What is a CBD COA?: 4 key things to look for on a CBD Certificate of Analysis

If you are in the market for CBD products, you may have already heard the term Certificate of Analysis or COA. If you haven't, you should have. The COA is your first tool for evaluating a CBD product or manufacturer. Just as not all CBD products are created equal, not all COAs are created equal.

A Certificate of Analysis is a document stating that specified goods have undergone specified testing at a specified lab with specified results. While this definition may sound obtuse, all four aspects of this definition are important to consider, before you choose to trust a COA.

The Specified Laboratory

A Certificate of Analysis should clearly show who performed the test. This information is typically located in the header and footer of every page of the report and will typically include:

• The name of the laboratory, contact information, and web address.
• A license number
• Accreditations
• Sampling Date/Testing Date
• A dated signature

This information is often overlooked as everyone rushes towards the results, but there are some important things to look for:

• Who is the testing entity? Google them. Where are they located? Do they share an address with the manufacturer? What does their web page look like? Is it professional and informative? These questions will tell you a lot about them, and perhaps their relationship with the manufacturer. Manufacturers should only be posting COAs from well established independent labs. If they are using a small, poorly marketed lab… you have to ask yourself why?
• Who accredited the lab? Anyone can buy testing equipment, and many unqualified people have jumped into cannabis and hemp testing in the last few years. Do they have an ISO certification? Is it the correct certification? The typical certification you will see is ISO 17025 which is reserved for analytical laboratories that do commercial testing. This certification verifies the quality, capability and expertise of the laboratory. It also shows a commitment to operational efficiency, quality management, and authentication models. You may sometimes also see an ISO 9001 certification. The ISO 9001 certification is typically not given to a commercial testing laboratory. ISO 9001 is a manufacturing certification that is sometimes extended to include an internal lab that does not perform outside analysis for other companies. An ISO 9001 certification (in the absence of an ISO 17025) on a COA should concern you.
• When was the sample processed? Cannabinoids degrade over time, and depending on how material is stored, this can range from 1-2% per year, to much higher if poorly stored. Typically a COA is valid for 12 months from the sampling date. An old COA is cause for concern.

The Specified Good

A Certificate of Analysis should clearly say what material was tested. This information, located in the header every page, should be your next stop after you determine that the testing lab is independent, and trustworthy.

• Account Name
• Sample Name
• Sample ID
• Test ID
• Sampling Date
• Testing Date
• Sometimes a photo or description of the sample

As above, this information isn't very exciting, but deserves your attention. You should be looking for a few key items:

• Does the account name match the manufacturer of the product? If not, why is the manufacturer using someone else's COA? This could mean that the “manufacturer” is actually a reseller, or it could mean that the incorrect COA has been provided...
• The sample name is selected by the manufacturer when the sample is submitted. Does it match the Lot number or Batch ID on your product? If a manufacturer is concerned about transparency, they should create a very direct and easy to follow connection from the COA to the product in your hand. The batch number should be easy to find on the product, and you should be able to easily find the COA on their website. If the sample name doesn't match the lot number of the product, it doesn't necessarily indicate a problem… but you should be asking why a manufacturer would not make it easy for consumers to connect the dots between the product and the correct COA?
• The Sample ID(s) and Test ID(s) are assigned by the lab. Every page of the COA should have the same Sample ID(s). The Test ID will change for each test that was performed.
• Does the photo or description match the product. Some manufacturers will post COAs for the extract or plant material that the finished product was made from. Others will post just the COA for the finished product. In the absence of a photo or description, you can sometimes tell which you are looking at by reading the actual test results. Each of these approaches has its own shortcomings. Ideally you want to see COAs for the extract and the finished product (see 1 Question You Have To Ask Before Buying CBD).

The Specified Test

A Certificate of Analysis should clearly indicate what test(s) were performed. Every section of the test results should have a header indicating several parameters:

• What test was performed
• What unit of measure the results are in
• The exact time and date of the test
• The Analysis method or SOP used

There really isn't a whole lot to inspect here. The most important part is to understand what results are being presented, and which ones are not. There is very little regulation of testing in CBD products, but any quality product should be backed by a COA that includes at a minimum:

• Pesticide contamination test on the extracted material
• Heavy Metals contamination test on the extracted material
• Residual solvent test on the extracted material
• Potency test on the finished product
• Pesticide test on the finished product
• Heavy Metals test on the finished product

Many manufacturers will only provide a COA for finished potency. This should greatly concern you. In my next post (The Final Question You Have To Ask Before Buying CBD), we will discuss in more detail why each of these tests is necessary, and how to read the results.

• Labs should also indicate which of their documented procedures were performed to get the results they present, and exactly when the test was performed.
• Large differences in the date on the specified test and the date on the report can indicate a report has been altered.

Each test (potency, pesticide, etc) that is included in a COA should be accompanied by a Quality Control section. Often these sections make up more than half of the COA.

The Quality Control section is basically a calibration log… every lab is required to re-calibrate their instruments frequently. While the actual data presented in these sections is beyond the scope of this discussion, and in many ways irrelevant beyond seeing that calibration is occurring… The presence of these sections in the COA is relevant. An absence of QC sections indicates that either the lab is not following procedure, or that the manufacturer is not presenting the COA in its entirety. Either should cause concern.

The Specified Results

A Certificate of Analysis should clearly indicate what results were observed for each test. This is the part of the COA most people rush to, and it often is the only part of the COA that is provided by the manufacturer. Specific results are meaningless unless presented as part of the COA in its entirety. In my next post (The Final Question You Have To Ask Before Buying CBD) we will talk about interpreting specific results, and how to read between the lines.

A Final Note

The final test I use before I look at specific results in a COA, is to look at the document as a whole.

• Is the formatting consistent?
• Is it displayed clearly?
• Is the background color and pattern uniform?
• Are the dates the same throughout?
• Does anything seem out of place?

A Certificate of Analysis is a form document that the producing lab plugs data into, signs, and releases thousands of times for different clients. Only the numbers change. The formatting is consistent and boring. It If something catches your eye when you glance at it… you should look more closely.

This may seem like the height of paranoia, but it comes from experience. Don't waste your time looking at the results section until you make a conscious decision to trust the COA. Certificates of Analysis get altered or reused frequently. I have had companies try to sell me extracts with my own COA after they changed the company name. I have encountered more than one “reputable” CBD manufacturer with altered COAs posted on their website.

Look at all the key parts of the COA and ask yourself:

Is there anything about this COA that causes me concern?

So what do you do if you encounter a COA that concerns you? If there are a lot of issues that cause concern, the answer is pretty simple… don’t buy from that company. Move on.

But, what happens if something just doesn't seem quite right? Or if you aren’t comfortable with your own ability to evaluate a COA? Contact the testing laboratory. Email them the entire COA as it is presented to you, and ask them to verify it.

You may receive a verification response, in which case you know that the COA has not been altered. And it is time to interpret the results!

On the other hand, you may receive a different kind of letter... Like this one. We received this letter when we attempted to verify a COA from a national pet CBD manufacturer after noticing a different font being used on part of the COA.

In our next post (The Final Question You Have To Ask Before Buying CBD) we will talk about the next step, interpreting the results, and reading between the lines to make sure the results accurately represent the product.