How to Read a Certificate of Analysis

Q: What does 'reported only' mean on a CoA?

It means no specification was supplied for that test, so the result is listed without a pass or fail. The number can still be useful, but only you can decide whether it is acceptable. Send your limits with the sample when you want each result judged against them on the report.

Q: Is a result just above the LOQ reliable?

It is a measured value, but it carries more relative uncertainty than results well above the LOQ, because the LOQ is the lowest level the method quantifies with suitable precision and accuracy. If a decision depends on a value near the LOQ or near your limit, a retest from reserve units helps confirm it.

Q: How do I check that a CoA is genuine?

Contact the issuer with the report number and lot number and ask it to confirm the results, or use a verification link or code the issuer provides. Compare the copy you hold with the issuer's copy line by line, because an altered report often differs in a single digit, unit or date.

Q: Does a passing CoA mean a product is safe?

Not on its own. A CoA reports what was measured in one sample against the limits listed. It says nothing about analytes that were not tested, other lots, or how the product is used. A useful review compares the tests on the report with the limits that actually apply to the product and its market.

Q: Why do two labs report different results for the same product?

Results can differ because the labs used different methods, limits of quantitation, sample preparation or reporting basis, such as per gram versus per serving, or because they tested different units from the lot. Compare the method, LOQ and basis on both reports before comparing the numbers themselves.

What does an annotated sample CoA look like?

The table below is a made-up report for a fictional hemp extract tincture. Every value is illustrative. The specification column shows a brand’s own example limits, except the per-container THC line, which mirrors the federal hemp definition discussed further down.

Sample CoA, illustrative values. Fictional product: Example Botanicals Hemp Extract Tincture, lot SAMPLE-0425, net weight 28 g, serving 1 g, label claim 33 mg CBD per serving. Not a real report.

Test	Method	Result	LOQ	Specification	Status
CBD	HPLC-DAD	32.1 mg/g = 32.1 mg per serving (97.3% of label claim)	0.05 mg/g	90–110% of label claim	Pass
CBG	HPLC-DAD	0.84 mg/g	0.05 mg/g	None set	Reported only
Δ9-THC	HPLC-DAD	<LOQ	0.02 mg/g	None set	Reported only
THCA	HPLC-DAD	ND	0.02 mg/g	None set	Reported only
Total THC per container	Calculated: (Δ9-THC + 0.877 × THCA) × 28 g	<1.05 mg	Derived from LOQs	Not more than 0.4 mg per container (total THC and similar cannabinoids)	Cannot confirm
Lead	ICP-MS	0.018 µg/g (18 ppb)	0.005 µg/g	0.10 µg/g maximum	Pass
Arsenic, total	ICP-MS	<LOQ	0.010 µg/g	0.10 µg/g maximum	Pass
Total yeast and mold	Plate count	<10 CFU/g	10 CFU/g	1,000 CFU/g maximum	Pass
Salmonella	Culture	Not detected in 10 g	Not applicable	Not detected	Pass

Read it in this order: lot number and dates first, then each row’s units, LOQ and specification, and only then the status. Two rows carry the lessons. CBG has no specification, so it has no verdict. Total THC per container shows “Cannot confirm” because the method’s LOQ is too high to prove the product sits under the line, as the next section explains.

What do LOD, LOQ, ND and <LOQ mean?

The international validation guideline ICH Q2(R2) defines the two limits that sit behind every low result:

Detection limit (LOD or DL): “the lowest amount of an analyte in a sample which can be detected but not necessarily quantitated as an exact value.”
Quantitation limit (LOQ or QL): “the lowest amount of analyte in a sample which can be quantitatively determined with suitable precision and accuracy.” Under the guideline’s signal-to-noise approach, a ratio of 3:1 is generally acceptable for estimating the DL and at least 10:1 for the QL.
ND (not detected): no signal at or above the detection limit. It does not mean zero.
<LOQ: below the level the method can put a reliable number on. Some may be present.

Either entry is only as strong as the limit next to it. In the sample, the THC and THCA LOQs are both 0.02 mg/g. Adding the THC LOQ and 0.877 × the THCA LOQ, then multiplying by the 28 g in the container, up to about 1.05 mg could go unreported, which is above the 0.4 mg per container line. Under the amended federal definition of hemp, final hemp-derived cannabinoid products containing more than 0.4 mg combined total per container of total THC and other cannabinoids with similar effects are excluded from hemp; per the Congressional Research Service (IF13136, 28 September 2026), that portion takes effect on 11 December 2026. To show a 28 g product is under the line, each LOQ would need to be below about 0.0076 mg/g (0.4 mg ÷ (28 g × 1.877)).

Figures checked against the sources below on 3 November 2026; rules change, so confirm the current version before relying on them.

Which units appear on a CoA and how do they convert?

Common CoA units and exact conversions

Unit	Meaning	Typical use	Equivalent
% w/w	Grams per 100 g of product	Cannabinoids in extracts, moisture	1% = 10 mg/g = 10,000 ppm
ppm	Parts per million by weight	Heavy metals, residual solvents	1 ppm = 1 µg/g = 1 mg/kg
ppb	Parts per billion by weight	Trace metals	1 ppb = 1 ng/g; 1,000 ppb = 1 ppm
µg/g	Micrograms per gram	Heavy metals	Same value as ppm
mg per serving	Amount in one labeled serving	Potency, Supplement Facts values	mg/g × serving size in g
% of label claim	Measured amount ÷ declared amount × 100	Potency	32.1 mg ÷ 33 mg × 100 = 97.3%
CFU/g or CFU/mL	Colony-forming units per gram or milliliter	Microbial counts	“<10 CFU/g” means below the lowest count the method reports

Concentration units describe the product, not a dose. To compare a heavy metal result with a daily limit, convert it with your serving size as shown on the heavy metals testing page, then check it against the figures in heavy metal limits.

How do you judge pass or fail against a specification?

No specification, no verdict. A status column means something only where a limit was supplied with the sample.
Same basis on both sides. An as-is result cannot be checked against a dry-weight limit, and a per-gram result cannot be checked against a per-day limit without converting it first.
Know the label rules behind potency. FDA checks Supplement Facts declarations on a composite of 12 consumer packages or 10 percent of the packages in the inspection lot, whichever is smaller (21 CFR 101.36(f)(1)). For Class I nutrients, added to the product, the composite must be at least equal to the declared value; for Class II, naturally occurring, at least 80 percent of it (21 CFR 101.9(g)(4)). Section 101.36(f)(1) applies these criteria to other dietary ingredients too. A single result is not that composite, but an added vitamin below 100% of label claim is a warning sign even if it passes a 90–110% internal specification.
Treat results near a limit with care. Every measurement has uncertainty. For a result just inside or outside a limit, a retest from reserve units shows whether it holds.

Figures checked against the sources below on 3 November 2026; rules change, so confirm the current version before relying on them.

What should you check on a CBD or hemp CoA?

THCA is reported. The USDA hemp rule defines total THC as (0.877 × THCA) + THC (7 CFR 990.1), so a report without THCA cannot support a total THC figure.
Finished products show per serving and per container figures. Once the per-container portion of the federal definition takes effect, a percentage alone will not answer the question for gummies, drinks or tinctures.
The LOQ fits the container. Repeat the calculation above with your own container weight.
The CoA matches the product form. An extract or distillate CoA does not describe the gummy or oil made from it.

Panels by product type are on the hemp and CBD testing page.

What are the red flags on a certificate of analysis?

No lot number, or a lot number that differs from the one printed on the package.
No method named for a result. For supplier CoAs that supplement makers rely on, 21 CFR 111.75(a)(2)(ii)(B) requires a description of the methods used.
No LOQ, or ND entries with no detection or quantitation limit anywhere on the report.
Results for a different lot, product or form, such as last year’s lot or the bulk extract instead of the finished product.
Dates out of order, such as a report issued before the sample was received, or tests dated before the lot was made.
Signs of editing: mismatched fonts or spacing in one figure, missing pages (“page 2 of 3” with no page 3), or a PDF that differs from the issuer’s own copy.
A pass with no specification, or results with no units or basis.

When something looks wrong, send the report number and lot number to the issuer and ask it to confirm the results. For what a complete CoA should contain, see certificate of analysis.

Questions about this page

What does 'reported only' mean on a CoA?

It means no specification was supplied for that test, so the result is listed without a pass or fail. The number can still be useful, but only you can decide whether it is acceptable. Send your limits with the sample when you want each result judged against them on the report.

Is a result just above the LOQ reliable?

It is a measured value, but it carries more relative uncertainty than results well above the LOQ, because the LOQ is the lowest level the method quantifies with suitable precision and accuracy. If a decision depends on a value near the LOQ or near your limit, a retest from reserve units helps confirm it.

How do I check that a CoA is genuine?