Lab testing, potency and the COALab testing, potency and the COA

Purpose and scope

Every batch you sell (and in a medicinal system, every batch you release) ends its life as a one-page document from a testing laboratory: the certificate of analysis, or COA. It says what is in the flower (cannabinoids, terpenes) and what must not be (mould, heavy metals, pesticides, mycotoxins). Buyers mostly read one number on it, total THC, and that number moves the price. Which is exactly why it is the most gamed number in the industry, with peer-reviewed studies documenting systematic inflation on retail labels^[1][2].

Here is the single idea that makes every section of this paper make sense: a COA is not a property of your crop. It is a measurement, of one small sample, pulled one way, prepared one way, run on one instrument, by one lab, on one day. Change any of those and the number changes, with no fraud involved. Most of the grief in cannabis testing (‘same weed, different number’, lab shopping, inflated labels) comes from people forgetting, or exploiting, that distinction.

Evidence and limitations

Laboratory testing overview

To read a COA in sixty seconds, check eight things in order:

1. Who tested it, a named lab with a checkable accreditation (ISO/IEC 17025 or, in medicinal frameworks, GMP certification)^[16].
2. What was tested, sample ID, batch, matrix, sample mass, and crucially who pulled the sample. ‘Client-submitted’ means the lab never saw your batch.
3. The basis, dry-weight or as-received, and the moisture content. This alone moves potency ~10–15%.
4. The potency table, acids (THCA) and neutrals (THC) on separate rows means an HPLC method. Then do the maths: total THC = Δ9-THC + 0.877 × THCA. It should reconcile exactly.
5. Units, % w/w and mg/g say the same thing (1% = 10 mg/g); don't let a unit switch fool you.
6. Each contaminant family (microbial, metals, pesticides, mycotoxins, solvents) is its own test with its own method and pass/fail. Potency says nothing about safety.
7. The footnotes, LOQs, ND definitions, method references. No LOQ column means ‘ND’ is uninterpretable.
8. The release, a named, dated QA signature. In GMP systems this is where a COA becomes a release decision instead of a marketing asset^[15].

And the honesty part, up front: the peer-reviewed record shows reported retail potency in several legal markets is systematically inflated, 70% of tested Colorado flower samples ran more than 15% below label in one study^[1], 70% of a three-state audit fell outside ±20% of label^[12], and product frequencies ‘bunch’ suspiciously just above the 20%-THC price threshold^[2]. When a single number sets the price, someone will lean on it. The defence is knowing how the number is made. Which is the rest of this paper.

Laboratory testing workflow

Between ‘cut a sample’ and ‘PDF lands in your inbox’ sits a pipeline, and every stage of it shapes the final numbers. The instrument is the glamorous part; the sampling and the prep are where the number is really decided.

Each family of tests uses different physics, which is why one lab houses half a dozen instruments:

How to read a certificate of analysis

Below is a mock certificate from a fictional lab, Example Analytical Ltd, laid out the way most real ones are. The eight callouts are the eight places your eyes should go, in order.

1. 1
   Lab identity and accreditation

   A real lab puts its name, address and accreditation number where you can check them against the accreditation body's public register. A PDF with a logo and no accreditation number is just a nicely typeset claim.
2. 2
   Report ID and version

   One report, one version. Amended reports (‘v2’) happen legitimately, but an amendment that only ever moves THC upward deserves questions.
3. 3
   Sample metadata

   Sample ID, batch/lot, matrix, mass received, dates. And who did the sampling. ‘Client-submitted’ means the number describes whatever was in the bag you sent, which is a very different claim from a lab-sampled batch result.
4. 4
   Basis and moisture

   As-received or dry-weight, with the measured moisture. Without this line, two COAs cannot be compared at all, see the basis section below.
5. 5
   The potency table

   THCA and Δ9-THC on separate rows (an HPLC signature), minor cannabinoids, a starred total. Verify: total THC = Δ9-THC + 0.877 × THCA. On the mock: 0.92 + 0.877 × 24.20 = 22.14%. It reconciles. If it doesn't, ask why before you trust anything else on the page.
6. 6
   Footnotes and LOQs

   ND means ‘not detected above the limit shown’, never zero. The LOQ column is what makes ND mean something. Its absence is a reporting failure.
7. 7
   Contaminant panels

   Each family (microbial, metals, pesticides, mycotoxins, solvents) is a separate test on a separate subsample. A stellar THC number and a failed Aspergillus test live happily on the same certificate.
8. 8
   Release signature and the small print

   A named QA person, dated. Then the ISO-language honesty clause: results relate only to the sample as received. That sentence is the legal truth of everything above it.

Total THC: calculation and chemistry

The living plant barely makes any THC. It makes THCA, tetrahydrocannabinolic acid — THC with an extra chemical group (–COOH) attached that makes it non-intoxicating and about 13% heavier. Think of baking soda releasing bubbles in a hot pan: heat forces a gas out of the molecule and leaves a chemically different compound behind. THCA does exactly that — heat strips the extra group off as CO₂ gas, a reaction called decarboxylation^[4]. A lighter, a vape, an oven. That is where most of the THC in your life is actually created.

That is the whole mystery of the 0.877 factor: it is a molecular-weight ratio, not a correction fudge. THC weighs 314.5 g/mol; THCA weighs 358.5 g/mol; 314.5 ÷ 358.5 = 0.877. So the standard label formula is:

How fast does the conversion actually run? In controlled kinetics work, THCA in an open reaction vessel fully converted in about 30 minutes at 110 °C (230 °F), about 9 minutes at 130 °C (266 °F) and about 6 minutes at 145 °C (293 °F), and, heated in the dark under vacuum, produced no significant CBN (the oxidation by-product)^[4]. In air, with light and higher temperatures, losses grow, which is exactly why the formula's assumption of perfect conversion makes it a maximum, not a prediction.

Slow decarboxylation also happens at room temperature, during curing and storage, THCA quietly ticks over to THC, and THC slowly oxidises onward to CBN. This is why an old COA and a fresh one on the same batch can honestly disagree: the material itself moved.

HPLC versus GC for potency testing

Two chromatography families dominate potency testing, and they do not see the same molecules. HPLC (high-performance liquid chromatography) pushes the extract through a column in liquid at near-room temperature. Different molecules travel through the column at different speeds — like pigments separating on wet paper, where some colours travel further than others — so THCA and THC arrive at the detector as separate, distinct peaks. GC (gas chromatography) must vaporise the sample in an injector inlet at roughly 250–300 °C (482–572 °F). At that temperature THCA decarboxylates on the spot, so the acid never reaches the detector as itself^[6].

The nasty detail is that the in-inlet conversion is incomplete and variable. Classic forensic work isolating pure THCA found decarboxylation under GC conditions converted only around 70% of the acid, and concluded that the only exact route to total THC is to measure THCA and THC separately and add them arithmetically. Any post-decarboxylation measurement gives a minimum, not the true value^[5]. On GC, acids are invisible unless the lab derivatises them first (a chemical cap that survives the heat)^[6].

Units and moisture basis

Units first, because this one is mercifully simple: % w/w and mg/g are the same number, one decimal place apart. 1% w/w = 10 mg/g. Flower COAs usually report %, oils and edibles often report mg/g or mg per unit. 22.14% = 221.4 mg/g. No trap here beyond unfamiliarity.

The basis is the real trap. Flower is roughly 10–13% water when properly dried. A potency percentage can be computed against the total mass including that water (as-received / ‘as-is’), or against the solids alone (dry-weight). Same flower, same chemistry, two different numbers:

Sampling and result representativeness

Everything the instrument will ever see is decided before the courier arrives. A batch might be 12 kg (26.5 lb); the composite sample a few tens of grams; the analytical portion that actually gets extracted, roughly 0.5–1 g (0.02–0.04 oz). That gram speaks for everything. Which is why pharmacopoeial guidance treats sampling procedure as a quality attribute in its own right, not paperwork^[7].

Cannabis makes this harder than most matrices because the analyte lives in the trichomes, and trichomes are not evenly distributed: top colas that grew in strong light run richer than shaded lower buds, small buds shed resin in handling, and ground material stratifies as kief settles. A sample built from the prettiest top nugs is not a batch sample. It is a brochure.

1. 1
   Define the batch first

   One cultivar, one room, one harvest, one process. If it isn't homogeneous by construction, no sampling plan can rescue it.
2. 2
   Pull increments, not a grab

   Multiple increments from different containers, positions and depths, including the unglamorous middle and bottom. More, smaller increments beat one big scoop.
3. 3
   Composite and record

   Combine increments, record who pulled what, from where, when. This is the start of chain of custody.
4. 4
   Homogenise before splitting

   Grind and mix before any subsample is taken, for potency, the lab does this again on its portion.
5. 5
   Keep a retained twin

   Split a duplicate sample and store it. When a number looks wrong, the retained sample is your only honest recourse.

Even perfect sampling leaves honest variance: duplicate composites from one batch, run by one lab, routinely land a point or so of THC apart. Treat differences of one to two percentage points as the noise floor of the whole exercise, not as information.

Microbial testing methods

Microbial testing asks two kinds of question. How much is growing on this?, answered by counts: total aerobic microbial count (TAMC), total yeast and mould (TYM / TYMC), bile-tolerant Gram-negatives. And is anything dangerous present?, answered by presence/absence tests for specified organisms: Salmonella, pathogenic E. coli, and in inhaled products the four pathogenic Aspergillus species.

Plates and qPCR genuinely disagree, and metagenomic sequencing has shown why: culture media select. When researchers sequenced what actually grew in standard culture-based yeast-and-mould tests of cannabis, the plates were growing organisms including bacteria, while toxigenic fungi present on the flower were under-represented, and organisms of real clinical concern could be missed entirely^[9]. Meanwhile qPCR happily counts DNA from dead cells, so a batch remediated with heat or irradiation can fail qPCR while passing plates.

Heavy-metal testing by ICP-MS

Cannabis is an enthusiastic accumulator of metals. The same trait that gets hemp planted for soil remediation pulls cadmium and lead out of your substrate, fertiliser and water and stores them in tissue. The panel nearly everywhere centres on the big four: arsenic, cadmium, lead and mercury, with some frameworks screening a wider element list^[8].

The instrument is ICP-MS, inductively coupled plasma mass spectrometry. The lab digests the sample in hot acid until nothing but dissolved elements remain, sprays that solution into an argon plasma running at thousands of degrees, and counts the resulting ions by mass. It is absurdly sensitive, parts-per-billion, which is why metals results carry LOQs that look like 0.01 µg/g.

Pesticide panels and their limits

A pesticide test is a panel: a defined list of compounds, each measured against an action limit. Pass means ‘nothing on this list was found above these limits’, it does not mean pesticide-free, and it says nothing about compounds the panel doesn't include. That distinction matters because panels differ absurdly between jurisdictions: a survey of US state rules found 551 distinct pesticides regulated somewhere, with action limits for the same compound spanning up to four orders of magnitude between states^[10].

• Two instruments are needed for coverage. LC-MS/MS catches most modern residues; GC-MS/MS catches the volatile and halogenated ones. A lab quoting a big panel runs both.
• Inhalation changes the toxicology. Residues that are tolerated on lettuce can pyrolyse into nastier chemistry when smoked. Some fungicides are reported to release hydrogen cyanide on combustion, which is why cannabis limits are often far tighter than food limits.
• History justifies the paranoia. Pre-regulation Californian concentrate screening found pesticides in roughly one-third of samples^[11].
• Drift and carryover count. You can fail a panel without ever spraying, neighbouring agriculture, contaminated secondhand equipment, or a dirty trim room can deposit residues.

Residual-solvent and mycotoxin testing

Residual solvents apply to extracts: whatever chemistry pulled the resin out, butane, propane, ethanol, CO₂ with ethanol polish. Traces can remain, and headspace GC measures them in the finished product. Limits are set per solvent, loosely following pharmaceutical solvent classes: near-zero tolerance for the genuinely toxic ones (benzene, toluene, never used deliberately, but present as impurities in cheap gas), workaday limits for the common process solvents.

Why does a solventless hash or rosin still carry a solvent test? Three honest reasons. The product category triggers the test in most rule sets regardless of process; the test is the only way to verify the solventless claim rather than take it on faith; and contamination doesn't need an extraction step, cleaning agents, fuels and off-gassing in storage can introduce volatiles. A clean solvent panel on rosin is cheap proof your marketing is true. Early concentrate surveys found residual solvents in around 30% of samples, so buyers learned to ask^[11].

Mycotoxins are the chemical ghosts of mould: aflatoxins B1, B2, G1, G2 (from Aspergillus flavus and relatives) and ochratoxin A, measured by LC-MS/MS at parts-per-billion limits^[10]. Two facts make them their own line on the COA rather than a footnote to the microbial section:

• They outlive the mould. Kill steps (heat, irradiation, ozone) can crash a TYM count while leaving the toxins fully intact. A batch can pass microbiology and still fail mycotoxins, and remediated product is exactly where to expect that pattern.
• They are potent at absurdly low doses. Aflatoxin B1 is among the strongest natural carcinogens known, hence limits in the µg/kg (ppb) range in medicinal frameworks^[15].

Water activity and moisture content

Two water numbers appear on flower COAs and they answer different questions. Moisture content (%) is how much water is in the sample — mass of water divided by total mass. Water activity (a_w, scale 0–1) is how freely available that water is to microbes. Think of a sponge held tightly in a fist versus one sitting in a bowl: both can hold the same amount of water by weight, but the fist-held sponge has most of its water bound and hard to release. Water activity measures that availability — formally, the equilibrium relative humidity the sample generates in a sealed space. Mould does not care how much water you have; it cares whether it can get at it. That makes a_w the microbially meaningful number, and it is why pharmacopoeial thinking on stored cannabis centres on a water-activity specification of ≤0.65^[7].

Operationally: dry and cure to a water-activity target, and let moisture content be whatever it is. The paired numbers on the COA also sanity-check each other, a_w 0.75 with 11% moisture claims a strange sample; question it.

COA inflation: evidence and warning signs

If a single number sets the price, the number comes under pressure. That is the documented, peer-reviewed history of legal cannabis markets, and any grower choosing a lab should know it cold.

The mechanism is visible in state datasets. Reported potency for chemotype-I flower across Washington's six largest labs differed systematically: median total THC ranged from 17.7% at the lowest-reporting lab to 23.2% at the highest, a 5.5-percentage-point spread on comparable product that persisted after controlling for strain and producer^[3]. And reported values ‘bunch’ just above the magic 20% price threshold: the frequency of products jumps discontinuously above 20% (a 43% spike in Nevada, 17% in Washington) with the bunching concentrated at specific labs (two later-suspended labs showed a 47% spike; the state's largest lab, 1%)^[2]. Biology does not know where 20% is. Pricing does.

Lab shopping is the market dynamic that produces this. Split one batch across three labs, keep the highest number, and give that lab your business. Labs know it. The lab that reports honestly loses accounts to the lab that reports generously, a race to the bottom wearing a lab coat. Inflation methods range from soft (flower-only calibration bias, generous rounding, tolerant sampling) to plainly fraudulent: in 2024 Oregon's regulator charged seven of the state's eleven accredited labs over inflated THC results, including allegations that staff at three labs spiked customer samples with kief before analysis^[14]. Licence actions and competitor lawsuits over inflated potency and passed-but-contaminated product have followed in California and Massachusetts.

What an operator does with this: pick a lab for its accreditation scope and method transparency, not its averages; split-sample occasionally against a second lab and expect ~1–2 points of honest scatter; keep retained samples; and treat any account manager who promises numbers as a walking licence risk. In GMP-style medicinal systems the incentive flips, the lab serves batch release, not marketing. Which is a large part of why those numbers are steadier^[15][16].

Interpretation limits of a single result

A COA is genuinely useful, inside its limits. What a single certificate can tell you: the potency class of the sampled material (a 15% batch and a 25% batch are truly different things); the pass/fail status of that sample against that panel; and, over many batches from your own room with consistent sampling, a trend worth steering by. What it cannot tell you:

• Your whole room's number. The certificate describes the sample. The batch inherits it only as far as your sampling was honest.
• Differences of a point or two. Sampling scatter plus inter-lab spread swamp them, the documented systematic spread between labs alone was 5.5 points^[3].
• Quality, effect or experience. THC% correlates weakly with what a product is like to consume; terpenes, minor cannabinoids, cure and freshness carry most of it. Chasing the number off the certificate is chasing the wrong thing.
• Next batch. A COA is a record, not a forecast. Genetics × environment × process will move the next one.

When the number looks weird

COA red flags

Testing for release in NZ and Australia

In the Australasian medicinal systems the COA plays a structurally different role from a retail label. In Australia, unapproved medicinal cannabis products must conform to TGO 93 (Therapeutic Goods (Standard for Medicinal Cannabis) Order 2017): assayed cannabinoid content must sit within 90.0–110.0% of the label claim, contaminant limits (including aflatoxins and pesticide residues) apply, and the regulator can pull and test product at any time^[15]. In New Zealand, products must meet the minimum quality standard under the Misuse of Drugs (Medicinal Cannabis) Regulations 2019, with critical tests performed by GMP-certified facilities and ISO/IEC 17025 accreditation recognised for the rest^[16].

The operative concept is release testing: a batch is tested against a registered specification, a qualified person reviews the full data set, and the batch is formally released, or not. The COA becomes one input to a documented decision, made by someone whose signature carries liability. Contrast that with a retail market where the COA's main job is to make the jar look good on a menu, and the potency-inflation record earlier in this paper stops being surprising: same document, opposite incentive structure.

• A 90–110% label-claim window means a batch can fail for being too strong. The target is accuracy, not magnitude^[15].
• Stability data and shelf-life claims ride on the same analytics. The release COA is re-verified over time, which quietly disciplines the initial numbers.
• Testing under GMP means validated methods, qualified instruments and audit trails, the lab's answer to ‘how do you know?’ is a documented system, not a shrug.

For growers elsewhere, the takeaway is portable: the closer your own testing practice is to release-style discipline, fixed sampling SOP, one accredited lab, retained samples, trend charts, numbers nobody is paid to like. The more your COAs are worth, to you and to anyone auditing you.