How to read a certificate of analysis (COA)

A certificate of analysis, or COA, is a laboratory report for one batch of a product. It shows how much CBD and THC the laboratory measured and whether contaminants were found. Read it by matching the batch number to the pack, comparing the CBD result with the label, checking the THC result, and then looking at the contaminant sections.

This page explains how these reports work. It is not a guide to choosing or buying a product. In Australia CBD is a prescription medicine, and a report posted on a retail or overseas website does not make a product lawful to buy.

Step 1: Does the report match your pack?

Start with the header. It should show:

• the name of the laboratory that did the testing
• the product name and the batch (or lot) number
• the date the sample was received or tested.

Australia’s quality standard for medicinal cannabis, TGO 93, defines a batch number as a code given by the manufacturer that uniquely identifies the batch and allows it to be traced through all stages of manufacture and distribution. It must appear on the label.¹ If the batch number on a report does not match the one on your pack, the report is about a different batch and tells you nothing about yours.

Step 2: Who did the testing?

A report is only as good as the laboratory. Look for accreditation to ISO/IEC 17025, the international standard against which laboratories are accredited as technically competent for the methods listed on their scope of accreditation. In Australia the accrediting body is NATA.²

“Third-party tested” means the laboratory is independent of the manufacturer. It says nothing on its own about whether the laboratory is accredited.

Step 3: Potency (the cannabinoid profile)

This section lists each cannabinoid and the amount found, usually in mg/mL or mg/g, sometimes as a percentage.

Compare CBD with the label. Under TGO 93, the average content of each active ingredient must be:¹

So a 100 mg/mL oil should test between 90 and 110 mg/mL.

Understand “total” figures. The plant makes cannabinoids in acid forms: CBDA becomes CBD and THCA becomes THC when heated.³ TGO 93 counts each active ingredient “together with any corresponding acid”.¹ Reports often show this as “total CBD” and “total THC”. The total is the figure to compare with the label.

Check THC. This is the result that affects your legal position and any drug test.

• A product is a CBD-only (Schedule 4) medicine only if CBD is 98% or more of the total cannabinoids.⁴
• THC must be declared as an active ingredient once it reaches 1.0% of the product, and any other cannabinoid once it reaches 2.0%.¹
• Small amounts matter. After a study of a full-spectrum extract containing 0.02% THC, the authors concluded that people using such products may test positive for the THC breakdown product on a urine drug screen.⁵ See CBD and drug tests.

Check the type claim. An isolate should show CBD and nothing else. A broad-spectrum product should show other cannabinoids and no THC. A full-spectrum product will show some THC. See full spectrum vs broad spectrum vs isolate.

Step 4: What do ND, LOD and LOQ mean?

Laboratory methods have limits, and the abbreviations describe them. The definitions below are from the international guideline on validating analytical methods (ICH Q2).⁶

“ND” is not the same as zero. How small an amount “ND” rules out depends on how sensitive the method is. As an example of scale, one research laboratory’s THC method could measure down to 0.005 mg/mL. Using it, the researchers found THC in 5 of 21 products that were labelled “THC-free”.⁷ A good report states its LOD or LOQ for each test so you can judge.

Step 5: Contaminants

A full report covers more than potency. These are the limits TGO 93 sets for the cannabis plant material used to make medicines, tested by European Pharmacopoeia methods. They give you something to compare a report against.¹

A unit note: mg/kg is the same as parts per million (ppm).¹ Some reports use parts per billion (ppb), which is micrograms per kilogram. A thousand ppb is one ppm.

Microbes. Oral and inhaled medicinal cannabis products must meet the microbiological acceptance criteria of the British, European or United States pharmacopoeia.¹ On a report this appears as counts of bacteria, yeasts and moulds, and tests for the absence of specific harmful organisms.

Residual solvents. These are traces of the solvents used in extraction. The international guideline ICH Q3C sorts solvents into Class 1 (to be avoided, for example benzene), Class 2 (to be limited, for example hexane at 290 ppm and methanol at 3,000 ppm) and Class 3 (low toxic potential, for example ethanol, generally acceptable up to 5,000 ppm).⁸ A report should show each solvent tested and a pass or a measured value. See how CBD is extracted and made.

Limits printed on an overseas report may come from a different rule book, such as a United States state regulation. A “pass” means the result met whichever limit that laboratory applied.

Step 6: Other things a report may show

• Terpene profile. A list of the aromatic compounds found. It describes the product but has no proven bearing on its effects. See terpenes.
• Appearance, density or water content. Routine quality checks.
• Method. The name of the technique used. The research study cited above measured cannabinoids by liquid chromatography with tandem mass spectrometry.⁷

What a COA cannot tell you

• It covers the sample tested. In a 2024 study that tested one sample each of 202 CBD products at an ISO/IEC 17025 accredited laboratory, 74% were at least 10% off their labelled CBD content.⁹ Independent testing found problems that the products’ own labels did not show.
• It is not evidence that CBD works. A perfectly made product can still be no better than placebo for a condition. See how we grade the evidence.
• It does not make a product lawful. CBD is a prescription medicine in Australia. A report on an overseas website does not change that. See buying CBD online.
• It does not mean the regulator has checked the product. Most CBD products supplied in Australia are unapproved medicines. The TGA says it does not test every product and instead uses risk-based surveillance testing against TGO 93.¹⁰

Do Australian prescription products come with a COA?

Not automatically, as far as the standard goes. TGO 93 requires products to meet content and contaminant limits and to be made under Good Manufacturing Practice, and it requires a batch number on the label. A certificate of analysis is not on its list of things the label must carry.¹ We did not find a rule requiring one to be given to patients.

If you want to see batch results for a prescribed product, ask your pharmacist or prescriber whether the sponsor provides them. For athletes, Sport Integrity Australia’s fact sheet says there are no batch-tested CBD products available in Australia that meet its threshold to be considered low risk.¹¹ See CBD and sport.

When the TGA’s own laboratory tested prescription cannabis products supplied in Australia, most were close to their labelled content.¹² See is what is on the label in the bottle?

Summary: what a complete report shows

1. The batch number matches your pack.
2. The laboratory is named and accredited to ISO/IEC 17025.
3. The report is dated and recent enough to relate to your batch.
4. Total CBD is within 10% of the label.
5. The THC result is stated, with the test’s detection limit.
6. Heavy metals, pesticides, mould toxins, microbes and residual solvents were all tested.
7. Each result has a limit beside it and a measured value or a clear pass.

This page is general information, not medical or legal advice. Laws and evidence change; we show the date we last checked the facts at the top of every page. Talk to your doctor or pharmacist before starting, stopping or changing any medicine.

Didn't find what you needed? Ask us a question.