibration labs. An accreditation body audits a lab against it and issues a certificate with a scope: the list of methods the lab is accredited to run.
Two points buyers miss:
- Accreditation covers methods, not the lab as a whole. A lab can hold ISO/IEC 17025 for heavy metals and not for cannabinoid potency. Open the scope document and find the potency method by name, usually HPLC.
- Certificates expire. Check the expiry date on the scope against the test date on the COA.
Accreditation bodies publish searchable directories. In the US the main ones for cannabis labs include ANAB, A2LA and PJLA. Each is a signatory of the ILAC mutual recognition arrangement. Search the lab’s name in the body named on the COA and match the certificate number.
Step 3: match the lot
A COA describes one sample. Match these fields to the listing, the invoice and the bag label:
| Field on the COA | Must match | Why |
|---|---|---|
| Client lot / batch number | Lot on the listing, invoice and bag | The only link between the paper and the flower |
| Sample ID | The lab’s records | What you quote when you call the lab |
| Sample type (matrix) | “Flower” or “plant material” | A COA for an extract or pre-roll does not describe loose flower |
| Product or cultivar name | The listing | A different name is a different sample |
| Sample date and test date | After harvest, before the sale | An old test does not reflect today’s flower |
| Sample size | A composite of several grams from across the lot | A single-bud sample says little about a pound |
If the seller cannot supply a COA with your lot number on it, the lot has not been shown to be tested.
Step 4: check the math on the page
Recompute total THC from the two numbers beside it:
Total THC = delta-9 THC + (0.877 × THCA)
USDA defines total THC this way, on a dry-weight basis (7 CFR 990.1). Example: THCA 27.40% and delta-9 THC 0.22% give 24.25% total THC. If the printed total differs by more than rounding, ask the lab why.
Then check:
- Basis. “Dry weight” and “as received” give different numbers for the same sample. Dry weight = as received ÷ (1 − moisture fraction). Compare lots only on the same basis.
- Method. HPLC reports THCA and delta-9 THC separately. Gas chromatography heats the sample, which converts THCA during the test, so a GC-only result shows one THC number and no THCA. For a THCA lot, expect HPLC.
- Units. Percent and mg/g differ by a factor of 10: 1.0% = 10 mg/g.
- Sum of cannabinoids. Total cannabinoids should be at least THCA plus delta-9 THC. If it is lower, the page has an error.
Step 5: the contaminant panels
Potency is one panel of six. For flower that will be smoked, the others matter more to the buyer’s customers:
| Panel | What it covers |
|---|---|
| Pesticides | A multi-residue screen; the number of analytes is stated |
| Heavy metals | Arsenic, cadmium, lead, mercury, in µg/g |
| Microbials | Salmonella, pathogenic E. coli, total yeast and mold |
| Mycotoxins | Aflatoxins B1, B2, G1, G2 and ochratoxin A |
| Water activity / moisture | 0.55–0.65 aw is the range in ASTM D8197 |
| Foreign matter | Hair, insects, debris |
Federal hemp rules require growers to run a pre-harvest THC test. They do not require a contaminant panel on flower sold to the public. A potency-only COA is common and legal. For a bulk buyer, ask for the full panel, or weigh the missing tests when you compare lots.
Step 6: confirm with the lab
The PDF in your inbox came from the seller. Confirm it at the source:
- Open the result through the lab’s own portal or QR code, and check that the link goes to the lab’s domain.
- Compare the portal version with the PDF, field by field.
- If the lab has no portal, email or call the lab with the sample ID and ask it to confirm the client name, the lot and the THCA and delta-9 results.
An edited PDF looks identical to a real one. A lab confirmation closes that gap in one call.
Red flags
- The COA has no client lot number, or the lot is “N/A”.
- The same COA appears for several different products or cultivars.
- The test date is long before the harvest date the seller gives.
- Total THC on the page does not match the formula.
- Delta-9 THC sits just under 0.300% on every lot from one seller, while THCA varies widely.
- The lab’s accreditation scope does not list potency, or expired before the test date.
- The QR code points to a file host or the seller’s own site.
Why this matters more until 2026-12-11
As of 3 October 2026, a lot qualifies as federal hemp on its delta-9 THC result. From 2026-12-11 (P.L. 119-37 §781; date set by H.R. 6500) total THC decides it, THCA included (CRS IF13136). After that date, a verified COA showing high THCA proves the lot is not hemp. Keep your COA file for every lot you sold before the date.
In this store
Every product page links the COA for its lot, and the lab testing page explains the figures we print. To confirm a certificate, send us the lot number and ask for the lab’s contact details and sample ID.
Sources
- ISO/IEC 17025:2017: requirements for the competence of testing and calibration laboratories.
- ILAC MRA signatories.
- 7 CFR 990.1: USDA total THC definition.
- ASTM D8197: water activity range for dried cannabis flower.
- CRS IF13136, 2026-08-17.
Questions
How do I know a COA is real?
Open it from the lab's own portal or QR code, not only from the seller's PDF, and call or email the lab with the sample ID to confirm the results and the client name. Check that the lab's ISO/IEC 17025 accreditation is current and covers cannabinoid potency.
What does ISO/IEC 17025 accreditation mean for a cannabis lab?
ISO/IEC 17025:2017 is the international standard for testing-lab competence. An accreditation body audits the lab against it for a listed scope of methods. The potency method must be on the lab's scope for the accreditation to cover the THCA result.
How do I match a COA to the flower I received?
The client lot or batch number on the COA must match the lot on the listing, the invoice and the bag label. The sample type should be flower, and the sample date should fall after harvest and before the sale.