How old can a sample date be on a CoA before I have to reject the batch?

A sample taken more than 6 months ago is a yellow flag, and over 12 months is a hard reject in WA per WAC 314-55-102 stability-test rules. Check the cultivar too, since a flower batch carrying an old test is a sign the producer is moving aged inventory. Reusing a single older CoA across new harvests is a violation worth rejecting and, if the pattern repeats, reporting to the state.

What potency difference between the label and the CoA is normal versus a reason to send product back?

Within 10% variance is normal lab tolerance, so a label reading 22% THC against a CoA of 19.4% falls in that range. A delta greater than 15% is mislabeling that exposes you to consumer-protection issues, and that batch should be rejected and sent back. Watch also for numbers above the natural plant ceiling, since real flower caps in the high-20s and plant-derived concentrates without distillation cap in the 70s.

What happens in a WSLCB audit if I can't produce a verified CoA for a product on my floor?

An inspector can pull 5 random SKUs from the floor and ask for each one's CoA plus the receiving timestamp. If you can't produce a verified CoA dated at or before the receiving timestamp, that's a documented finding, with fines starting around $1,000 and escalating with pattern. Verifying at receiving takes roughly 90 seconds per batch and gives you the paper trail that also protects your leverage in vendor disputes.

← All guides

Compliance + receiving playbook

Reading a cannabis Certificate of Analysis — what to verify before product hits the floor

A Certificate of Analysis (CoA) is the lab-test document every cannabis product ships with — potency, pesticides, heavy metals, microbial, residual solvents, mycotoxins. It’s also the document a WSLCB inspector pulls first when something goes wrong, the document your insurance asks for after any incident, and the document your customer might ask the budtender to explain. Receiving-side CoA verification takes ~90 seconds per batch + prevents three categories of bad outcomes: customer harm, vendor disputes, and audit findings. The discipline worth running, what to verify, and where the legitimate-but-suspicious patterns hide.

By CannAgentMay 7, 20266 min read

The 6-line receiving-side CoA check

License + lab match. The CoA shows a state-licensed lab; the lab’s license number checks against your state’s active-list. Not all CoAs are from accredited labs — and an unaccredited CoA is worthless to WSLCB.
Sample-date vs ship-date. Sample taken more than 6 months ago is a yellow flag; over 12 months is a hard reject in WA per WAC 314-55-102 stability-test rules. Check the cultivar — a flower batch with an old test is a sign the producer is moving aged inventory.
Potency aligned with label. Label says 22% THC; CoA says 19.4%. Within 10% variance is normal lab tolerance; >15% delta is mislabeling that exposes you to consumer-protection issues. Reject + send back.
All pesticide + heavy-metal panels PASS. Don’t skim ‘OK’; verify each line. WSLCB requires the full panel; one fail anywhere = product cannot legally be sold; receiving it onto your floor is your problem if the producer mislabeled.
Microbial + mycotoxin within action limits. Look for total yeast/mold + bile-tolerant gram-negative bacteria + Aspergillus species + aflatoxin. State limits vary; bookmark your state’s table; check every CoA against it.
Residual solvent (concentrates only) within limits. Distillates, BHO, CO2 extracts, vapes — all need this panel. Butane / propane / hexane / acetone all have specific ppm caps. Failed solvent panel is non-negotiable reject.

Three categories of bad outcomes the check prevents

Customer harm. Pesticide-contaminated flower + bacteria in concentrates = real medical exposure. The cost of one ER visit traced to a product you sold > the cost of 1,000 receiving CoA checks combined.
Vendor disputes you can’t win. Floor pulls a SKU mid-week because the CoA shows a fail. Vendor says ‘you accepted it.’ If your receiving record has the CoA verified at intake, you have a paper trail to claim against. If you didn’t check, your dispute leverage is zero — you accepted the product.
WSLCB audit findings. Inspector pulls 5 random SKUs from the floor + asks for their CoAs + the receiving timestamp on each. If you can’t produce a verified CoA dated AT or BEFORE the receiving timestamp, that’s a documented finding. Fines start ~$1,000 + escalate with pattern.

Legitimate-but-suspicious patterns to develop intuition for

Same lab + same producer + identical potency to two decimal places across multiple batches. Real lab variance is ~0.3-1% per re-test; identical numbers across batches signals copy-paste or producer-supplied (not lab-tested) data. Spot-check by looking up the lab’s portal entry for the sample-id.
THC potency suspiciously high (>32% flower, >85% concentrate label without distillate process). Real flower caps in the high-20s; real plant-derived concentrates without distillation cap in the 70s. Numbers above the natural plant-chemistry ceiling indicate either lab inflation (some labs inflate to keep producer business) or product mislabeling.
Pesticide PASS-with-only-two-tested. Some labs run minimum-required panels and skip ones not legally required for the state. Verify the panel the CoA actually ran covers your state’s required list, not just ‘PASS’.
Older CoA reused for new harvest. Flower batch labels reference a CoA dated 6+ months ago. The producer is using a single test result for multiple harvests; per WAC 314-55-102 + most state stability rules, this is a violation. Reject + report to state if pattern repeats.

What CannAgent does to make this stick

CoA upload required at receiving. PDF attached to the receiving line; failure to upload doesn’t advance the line to the floor.
6-line check enforced as a checklist the receiver clicks through; can’t advance to next line without confirming each. Anti-pattern: receiving as a single ‘received: yes’ toggle without enforced verification.
Lab license verification against the state’s active-list (cached, refreshed nightly). CoA from an inactive-license lab flags red.
Sample-date freshness check — yellow flag at 6+ months, red at 12+ months. Receiver sees the flag at intake.
Per-product CoA history linked to every product page; budtender can pull up the live CoA in a customer-facing question; management can audit the per-vendor CoA pattern.
Vendor-CoA-quality scorecard. Aggregate your CoA-rejection rate per vendor over time; data drives the relationship-discipline conversation per /guides/cannabis-vendor-diligence-fire-or-keep.

Takeaways

CoA is the document a WSLCB inspector pulls first; verifying at receiving takes ~90 seconds and prevents customer harm + vendor disputes + audit findings
6-line check: license + lab match against state active-list / sample date < 6mo / potency within 10% of label / pesticide + heavy-metal PASS line-by-line / microbial + mycotoxin within state limits / residual solvent within ppm caps for concentrates
Missing or modified CoAs go to quarantine pending verification — do NOT sell off PRELIMINARY or PARTIAL stamps
Suspicious patterns: identical potency across batches (lab variance is ~0.3-1%), THC > natural plant ceiling (>32% flower / >85% non-distillate concentrate), pesticide PASS with only partial panel run, older CoA reused for new harvest
CannAgent: CoA upload required at receiving + 6-line checklist enforced + lab license verification against state active-list + sample-date freshness flagging + per-vendor CoA-quality scorecard

Frequently asked

How old can a sample date be on a CoA before I have to reject the batch?: A sample taken more than 6 months ago is a yellow flag, and over 12 months is a hard reject in WA per WAC 314-55-102 stability-test rules. Check the cultivar too, since a flower batch carrying an old test is a sign the producer is moving aged inventory. Reusing a single older CoA across new harvests is a violation worth rejecting and, if the pattern repeats, reporting to the state.
What potency difference between the label and the CoA is normal versus a reason to send product back?: Within 10% variance is normal lab tolerance, so a label reading 22% THC against a CoA of 19.4% falls in that range. A delta greater than 15% is mislabeling that exposes you to consumer-protection issues, and that batch should be rejected and sent back. Watch also for numbers above the natural plant ceiling, since real flower caps in the high-20s and plant-derived concentrates without distillation cap in the 70s.
What happens in a WSLCB audit if I can't produce a verified CoA for a product on my floor?: An inspector can pull 5 random SKUs from the floor and ask for each one's CoA plus the receiving timestamp. If you can't produce a verified CoA dated at or before the receiving timestamp, that's a documented finding, with fines starting around $1,000 and escalating with pattern. Verifying at receiving takes roughly 90 seconds per batch and gives you the paper trail that also protects your leverage in vendor disputes.

Related guides

Compliance + ops playbook

Ready to talk through your migration?

30-minute demo. We end by quoting the cutover from your current setup — fixed scope, no hourly games.

Request a demo →All guides