← INSIGHTS · 6 MIN READ · BY CannaBless Editorial

Reading a medical-cannabis CoA: a clinician's checklist

How to read a medical-cannabis Certificate of Analysis line by line. Cannabinoids, terpenes, microbial limits, residual solvents, contaminants.

Why this is the document that matters

A patient prescribed CBD-dominant flower at 8% CBD doesn't see the test report. The dispensing pharmacist might glance at it. The licensed importer's QA team reads it carefully. The TGA inspector, in a compliance review, reads it line by line.

The Certificate of Analysis is the document that turns "we grow good cannabis" into "this batch contains X% CBD ± Y%, with these contaminants below regulated thresholds, tested on this date in this accredited laboratory using these methods." Everything before it is sales. Everything after it is medicine.

If you're a licensed importer evaluating a Thai supplier — or any supplier — and you can't read their CoA confidently in five minutes, you can't evaluate them. This piece is the five-minute read.

What a real CoA contains

A defensible medical-cannabis CoA has, at minimum, the following sections:

  1. Header — sample identifier, batch number, sample weight, date received, date tested, date reported, lab identifier with accreditation number.
  2. Cannabinoid profile — major and minor cannabinoids reported individually, including acidic precursors, with limits of quantification (LoQ) and limits of detection (LoD).
  3. Terpene profile — typically 20–30 named terpenes, reported as % w/w with LoQ.
  4. Microbiological — total aerobic count, yeast and mould, specified pathogens.
  5. Heavy metals — Pb, Cd, As, Hg at minimum.
  6. Pesticide residues — multi-residue panel, typically 50–80 compounds.
  7. Residual solvents — only relevant for extracts; the panel depends on the extraction method.
  8. Mycotoxins — total aflatoxins, ochratoxin A.
  9. Moisture content & water activity — affects shelf stability and microbial risk.
  10. Method references — which standard each test followed.

Anything missing from this list isn't redacted; it's untested. "Pesticides: pass" without a panel listing means nothing.

Cannabinoid section — what the numbers actually say

A typical cannabinoid line might read:

Δ9-THC      : 0.18%   (LoQ 0.05%)
THCA        : 0.05%   (LoQ 0.05%)
Total THC   : 0.22%   = Δ9-THC + (THCA × 0.877)
CBD         : 7.21%   (LoQ 0.05%)
CBDA        : 1.43%   (LoQ 0.05%)
Total CBD   : 8.46%   = CBD + (CBDA × 0.877)
CBG         : 0.32%
CBN         : 0.04%

Three things to read for:

The "Total" value. Cannabis flower in its raw, uncured state contains mostly acidic cannabinoid forms (THCA, CBDA). When the patient applies heat — vaporiser, joint, oven — those decarboxylate into the active forms (Δ9-THC, CBD), losing roughly 12.3% of their mass as CO₂ (the 0.877 multiplier above). "Total THC" and "Total CBD" approximate what the patient would actually receive at full decarboxylation.

The CBN level. CBN forms when Δ9-THC oxidises with age, heat, or light exposure. A fresh, properly stored flower has CBN well below 0.1% of total cannabinoid content. Anything approaching 0.5% suggests degradation — which means storage or transit conditions failed somewhere upstream. CBN is real; high CBN in a flower labelled for THC content is a quality-control flag.

The labelled-vs-tested gap. Compare the cannabinoid result on this CoA to the cannabinoid claim on the label or supply contract. Australian importers typically tolerate ±10% variance from the labelled value. A flower labelled "8% CBD" testing at 7.5% is fine; at 6.0%, it's a quality issue that affects patient dosing.

Terpene section — small numbers, real clinical relevance

Terpene profiles are reported in percentages that look small (typically total terpene content is 1–4% of flower weight) but matter therapeutically. The major terpenes to look for in a CoA:

A serious CoA reports each individually with LoQ. A weak CoA reports "total terpenes: 2.1%" with no breakdown — that number is meaningless because the clinical effects depend on which terpenes are present, not how much there is in aggregate.

For prescribers practising cultivar-specific medicine (selecting cultivars based on patient phenotype), terpene profile is a primary selection variable. Pharmacies dispensing into AP-scheme prescriptions retain CoAs partly so prescribers can verify the terpene profile is what they prescribed.

Microbiological — pass / fail thresholds

Cannabis is a botanical product; it carries microbiology that pharmaceutical APIs don't. The relevant thresholds (from EU GMP Annex 1 / USP <1111> applied to inhaled botanicals):

A CoA that says "microbiology: pass" without numbers is a marketing document. A real CoA reports actual CFU counts (or "below LoQ") and names the specified pathogens individually.

Pesticide residues — the panel size matters

The size of the pesticide panel is a quick signal of CoA seriousness. A 12-pesticide panel is a starter kit. A 60–80-pesticide panel is what you'd see from a serious testing lab. Health Canada's medical-cannabis pesticide list runs to 96 compounds; Oregon's published list is similar.

The exporter's job upstream is to use a pesticide regime documented and chemically compatible with the destination market's panel. The lab's job is to test against that panel. The importer's job is to read the result and reject anything above the regulated maximum residue limit (MRL). For most jurisdictions, the cannabis MRL is the "default" agricultural MRL or stricter — there's rarely a cannabis-specific tolerance.

Heavy metals — the four to demand

Cannabis is a hyperaccumulator — it pulls metals from soil aggressively. That makes heavy metal testing particularly important. The standard four:

Limits are typically reported in µg/kg (parts per billion). Modern ICP-MS instruments resolve below 1 µg/kg easily. Be suspicious of CoAs reporting metals as "<LoQ" with the LoQ itself unstated — that's a way to look pass without proving pass.

What licensed importers actually do with a CoA

In practice, the importer's QA process when a shipment arrives is:

  1. Verify CoA accompanies shipment, batch number matches packaging
  2. Scan the cannabinoid result against the labelled value, flag if outside ±10%
  3. Verify all required test categories are present
  4. Confirm lab is ISO/IEC 17025 accredited for the relevant test methods
  5. Optionally re-test on arrival via Australian-accredited lab (increasingly the norm for high-volume product)
  6. File the CoA against the batch for the regulated retention period

A CoA that fails step 4 — unaccredited lab, or accredited for the wrong tests — is the most common reason shipments get held in quarantine on arrival.

What this means for patients

Reading a CoA carefully is not paperwork hygiene. The molecule profile on the report is what the patient actually receives, dosed against the prescription written for an entirely different person — themselves, three weeks ago, in front of a clinician who based their decision on a labelled cannabinoid value. Every line item on the CoA is one more checkpoint between the cultivation room and that patient.

How CannaBless documents per-batch quality

Every CannaBless export ships with:

If you're a licensed importer evaluating Thai supply, ask to see a sample CoA before signing. Spend five minutes on it. The supplier whose CoA reads cleanly is the supplier whose flower will read cleanly when your QA team holds it.

Looking to begin a regulated supply conversation? Reach the export team →

Reading a medical-cannabis CoA: a clinician's checklist