How to Read a Certificate of Analysis (COA)

What This Page Covers

• What a COA actually means for your store
• Why COAs matter to retailers
• What parts of a COA you need to look at
• How numbers affect product quality and effects
• Mold, safety failures, and liability risk
• Common mistakes retailers make

What a COA Means for You as a Retailer

A COA is a third-party lab report and batch-specific. A COA for Batch A does not cover Batch B.

It shows two things:

1. Potency (THC, CBD, other cannabinoids; sometimes terpenes)
2. Safety (whether it passed contaminant testing)

A COA is not optional paperwork.

It is proof that:

• The product passed required New York safety testing
• The product is legally eligible for sale
• The label claims are supported by lab results
• You can show documentation during inspections or audits

If a product fails testing, is recalled, or does not have a valid COA, the retailer is responsible for removing it from sale and responding appropriately, even if the issue originated upstream.

Where Retailers Find the COA

You should be able to access the COA from at least one of these:

• QR code on the package
• Link from the brand or distributor
• Internal product intake file from your vendor/distributor
• In-store access method you can provide to consumers (upon request)

How Long Retailers Must Keep COAs (NYS)

In New York, retailers are required to maintain records related to cannabis products for at least five (5) years.

This includes:

• Certificates of Analysis (COAs)
• Records linking COAs to specific batches or lots
• Records showing when products were received and sold

COAs must be available to OCM upon request and accessible to consumers (for example, via QR code or in-store access).

Why COAs Matter in Your Store

COAs affect:

• What you can put on the shelf
• What you can legally advertise
• What you can say to customers
• What inspectors will ask to see
• What must be quarantined or removed from sale

OCM may take action against manufacturers, distributors, laboratories, or licensees depending on the issue, but retailers are responsible for what they sell and for maintaining required records.

The 5 Things to Check Every Time

You do not need to read the full COA. You need these 5 checks.

1) Match the COA to the Product (Batch Match)

Confirm all of the following match the package:

• Product name
• Brand / manufacturer name (or the entity on the label)
• Batch / lot number
• Product type (flower, vape, edible, concentrate)

If the batch/lot number does not match, the COA does not apply to that product.

2) Confirm the COA Is Current for That Batch

Look for:

• Date tested / report date
• Sample ID / batch ID

Old does not automatically mean “invalid,” but it should still be the COA for the exact batch you have.

3) Potency: Use the Right THC Number

Retailers should look for Total THC, not just “THC.”

Why:

• Flower often lists THCA and Delta-9 THC separately
• THCA converts to THC when heated
• “Total THC” is the best quick indicator of strength

For edibles:

• Potency is usually in mg per serving and mg per package
• Your customer experience depends on mg, not strain name

What retailers should be able to answer from potency:

• “Is this mild, medium, or strong?”
• “Is this more functional or more couch-lock?” (you can’t promise, but you can guide)

4) Terpenes: Use Them for “Type of Effect,” Not Promises

Terpenes help explain:

• Smell and taste
• Why two products with similar THC can feel different
• General direction of effects (uplifting vs relaxing)

Terpenes do not let you guarantee outcomes.

Use terpenes to say things like:

• “This one tends to feel more relaxing for many people.”
• “This terpene mix is often described as more uplifting.”

Strain names are not regulated. Terpene profiles are usually more useful than the name.

5) Safety: Confirm Every Required Category Shows PASS

This is the section that protects customers and your license.

A normal COA will show safety categories like:

• Microbials / mold / yeast (sometimes includes Aspergillus)
• Pesticides
• Heavy metals (lead, arsenic, cadmium, mercury)
• Residual solvents (especially for vapes/concentrates)
• Mycotoxins (some labs include)

What you want to see:

• PASS, or
• “Not detected,” “Absent,” or results below limits

If the COA only has potency and no safety panel, you need to confirm whether it is a complete COA for NY requirements. In general, retailers should prefer full panel COAs, not potency-only.

Potency: What the Numbers Actually Mean

Flower

• Potency is usually shown as % by weight
• Higher % can mean stronger effects, but not always
• Freshness, terpenes, and individual tolerance change the experience

Vapes/Concentrates

• Potency is often much higher than flower
• Terpenes and additives matter more for how it feels and tastes

Edibles

• Potency is in milligrams (mg)
• Customers often misread mg. Your job is to keep them safe:
  • “Start low. Wait. Don’t stack doses.”

THC vs TAC

• THC = impairment potential
• TAC = total cannabinoids listed as active

TAC helps explain why products with similar THC can feel different, but TAC is not a quality guarantee.

Mold: The Biggest Retail Risk

Cannabis grows mold easily.

Mold risk increases when:

• Flower is improperly cured
• Stored with too much moisture
• Stored too long
• Handled or stored incorrectly

Moldy cannabis:

• May look fine
• May smell fine
• Can still fail testing

If mold is detected:

• Product must be removed from sale
• Product may be quarantined or destroyed
• Retailers must document compliance actions

Why Testing Is Not Always Perfect

Testing is required, but it is not flawless.

Results can vary because:

• Labs test samples, not entire batches
• Sampling methods differ
• Cannabis is not uniform
• Market pressure exists around potency numbers

This is why:

• Extremely high THC should be questioned
• Full-panel testing matters more than potency alone
• COAs must match the batch exactly

COAs reduce risk. They do not eliminate it.

What a COA Does Not Tell You

A COA does not guarantee:

• How a product will feel for every customer
• That a strain name is consistent across brands
• That effects match marketing language

A COA tells you what passed testing, not how someone’s body will react.

Common Retailer Mistakes

• Trusting the label without checking the COA
• Assuming strain name equals effects
• Ignoring terpene information
• Selling products with mismatched batch numbers
• Not understanding mold results
• Treating COAs as lab paperwork instead of compliance records

Why This Matters Long-Term

Retailers who understand COAs:

• Reduce compliance risk
• Respond faster to recalls
• Educate customers clearly
• Build trust
• Avoid preventable enforcement issues

Retailers who don’t:

• Rely on marketing
• Get blindsided during inspections
• Carry unnecessary risk

Related Pages

• Product Standards. Testing & Safety
• Packaging & Labeling
• Packaging & Labeling Requirements
• Advertising & Marketing Rules (Health and Medical Claims)

Source Material

• OCM Certificate of Analysis (COA) Guidance
• NYCRR Title 9; Recordkeeping and Testing Requirements