A Certificate of Analysis (COA) is a lab report from a third-party testing facility that tells you exactly what’s inside a gummy and, just as importantly, what isn’t. It’s the only way to verify whether the 15mg Delta-9 gummy you bought actually contains 15mg of Delta-9, whether it’s free of pesticides and heavy metals, and whether the brand’s claims match reality.
Most buyers never look at the COA. That’s a problem. An On Pattison audit of 47 gummy brands in February 2026 found potency variance of 15-23% across brands, meaning a “15mg” gummy from many brands could contain anywhere from 11mg to 19mg. BudPop’s variance was 2.1%. The COA is where you confirm those numbers before you buy.
BudPop publishes batch-specific COAs at budpop.com/lab-testing/. Below is how to read one.
The five sections of a COA
Section 1: Header (who tested what, and when)
The top of the COA shows: the testing laboratory name and accreditation (look for ISO 17025), the date of testing, the client name (the brand that submitted the sample), the sample name or batch number, and the date the sample was received.
What to check: Is the lab ISO 17025 accredited? This is the international standard for testing laboratories. If the COA doesn’t mention ISO accreditation, the lab may not meet quality standards. Is the test date recent? A COA from 2 years ago doesn’t represent current product quality. Does the batch number match the one printed on your product package? If the brand gives you a “representative” COA that doesn’t match your specific batch, the results may not apply to what you’re holding.
Section 2: Cannabinoid profile (the potency panel)
This is the section most buyers care about. It lists every cannabinoid detected and its concentration, typically in milligrams per gram (mg/g) or as a percentage.
What to check:
Does the Delta-9 THC per serving match the label? If the gummy claims 15mg D9 per piece, the COA should show approximately 15mg D9 per serving. Variance under 5% is good. Variance under 10% is acceptable. Variance over 15% means the manufacturing process isn’t well-controlled.
Is total THC under 0.3% by dry weight? For the product to be federally legal under the Farm Bill, the Delta-9 THC concentration must stay below 0.3% of the total product weight. The COA should explicitly state this compliance.
Are other cannabinoids listed? Full-spectrum and multi-cannabinoid products should show CBD, CBG, CBN, CBC, and/or other minor cannabinoids on the panel. If a product claims “full spectrum” but the COA shows only Delta-9 THC and nothing else, the claim is misleading.
ND vs LOQ: “ND” means Not Detected (the compound is below the lab’s detection limit). “LOQ” means Limit of Quantification (the lowest amount the lab can accurately measure). Seeing “ND” for Delta-9 THC on a CBD-only product confirms there’s no measurable THC present.
Section 3: Heavy metals testing
This panel checks for: arsenic, cadmium, lead, and mercury. These are the “big four” heavy metals that can accumulate in hemp plants from contaminated soil or water.
What to check: All four metals should show results below the state or federal action limits. Most COAs use California’s action limits (the strictest in the U.S.) as the benchmark. Results are reported in parts per million (ppm) or parts per billion (ppb). “Pass” means the levels are below allowable thresholds. Any “Fail” on heavy metals is a hard stop. Do not consume that product.
Section 4: Pesticide screening
This panel tests for dozens of pesticides and herbicides that may have been used during hemp cultivation. The exact list varies by state regulation, but common targets include myclobutanil, bifenthrin, chlorpyrifos, and others.
What to check: The overall result should be “Pass.” If any individual pesticide exceeds the action limit, the product fails. Some labs test for 60+ pesticides; others test for only the minimum required by state law. More pesticides tested = more thorough screen = more trustworthy result.
Section 5: Microbial and residual solvent testing
Microbial testing checks for: total yeast and mold count, E. coli, Salmonella, and sometimes total aerobic bacteria. These contaminants can enter during cultivation, extraction, or manufacturing. All results should be within acceptable limits or “Pass.”
Residual solvent testing checks for: butane, propane, ethanol, hexane, and other solvents used during extraction. If the product is labeled “solventless” (like live rosin), residual solvents should show ND across the board. For solvent-extracted products (distillate, live resin), residual levels should be below the action limits set by the testing state.
How to spot a fake or questionable COA
No lab name or accreditation number. Every legitimate COA identifies the testing lab by name and includes their license or accreditation number. If the document doesn’t identify who performed the test, it may be fabricated.
No batch number matching your product. If the COA batch number doesn’t match the batch code printed on your gummy package, the test results aren’t for your specific product. Some brands recycle old COAs for new batches. That defeats the purpose.
Perfect round numbers. Real lab results almost never land on exact whole numbers. A potency result of exactly “15.000 mg” per serving across every cannabinoid is suspicious. Real results look like “14.73 mg” or “15.26 mg” with decimal precision.
Missing test panels. A COA that shows only cannabinoid potency but no heavy metals, pesticides, or microbial testing is incomplete. A full COA covers all five sections. Brands that test only for potency may be hiding contamination issues.
QR code that links nowhere. Some brands print QR codes on packaging that claim to link to the COA. If the QR code leads to a dead page, a generic website, or a landing page rather than the actual lab document, the transparency claim is hollow.
BudPop’s COA approach
BudPop publishes batch-specific COAs from ISO-accredited third-party labs at budpop.com/lab-testing/. Each report covers cannabinoid potency, heavy metals, pesticides, residual solvents, and microbial screening. The batch codes on the COA match the batch codes printed on BudPop product packaging.
On Pattison’s February 2026 audit independently verified BudPop’s lab claims by purchasing products retail (not samples provided by the brand) and sending them to a separate lab for verification. The result: 2.1% potency variance on the Cosmic Punch D9 gummies, confirming the label accuracy.
This level of COA transparency isn’t universal. Many hemp brands publish no COAs at all, or publish only partial reports. Making COA verification a habit before purchasing any cannabinoid product is the single best protection against low-quality or mislabeled products.
THC RECOVERY PICKS
Feeling Too High From Edibles?
These hemp-derived products are popular for promoting calmer,
smoother, and more manageable THC effects.
Frequently asked questions
What does COA stand for?
Certificate of Analysis. It’s a document issued by a third-party laboratory that reports the chemical composition and safety testing results for a specific product batch.
Where do I find a brand’s COA?
Reputable brands publish COAs on their website, typically under a “Lab Testing,” “Lab Results,” or “COA” page. BudPop’s are at budpop.com/lab-testing/. If a brand doesn’t publish COAs online, that’s a red flag. You can also email the brand and request the COA for a specific batch number.
How often should COAs be updated?
Every production batch should have its own COA. A single COA should not be used to represent multiple batches produced months apart. If a brand’s most recent COA is more than 6 months old and they’re still producing new batches, the testing isn’t keeping pace with production.
Can a COA be faked?
Yes. Some disreputable brands create fabricated COAs with fake lab names. Verify by checking: is the lab name real? (search for it online). Does the lab have ISO 17025 accreditation? Can you call the lab and confirm they tested that batch? Most legitimate labs maintain online portals where COA results can be independently verified.
