Certificate of Analysis (COA)
Last reviewed · By Chad Griffith
A Certificate of Analysis (COA) is the laboratory-issued document that reports the results of required testing for a cannabis batch or harvest lot. State Cannabis Regulatory Authorities require COAs covering some combination of: cannabinoid potency (THC, CBD, total cannabinoids), terpene profile, microbial contamination (E. coli, salmonella, total yeast/mold), pesticide residue, heavy metals (lead, arsenic, cadmium, mercury), residual solvents (for extracts), water activity, foreign material, and homogeneity (for edibles). COAs must be retained per state retention rules (typically 3-7 years) and provided on request to regulators, retailers, and in some states consumers via QR code. Testing must be performed by an ISO/IEC 17025-accredited lab licensed by the state.
Frequently Asked Questions
What information must a COA contain?
Required COA elements typically include: lab name and license number, ISO 17025 accreditation reference, sample collection date and method, batch/lot ID matching METRC, all required test panels and pass/fail status, exact analyte values with units, action limits used, lab director or qualified individual signature, and report date. Specific format requirements vary by state — California's DCC publishes mandatory COA template requirements in CCR Title 4 Section 15724.
How long must COAs be retained?
Retention varies by state. California requires 7-year retention of all cannabis transaction records under CCR Title 4 Section 15049. Colorado's MED requires 3-year retention. Michigan CRA requires at least 5 years under R 420.501. Multi-state operators must apply the longest-retention state's rule across the corpus to maintain consistency. Both physical and electronic retention are acceptable if records are accessible to regulators on demand.
Who pays for COA testing?
The licensee (cultivator, processor, or distributor) submitting the sample for testing pays the lab fee. Testing costs typically run $250-$700 per full panel depending on state requirements and lab. In some states, distributors are required to commission and pay for testing under chain-of-custody requirements (California's distributor-led testing model). Costs are baked into wholesale pricing.
What happens if a COA fails?
Failed batches must be remediated (re-tested after corrective action), reprocessed, or destroyed and reported to METRC. Pesticide failures generally cannot be remediated. Microbial failures may be remediated through extraction in some states. Heavy metal failures require destruction. State CRAs receive failed-test reports automatically through state-level lab reporting systems and may follow up with inspections.
Authoritative sources
Related terms
FileFlo classifies and tracks compliance documents against rule packs that map directly to the regulators referenced above. Run a free CFR-cited audit →