← All guides

Compliance + receiving playbook

Reading a cannabis Certificate of Analysis — what to verify before product hits the floor

A Certificate of Analysis (CoA) is the lab-test document every cannabis product ships with — potency, pesticides, heavy metals, microbial, residual solvents, mycotoxins. It’s also the document a WSLCB inspector pulls first when something goes wrong, the document your insurance asks for after any incident, and the document your customer might ask the budtender to explain. Receiving-side CoA verification takes ~90 seconds per batch + prevents three categories of bad outcomes: customer harm, vendor disputes, and audit findings. The discipline we run at Green Life + SCC, what to verify, and where the legitimate-but-suspicious patterns hide.

By CannAgent6 min read

The 6-line receiving-side CoA check

  1. **License + lab match.** The CoA shows a state-licensed lab; the lab’s license number checks against your state’s active-list. Not all CoAs are from accredited labs — and an unaccredited CoA is worthless to WSLCB.
  2. **Sample-date vs ship-date.** Sample taken more than 6 months ago is a yellow flag; over 12 months is a hard reject in WA per WAC 314-55-102 stability-test rules. Check the cultivar — a flower batch with an old test is a sign the producer is moving aged inventory.
  3. **Potency aligned with label.** Label says 22% THC; CoA says 19.4%. Within 10% variance is normal lab tolerance; >15% delta is mislabeling that exposes you to consumer-protection issues. Reject + send back.
  4. **All pesticide + heavy-metal panels PASS.** Don’t skim ‘OK’; verify each line. WSLCB requires the full panel; one fail anywhere = product cannot legally be sold; receiving it onto your floor is your problem if the producer mislabeled.
  5. **Microbial + mycotoxin within action limits.** Look for total yeast/mold + bile-tolerant gram-negative bacteria + Aspergillus species + aflatoxin. State limits vary; bookmark your state’s table; check every CoA against it.
  6. **Residual solvent (concentrates only) within limits.** Distillates, BHO, CO2 extracts, vapes — all need this panel. Butane / propane / hexane / acetone all have specific ppm caps. Failed solvent panel is non-negotiable reject.

Three categories of bad outcomes the check prevents

  1. **Customer harm.** Pesticide-contaminated flower + bacteria in concentrates = real medical exposure. The cost of one ER visit traced to a product you sold > the cost of 1,000 receiving CoA checks combined.
  2. **Vendor disputes you can’t win.** Floor pulls a SKU mid-week because the CoA shows a fail. Vendor says ‘you accepted it.’ If your receiving record has the CoA verified at intake, you have a paper trail to claim against. If you didn’t check, your dispute leverage is zero — you accepted the product.
  3. **WSLCB audit findings.** Inspector pulls 5 random SKUs from the floor + asks for their CoAs + the receiving timestamp on each. If you can’t produce a verified CoA dated AT or BEFORE the receiving timestamp, that’s a documented finding. Fines start ~$1,000 + escalate with pattern.

Legitimate-but-suspicious patterns to develop intuition for

  • **Same lab + same producer + identical potency to two decimal places across multiple batches.** Real lab variance is ~0.3-1% per re-test; identical numbers across batches signals copy-paste or producer-supplied (not lab-tested) data. Spot-check by looking up the lab’s portal entry for the sample-id.
  • **THC potency suspiciously high (>32% flower, >85% concentrate label without distillate process).** Real flower caps in the high-20s; real plant-derived concentrates without distillation cap in the 70s. Numbers above the natural plant-chemistry ceiling indicate either lab inflation (some labs inflate to keep producer business) or product mislabeling.
  • **Pesticide PASS-with-only-two-tested.** Some labs run minimum-required panels and skip ones not legally required for the state. Verify the panel the CoA actually ran covers your state’s required list, not just ‘PASS’.
  • **Older CoA reused for new harvest.** Flower batch labels reference a CoA dated 6+ months ago. The producer is using a single test result for multiple harvests; per WAC 314-55-102 + most state stability rules, this is a violation. Reject + report to state if pattern repeats.

What CannAgent does to make this stick

  • **CoA upload required at receiving.** PDF attached to the receiving line; failure to upload doesn’t advance the line to the floor.
  • **6-line check enforced as a checklist** the receiver clicks through; can’t advance to next line without confirming each. Anti-pattern: receiving as a single ‘received: yes’ toggle without enforced verification.
  • **Lab license verification** against the state’s active-list (cached, refreshed nightly). CoA from an inactive-license lab flags red.
  • **Sample-date freshness check** — yellow flag at 6+ months, red at 12+ months. Receiver sees the flag at intake.
  • **Per-product CoA history** linked to every product page; budtender can pull up the live CoA in a customer-facing question; management can audit the per-vendor CoA pattern.
  • **Vendor-CoA-quality scorecard.** Aggregate your CoA-rejection rate per vendor over time; data drives the relationship-discipline conversation per /guides/cannabis-vendor-diligence-fire-or-keep.

Takeaways

Ready to talk through your migration?

30-minute demo. We end by quoting the cutover from your current setup — fixed scope, no hourly games.

Request a demo →All guides