How to Read a CBD Certificate of Analysis (COA): A Step-by-Step Guide | PureCraft CBD

Buyer's Guide  |  This article is for educational purposes — helping consumers make informed purchases of CBD products. PureCraft CBD publishes current batch COAs for all products at purecraftcbd.com/pages/faq. CBD products are supplements, not FDA-approved medications. Third-party COA verification is the consumer's primary protection against inaccurate labeling and contamination. PureCraft CBD products are not intended to diagnose, treat, cure, or prevent any disease.

 

Why the COA Is the Most Important Document in CBD Buying

A2017 study in JAMA tested 84 commercially available CBD products and found that only 31% were accurately labeled — 26% contained less CBD than stated, 43% contained more, and 21% contained detectable THC even when labeled as THC-free. A2019 follow-up analysis found similar rates of mislabeling. The CBD industry is unregulated in the pharmaceutical sense — the FDA does not pre-approve CBD supplements before they reach market. The consumer's primary protection is the third-party Certificate of Analysis.

 

A COA is an analytical report produced by an independent laboratory that tested a specific batch of CBD product. It tells you what's actually in the product — not what the label claims is in it. Reading a COA takes about 5 minutes once you know what to look for, and it is the single most important thing you can do before buying any CBD product.

 

This post is a supporting post in PureCraft's Buyer's Guide cluster. For the broader context of what to look for in a CBD brand, seeWhat Makes a Good CBD Brand?. For understanding what spectrum type the COA is verifying, seeFull-Spectrum vs Broad-Spectrum vs CBD Isolate: The Complete Guide. PureCraft's current batch COAs are available atpurecraftcbd.com/pages/faq.

 

Before You Read the COA: Three Verification Checks

Before diving into the analytical results, three structural checks confirm the COA is worth reading at all:

 

Check 1: Is This an Independent Third-Party Lab?

The most important check. A COA is only meaningful if it was produced by a laboratory with no financial or ownership relationship with the company selling the product. In-house testing (the company's own lab) or testing by a lab owned by the same parent company is a significant red flag — not because the results are necessarily fraudulent, but because independent verification is the entire point of third-party testing.

 

What to look for: the lab's name and address should be clearly stated on the COA, and you should be able to find the lab independently — it should have its own website, accreditation, and client list that includes companies other than just the CBD brand you're evaluating. Look for ISO 17025 accreditation or, in the US, DEA registration for cannabis-testing labs. These accreditations mean an external auditing body has verified the lab's methods and competency.

 

Check 2: Does the Batch Number Match Your Product?

A COA is batch-specific — it applies to a single production run, not to the product line as a whole. A legitimate COA will have a batch number (or lot number) clearly stated, and that number should match the batch number on your product's label or packaging. A COA without a batch number, or one where the batch number doesn't match your product, means the testing may not apply to what you actually received.

 

Check 3: How Old Is the Test?

COAs should be current — within 12 months, ideally within 6 months. An older COA may accurately reflect a past batch but does not tell you anything about the current formulation or production run, which may have changed. Premium CBD brands update COAs with each new production batch. If the COA on a company's website is dated more than 12–18 months ago, that is a quality signal worth noting.

 

The Seven COA Sections: What Each Tells You

 

 

COA Section	What It Tests	Units / How Reported	What PASS Looks Like	Red Flags — Stop Buying
Cannabinoid Profile (most important section)	CBD concentration per serving/mL; THC; CBG; CBC; CBN; other cannabinoids present; verifies label accuracy and spectrum type	mg/mL or mg/serving; percentage of total extract weight; sometimes % by dry weight	CBD within 10–15% of label claim; THC 'ND' (not detected) for broad-spectrum products or below 0.3% for full-spectrum; minor cannabinoids present (CBG, CBC) for broad/full-spectrum	CBD more than 20% below label claim (underpotency); THC present above 0.3% in any product; THC present at all in labeled broad-spectrum; entire section blank or missing
Heavy Metals (arsenic, cadmium, lead, mercury)	Contamination from soil bioaccumulation — hemp draws metals from the ground; essential safety test for ingested products	μg/g (micrograms per gram) or ppm; compared against state limits or USP/ISO action levels	All four metals below action limits; most premium products show ND (not detected) for all four; some state limits are more stringent than federal guidelines	Any metal above action limits; incomplete panel (only 1–2 metals tested); no metal testing at all; generic 'passed' without specific values
Pesticides & Herbicides	Agricultural chemical residues from hemp farming; hemp grown without proper organic certification may contain multiple pesticide residues	μg/g or ppb; compared against state action levels; comprehensive panels test 50–100+ compounds	All pesticides ND or below action limits; comprehensive panel (40+ compounds); independent lab tested	Any positive detection above action limits; very short panel (fewer than 20 compounds — may miss common pesticides); no pesticide testing
Microbials (E. coli, Salmonella, Staph aureus, yeast/mold)	Bacterial and fungal contamination from plant material, processing, or storage; especially critical for edibles, gummies, and capsules	CFU/g (colony-forming units per gram); absent/present for pathogens; compared against USP limits for supplements	All pathogens absent; yeast/mold within USP limits; only relevant for ingested/edible products — less critical for topicals	Any pathogen detected (E. coli, Salmonella); yeast/mold above limits; section missing for gummies/capsules/ingested products
Mycotoxins (aflatoxins B1/B2/G1/G2, ochratoxin A)	Mold-produced toxins that persist even after mold is eliminated; hepatotoxic and carcinogenic at high exposures; testing is separate from general microbial testing	μg/kg or ppb; compared against EU/USP/state limits; aflatoxin total limit typically 20 μg/kg	All mycotoxins ND or below limits; aflatoxin total below 20 μg/kg; section included for ingested products	Any mycotoxin above limits; section completely absent for products that are ingested
Residual Solvents	Extraction chemicals remaining in final product; ethanol extraction leaves trace ethanol; solvent extraction (butane, hexane, propane) may leave harmful residues; CO2 extraction is cleanest	ppm; compared against Class 1/2/3 ICH Q3C solvent limits	All solvents ND or below ICH limits; CO2-extracted products typically show clean profiles across all solvents; ethanol trace below limit is acceptable	Class 1 solvents (benzene, hexane) detected above limits; butane above limits; any solvent above ICH Class 2 limits
Test Metadata (lab identity, date, batch number)	Not a test — but essential verification of COA authenticity and applicability to the specific product batch being purchased	Text fields on COA header/footer	Independent third-party lab (name, CLIA/ISO accreditation); test date within past 12 months; batch number matching product label; QR code or URL that resolves to the actual lab report	Lab is the manufacturer's own subsidiary or in-house; date more than 12–18 months old; no batch number; QR code points to a generic company page rather than the actual lab report; lab not accredited

 

 

Section 1: The Cannabinoid Profile — The Most Important Page

The cannabinoid profile is the heart of the COA — it tells you what's actually in the product and verifies label accuracy. This is where most consumers should spend the majority of their COA-reading time.

 

How to Verify CBD Potency

Find the CBD (cannabidiol) concentration on the COA. It will typically be expressed as mg/mL or mg/serving. To verify against the label:

 

 

How to Read the THC Result

For broad-spectrum products:look for 'ND' (not detected) next to Δ9-THC. This is the critical verification that the product truly contains zero THC. 'ND' means the compound was tested for and fell below the method's detection limit — it is not simply a blank field. If the THC field shows a number (even 0.01%), that is not ND — that is a detectable trace.

 

For full-spectrum products: look for THC at or below 0.3%. If the COA shows THC above 0.3%, the product is technically out of federal hemp compliance and should not be purchased.

 

THCA — The Hidden THC Concern

Many COAs report Δ9-THC and THCA separately. THCA is the acidic precursor to THC in raw hemp — it is non-psychoactive in its raw form but converts to Δ9-THC when heated (decarboxylation). Some states calculate 'total THC' as Δ9-THC + 88% × THCA, which can push products over the 0.3% limit even when Δ9-THC alone is below. For most consumers using tinctures sublingually (not heated), THCA is not a meaningful drug test concern. But for people in states with total-THC calculations or those heating their CBD products, THCA matters. PureCraft's broad-spectrum products show ND for both Δ9-THC and THCA. For the full drug test context, seeCBD and Drug Testing: Will CBD Show Up on a Drug Test?.

 

Minor Cannabinoids as Entourage Verification

If you're buying a broad-spectrum or full-spectrum product, the cannabinoid profile should show more than just CBD. Look for detectable levels of CBG (cannabigerol), CBC (cannabichromene), and CBN (cannabinol) — even if small. Their presence confirms the product contains the minor cannabinoid entourage compounds that make broad-spectrum more effective than isolate. If the profile shows only CBD and nothing else, the product may actually be isolate-based despite being labeled as broad-spectrum. For the entourage effect science, seeFull-Spectrum vs Broad-Spectrum vs CBD Isolate: The Complete Guide.

 

Section 2: Heavy Metals — Why Hemp's Soil-Cleaning Properties Matter Here

Hemp (Cannabis sativa) is a phytoremediator — it actively draws heavy metals and other soil contaminants into its tissues as it grows. This is actually why hemp was planted at Chernobyl to help decontaminate radioactive soil. For CBD consumers, this same property means that hemp grown in contaminated soil can concentrate metals like arsenic, cadmium, lead, and mercury into the plant biomass that is then extracted into your CBD oil.

 

The four metals tested and their health significance:

 

 

A quality COA shows ND (not detected) for all four metals, or values well below the relevant action limits (typically set by state cannabis regulations, California Prop 65, or ISO 10993 standards). PureCraft sources hemp exclusively from USA-grown, regulated agricultural operations where soil quality is monitored — and batch COAs confirm heavy metal levels.

 

Section 3: Pesticide Testing — The Panel Size Matters

Not all pesticide panels are equal. A comprehensive pesticide panel tests for 50–100+ individual pesticide compounds. A minimal panel might test for only 10–15 of the most commonly used pesticides. The difference matters because a CBD brand can pass a 10-compound panel while using pesticides that are not in the panel — technically passing but not actually testing for everything relevant.

 

What qualifies as comprehensive: at minimum, the panel should include the full list of pesticides that regulated state cannabis programs require — typically 60–80 compounds. California's cannabis regulations, for example, require testing for over 60 pesticides and are considered the most rigorous benchmark in the US. A COA that shows 'all pesticides — ND' for a 12-compound panel is not providing meaningful assurance.

 

For pesticide testing specifically, look for the number of compounds tested alongside the results. Premium CBD brands like PureCraft test against comprehensive panels matching or exceeding state cannabis program requirements.

 

Section 4: Microbials and Mycotoxins — Most Important for Edibles

Microbial testing is particularly critical for CBD products you ingest — gummies, capsules, tinctures. Bacterial contamination (particularly E. coli and Salmonella) and mold contamination can cause significant illness in immunocompromised individuals, elderly consumers, and people with gut health conditions.

 

Mycotoxins — toxins produced by mold that persist even after the mold itself is eliminated — are tested separately from general microbial testing and are particularly relevant for hemp that was improperly stored or dried. Aflatoxins (produced by Aspergillus mold species) are hepatotoxic and classified as Group 1 carcinogens by the IARC. A COA for an ingested CBD product that does not include mycotoxin testing has a meaningful gap in its safety profile.

 

For CBD topicals (creams, balms), microbial testing is less critical since the product is not ingested — though it remains good practice for comprehensive quality assurance.

 

Section 5: Residual Solvents — What the Extraction Method Left Behind

CBD extraction uses solvents to separate cannabinoids from hemp plant material. The most common methods: CO2 extraction (supercritical carbon dioxide — cleanest profile, most expensive equipment), ethanol extraction (food-grade ethanol — widely used, produces clean profiles when properly purged), and hydrocarbon extraction (butane, propane, hexane — lower cost, higher residual solvent risk if not properly purged). For the full extraction science, seeHow CBD Is Made.

 

Residual solvents are classified by ICH Q3C guidelines into three risk categories:

 

 

The residual solvents section of a COA from a CO2-extracted or properly purged ethanol-extracted product should show ND or trace levels well below limits for all compounds. Any detectable Class 1 or high Class 2 solvent is an absolute disqualifier.

 

CBD COA Abbreviations Decoded

COAs use technical shorthand that can make them confusing to read. This reference table explains the most common terms:

 

 

Abbreviation / Term	What It Means	Good or Bad?	Context
ND	Not Detected — the compound was tested for and was below the method's limit of detection; effectively zero at analytical sensitivity	Good — expected for THC in broad-spectrum products; expected for heavy metals, pesticides, pathogens in quality products	THC: ND on a broad-spectrum COA confirms zero THC. Metals/pesticides: ND means clean.
LOD	Limit of Detection — the smallest amount the testing method can detect; if a result is ND, the actual amount (if any) is below this threshold	Neutral — lower LOD means more sensitive detection; knowing the LOD helps interpret ND results	If THC LOD is 0.01%, ND means less than 0.01% THC. Better LOD = more confidence in ND.
LOQ	Limit of Quantification — the smallest amount the testing method can accurately measure; above LOD but below LOQ means 'detected but not precisely measurable'; often reported as <LOQ	Neutral — understand that <LOQ doesn't mean zero; it means trace	THC <LOQ might mean there is a tiny amount but less than the measurement threshold; for drug testing purposes, <LOQ on a verified independent COA is generally safe
ppm	Parts Per Million — concentration unit for trace contaminants; equivalent to mg/kg	Neutral — unit of measurement; check against limits for each compound	Heavy metals often measured in ppm; pesticides in ppb (parts per billion, 1000x more sensitive)
ppb	Parts Per Billion — concentration unit for very low-level contaminants; equivalent to μg/kg	Neutral — more sensitive unit than ppm; pesticides and mycotoxins typically measured in ppb	Aflatoxin limit of 20 μg/kg = 20 ppb; ppb values should be well below limits
mg/mL	Milligrams per milliliter — concentration unit for CBD and other cannabinoids in liquid extract	Neutral — the most useful unit for verifying label accuracy in CBD oil; divide total mg by volume in mL to calculate	A 1000mg/30mL bottle should test at ~33.3 mg/mL CBD on the COA
HPLC	High-Performance Liquid Chromatography — the most common analytical method for cannabinoid quantification; highly accurate and reproducible	Good — HPLC is the gold standard for cannabinoid testing; shows the lab uses appropriate methodology	Seen in COA method section; alternative is GC (gas chromatography) which is less accurate for cannabinoids due to heat degradation
ISO 17025 / CLIA	International Organization for Standardization / Clinical Laboratory Improvement Amendments — laboratory accreditation indicating the lab meets rigorous quality and competency standards	Good — only use COAs from accredited labs; accreditation means external auditing of methods and results	Look in COA header or lab profile; accredited labs list their accreditation number
Δ9-THC	Delta-9 THC — the primary psychoactive cannabinoid in cannabis; the compound targeted by drug tests; the 0.3% federal hemp limit refers to Δ9-THC	Neutral — understand which THC is being reported; some COAs separately report Δ8-THC, THCA, and Δ9-THC	The legally and drug-test-relevant THC; broad-spectrum should show ND for Δ9-THC specifically
THCA	Tetrahydrocannabinolic acid — the precursor to THC in raw hemp; converts to THC when heated (decarboxylation); non-psychoactive in raw form but contributes to 'total THC' by some measurement standards	Important context — some states calculate 'total THC' as Δ9-THC + 88% × THCA, which can push products over 0.3%; reputable COAs report THCA separately	Hemp plants can have meaningful THCA even when Δ9-THC is below 0.3%; if total THC calculation is required in your state, verify THCA is also low

 

 

How to Find and Verify a CBD COA

Where to Find the COA

 

How to Verify the COA Is Authentic

 

Reading PureCraft's COA: What You'll See

PureCraft publishes independent third-party batch COAs for every product atpurecraftcbd.com/pages/faq. Here is what to expect from a PureCraft COA:

 

 

PureCraft'sCBD Oil 1000mg,CBD Oil 2000mg,CBD+CBN Sleep Gummies, andCBD Topicals all carry current batch COAs. If you have a question about a specific COA or batch number, PureCraft's customer service can assist.

 

Frequently Asked Questions

 

What is a COA for CBD?

A COA (Certificate of Analysis) is an analytical report produced by an independent third-party laboratory that tested a specific batch of CBD product. It documents what the product actually contains — CBD concentration, THC level, presence of contaminants (heavy metals, pesticides, microbials, residual solvents) — independent of what the manufacturer claims on the label. Given the2017 JAMA study finding that 69% of commercially available CBD products were inaccurately labeled, the COA is the consumer's primary and most reliable tool for verifying they're getting what they paid for. Any CBD brand unwilling to share a current, batch-specific, independent-lab COA should be treated with significant skepticism.

 

How do I know if a COA is real?

Three verification steps: (1) Google the testing laboratory independently — it should have a website, accreditation, and an existence outside of the CBD brand's website. (2) Check for ISO 17025 or state cannabis testing accreditation on the COA — these are third-party verified credentials. (3) If the COA has a URL or QR code linking to the lab's own database, open it and confirm the report appears in the lab's own system. A COA that only exists on the manufacturer's website without independent lab verification cannot be fully trusted. PureCraft's COAs are produced by independent accredited laboratories and can be verified through the lab directly. Access them atpurecraftcbd.com/pages/faq.

 

What should I look for in a CBD COA?

In order of priority: (1) CBD potency within 10–15% of the label claim; (2) THC 'ND' (not detected) for broad-spectrum products — not a small number, actually ND; (3) heavy metals (As, Cd, Pb, Hg) all below action limits or ND; (4) comprehensive pesticide panel with all results ND or below limits; (5) microbials absent for ingested products; (6) mycotoxins ND; (7) residual solvents ND for Class 1 and 2 compounds; (8) test performed by an independent, accredited lab with a batch number matching your product, dated within 12 months.

 

What does cannabinoid potency mean on a COA?

Cannabinoid potency refers to the concentration of each cannabinoid in the product — primarily CBD (the labeled therapeutic compound) but also THC, CBG, CBC, CBN, and others. For CBD specifically, potency on the COA should match the label claim within analytical variability (±10–15%). If the COA shows significantly less CBD than labeled, you are paying for CBD you're not getting. If it shows significantly more, the manufacturer is under-labeling (which may actually be intentional to avoid regulatory scrutiny at higher doses). Either large deviation from the label claim is a quality concern.

 

What are acceptable heavy metal levels in CBD?

Most state cannabis programs use limits aligned with USP Chapter 232 (pharmaceutical metals limits) or more stringent state-specific limits. As a practical benchmark: lead below 0.5 ppm; arsenic below 1.5 ppm; cadmium below 0.5 ppm; mercury below 0.15 ppm are widely cited acceptable limits. Premium CBD products from quality-controlled USA-grown hemp typically show ND (not detected) for all four metals, well below these thresholds. Any result approaching or exceeding these limits is a safety concern for a daily-use supplement.

 

What does 'ND' mean on a CBD COA?

ND means 'Not Detected' — the laboratory tested for this compound using validated analytical methods and it was not found above the method's limit of detection. ND is not the same as zero — a tiny amount might theoretically exist below the detection limit — but for practical purposes, ND means the compound is absent at any analytically meaningful level. For THC on a broad-spectrum COA, ND is the expected and correct result. For heavy metals, pesticides, and pathogens, ND is the ideal outcome indicating a clean product.

 

How often should a CBD company update their COAs?

With every new production batch — ideally. A responsible CBD brand tests each batch independently and makes the batch-specific COA available to customers. For high-volume producers, this may mean monthly or quarterly updates to the published COA. At minimum, COAs should be updated at least annually and whenever the supplier, formulation, or manufacturing location changes. A company with a COA dated more than 18 months ago on their website has not demonstrated the ongoing quality commitment that batch testing requires. PureCraft updates COAs with each new production batch.

 

What happens if a CBD product fails testing?

In the regulated state cannabis markets (California, Colorado, Nevada, etc.), a product that fails testing for THC, heavy metals, pesticides, or microbials cannot legally be sold — it must be quarantined, remediated if possible, or destroyed. In the unregulated hemp CBD supplement market, failure consequences are less uniform — FDA enforcement of failed hemp products has been limited. This is exactly why independent third-party testing is consumer-driven rather than mandatory: the consumer asking for and verifying COAs is the quality enforcement mechanism that regulatory gaps leave to the market. Brands that publish failing COA results (and how they addressed them) are demonstrating more transparency than brands that simply do not publish COAs.

 

The Bottom Line: Make COA Verification a Non-Negotiable

The COA is not optional paperwork — it is the only objective evidence that a CBD product contains what it claims, is free of harmful contaminants, and was produced to the quality standards the brand claims to uphold. Given the documented history of mislabeling and contamination in the CBD industry, purchasing any CBD product without a current, batch-specific, independent-lab COA is buying blind.

 

The five-minute COA check:(1) Confirm the lab is independent and accredited. (2) Match the batch number to your product. (3) Verify CBD potency within 15% of label. (4) Confirm THC is ND for broad-spectrum or below 0.3% for full-spectrum. (5) Check that metals, pesticides, and microbials pass. Five minutes, five checks, and you know what you're actually buying.

 

PureCraft's current batch COAs are available atpurecraftcbd.com/pages/faq for all products includingCBD Oil 1000mg,CBD+CBN Sleep Gummies, andCBD Topicals.

 

Buyer's Guide  |  This article is for educational purposes. Always verify the current batch COA before purchasing any CBD product. PureCraft CBD products are third-party batch-tested — COAs available at purecraftcbd.com/pages/faq. PureCraft CBD products are not intended to diagnose, treat, cure, or prevent any disease.

 

Related Articles — Buyer's Guide Cluster

 

Sources & Citations