A certificate of analysis (COA) is a laboratory report on one sample, tested on one day. A clean-looking certificate can still hide a short test list, an old date or a result sitting just under a limit. This part explains the contaminant tests on a full panel, how to read the document line by line, the warning signs, and what all of this means for growers in Thailand.
This is Part 2. Part 1: How to Read a Cannabis Certificate of Analysis
1. Terpene Profiling
Terpenes are the aroma compounds of the plant (more in Terpenes in Cannabis). Unlike cannabinoid acids, they survive the hot inlet of a gas chromatograph, so gas chromatography (GC) suits them. A flame ionisation detector (GC-FID) measures how much of each terpene is present. A mass spectrometer (GC-MS) identifies each one by matching its pattern against a library of known spectra.
Read terpene numbers as approximate (“semi-quantitative”). This is general laboratory practice rather than a finding from the studies cited here. An exact figure needs a certified reference standard for every single compound. Terpenes also evaporate easily, so part of them is lost during drying, curing and storage.
Why Two Laboratories Disagree
Laboratories test different lengths of terpene list. A compound missing from one report may simply never have been searched for. Sample preparation, reference standards and the age of the material also differ.
The “total terpenes” figure adds up only what that laboratory looked for. Two totals from two laboratories therefore answer two different questions.
What to do: when you compare terpene results, compare the same compounds from the same laboratory, on material of similar age. The purpose is to see real differences between batches, not differences between test lists.
2. Heavy Metals
Laboratories usually test for lead, cadmium, arsenic and mercury. Some jurisdictions add chromium or nickel. That core list is general practice; each jurisdiction sets its own list and limits. Montoya and colleagues (2020) note that Colorado and California require heavy metal testing, and that the requirement is not universal.
The same authors state that cannabis plants hyperaccumulate metals: they draw metals from the soil and store them in tissues throughout the plant. This is why cannabis has been studied as a way to clean contaminated soil. They report mercury at up to 440 nanograms per gram of dry plant mass in cannabis grown in volcanic soils in Hawaii. The usual test method is inductively coupled plasma mass spectrometry (ICP-MS), an instrument that measures individual elements at very low levels.
What to do: if you grow in field soil or reuse land with an unknown history, test the soil and your first harvest for heavy metals. The purpose is to find out before a buyer does, because the plant will carry whatever the soil holds.
3. Pesticide Residues
A pesticide test is a targeted list. The instrument looks only for the compounds on that list and cannot see the rest. A clean result means only that no listed compound exceeded the laboratory’s reporting threshold.
Lists are built from different starting points: pesticides registered locally, compounds that failed earlier compliance tests, or a list borrowed from food crops. Montoya and colleagues observe that the United States has no federal environmental agency guidelines on pesticide use on cannabis. Laboratories there often have no official residue list to start from.
What the Contamination Surveys Found
| Finding | Where | Reported by |
|---|---|---|
| 84% of samples contained up to 24 agents, including insecticides, fungicides and growth regulators | Washington state (USA), 26 samples | Montoya and colleagues, 2020 |
| 49% contained pesticides meant only for ornamental plants, including abamectin and bifenazate | California dispensaries | Montoya and colleagues, 2020 |
| Recurring compounds: myclobutanil, imazalil, daminozide, paclobutrazol | Various | Montoya and colleagues, 2020 |
What to do: ask the laboratory for its full pesticide list and check that every product you have sprayed on the farm is on it. The purpose is to make sure “clean” means “tested for what I actually used”, not “tested for something else”.
Translator’s note: in Thailand, use only pesticides registered with the Department of Agriculture (กรมวิชาการเกษตร), and apply them exactly as the label says. Keep spray records with the product name, date and dose. Those records tell the laboratory what to look for, and an auditor will ask for them. More detail in Pesticide Residues on Cannabis and What You May Legally Spray on Cannabis Under Thai GACP.
4. Microbial Testing
Microbial tests give two kinds of result. Counts estimate how many living microbes there are per gram, reported in colony-forming units per gram (CFU/g); one “colony” grows from roughly one living cell on a test plate. Named targets are organisms that are unacceptable at any count. These are conventionally coliform bacteria (a sign of poor hygiene), Escherichia coli and Salmonella.
That grouping is general practice; each jurisdiction sets its own list and limits. Gwinn and colleagues (Frontiers in Microbiology, 2023) note that molecular methods such as polymerase chain reaction (PCR, a DNA test) are more sensitive and specific than growing microbes on plates. But PCR can also react to Aspergillus species that are not on the target list, and it can detect dead material.
Why “Total Yeast and Mould” Is a Disputed Number
Gwinn and colleagues argue that counting all yeasts and moulds, whether or not they have any history of causing harm, does not tell you the health risk. One number mixes harmless fungi with the ones that matter.
They report that action limits in the United States range from 10,000 to 100,000 CFU/g, a tenfold spread. They also cite a review of seven case reports of aspergillosis in cannabis smokers.
What to do: if a certificate shows a high total yeast and mould count, ask whether the laboratory also tested for specific Aspergillus species. The purpose is to separate a harmless high count from a real health risk.
5. Mycotoxins
Mycotoxins are toxins made by moulds. They are the reason a microbial test alone is not enough: the toxin stays in the material after the mould is dead.
Aflatoxins come mainly from Aspergillus flavus and Aspergillus parasiticus, in four variants: B1, B2, G1 and G2. They rank among the most cancer-causing substances known, with effects including liver cancer. United States Food and Drug Administration action levels are described as ranging from 20 to 300 parts per billion, depending on the commodity. Laboratories detect them by high-performance liquid chromatography (HPLC) and by liquid chromatography with tandem mass spectrometry (LC-MS/MS). Gwinn and colleagues note that exposure to another mycotoxin, ochratoxin A, can cause kidney damage.
What the Surveys Found
In California compliance testing of 5,654 flower samples, Gwinn and colleagues report that aflatoxins exceeded the limit in one sample. No ochratoxin A was detected in more than 9,000 legal California samples tested in 2020 and 2021.
The illegal market looked different. In 142 illicit samples from Luxembourg, ochratoxin A was found in 39% of resin samples and 27% of herbal samples. Rules also vary widely: some United States states set zero tolerance, others set no limit at all. Canada and the European Union work from European Pharmacopoeia guidelines.
Why This Matters Most for Patients
Aflatoxin B1 can weaken the immune system. Exposure is associated with higher viral load in people living with HIV. An amount a healthy adult clears may be a serious risk for someone whose immune system is already weak. This is why mycotoxin tests matter most in a medical supply chain.
What to do: if you supply material for medical use, make sure every batch certificate includes aflatoxins and ochratoxin A, not only a microbial count. The purpose is to protect the patients most at risk, and to meet what medical buyers will require.
6. Residual Solvents
This test is for extracts, not flower. Flower that never touched a solvent cannot contain one. The test is normally done by headspace gas chromatography: the sample is heated in a sealed vial, and the instrument samples the vapour that collects in the space above it (the “headspace”).
A clean result means only that the solvents on that laboratory’s list were not found above its reporting thresholds. It does not prove that no solvent was used. It says nothing about a solvent that was not on the list.
What to do: if you make or buy extracts, check that every solvent used in production appears on the certificate’s list. The purpose is to make sure the test covered the real process.
7. Water Activity and Moisture
Moisture content is the total weight of water in the material. Water activity (aw) is how available that water is to microbes, on a scale from 0 to 1. Gwinn and colleagues report that most fungi grow best at water activity between 0.83 and 0.99, and growth is prevented below 0.7. Aspergillus and Penicillium can still survive in the 0.62 to 0.7 range.
Water activity is the one forward-looking number on the certificate. The other results describe the past. This one predicts whether microbes can multiply while the material is in storage.
What to do: measure water activity at packing and again before sale. The purpose is to know whether your storage is keeping mould growth stopped. More in Drying Cannabis Without Ruining the Harvest.
Translator’s note: in much of Thailand, room air during the rainy season is hot (30–35 °C) and very humid. Dried flower in an open or poorly sealed container takes up moisture from the air, so its water activity rises after testing. A certificate that showed a safe value at packing does not guarantee the same value months later. Store in airtight containers in a cool place, and re-measure batches that have been stored through the wet months.
8. Foreign Matter and Physical Inspection
This is an examination by eye and under low magnification for things that should not be there. Examples are insect parts and droppings, visible mould, hair, soil, sand, plastic, metal and excess stem. The European Medicines Agency GACP guideline requires plant material to be inspected and, where necessary, sieved. A failure here usually points to a problem in handling or storage.
What to do: inspect each batch under a magnifier before sampling, and record what you remove. The purpose is to fix handling problems on the farm, before they show up as a failed test.
9. Reading the Document Itself
Identity, Dates and Scope
- Check that the batch number on the certificate matches the package exactly.
- Check that there is a separate sample number.
- Check that the certificate says who collected the sample and when.
- Check the sampling date, the date the laboratory received it, and the issue date. Long gaps matter for terpenes, which evaporate, and for microbial counts, which change.
Also check what the certificate covers. A potency-only certificate says nothing about contamination. A certificate for flower does not cover an extract made from that flower.
Detection Limit Versus Quantification Limit
The limit of detection (LOD) is the lowest level at which the method can reliably say a substance is present. The limit of quantification (LOQ) is a higher level at which it can say how much is present. “Not detected” and “below LOQ” are different statements, and neither means zero.
What “Pass” Hides
Action limits (the levels at which a result fails) are set by regulators, not by laboratories, and they differ between jurisdictions. The certificate should state whose limits it applied. Where a number appears next to a pass mark, read the number. A result at 95% of the limit and a result at 2% of the limit both read “pass”.
Warning Signs on a Certificate
| Warning sign | What it looks like | Why it matters |
|---|---|---|
| No accreditation details | No accrediting body, number or scope named | Nothing shows the laboratory is competent |
| Wrong lot | Batch number does not match the package | It describes different material |
| Old certificate | Issued long before you received the material | Microbe counts and water activity change over time |
| One batch picked for testing | One certificate reused across several lots | It vouches for material that was never tested |
| Laboratory shopping | Potency from one laboratory, contaminants from another | Results were chosen, not simply reported |
| Pass marks only | “Pass” with no values or limits | Hides how close the result was to the limit |
What to do: run through this table for every certificate before you sign a purchase or sales contract. The purpose is to catch a certificate that does not describe the material in front of you.
10. The Thai Context
The original article gives this background. Thailand became the first Asian country to legalise medical cannabis, in 2018. In June 2022, cannabis flower was removed from the narcotics list. Extracts containing more than 0.2% tetrahydrocannabinol (THC) by weight stayed under the narcotics law and needed a licence.
The current rules are these. Cannabis flower (ช่อดอกกัญชา) is a controlled herb under the Notification of the Ministry of Public Health Re: Controlled Herbs (Cannabis), B.E. 2568, issued under the Thai Traditional Medicine Protection Act B.E. 2542 (1999) and in force since 26 June 2025. Flower may be sold only with a PT 33 (ภ.ท.33) prescription, for a maximum of 30 days. Advertising and online sale of flower are prohibited. The Ministerial Regulation on Controlled Herbs (No. 2) B.E. 2569, in force 30 April 2026, tightens licence criteria for cannabis flower.
As reported by the law firm Tilleke & Gibbins, cannabis flower sold or exported must come from a site certified under Good Agricultural and Collection Practices (GACP). Inspection covers soil, water, pesticide use, worker hygiene and post-harvest handling. Certification lasts one to three years, with yearly surveillance checks. Required records include seed origin, input logs and quality-control tests.
That last item is the key one. In Thailand, testing sits inside cultivation certification. It is not a separate requirement aimed at consumers.
What to do: keep every certificate together with the batch’s farm records (seed origin, inputs, sprays, harvest and drying dates). The purpose is to show an auditor a complete trail from plant to test result.
What an Export Operation Needs
A grower selling abroad must meet the destination market’s test panel, not Thailand’s. That means:
- A laboratory holding ISO/IEC 17025 accreditation, with the destination’s required substances inside its accredited scope.
- The destination market’s pesticide list, which can be far longer than a local one.
- Contaminant results compared with that market’s action limits, with those limits printed on the certificate.
- Documented independent sampling, because the importing regulator will ask who took the sample.
- Retained samples and a written retest policy.
More detail in Testing Cannabis Flower Before Export.
Translator’s note: before you sign an export contract, ask the buyer in writing which tests, limits and laboratory accreditation they require. Then ask your Thai laboratory whether its accredited scope covers all of them. If it does not, you will need a second laboratory, and you should plan that cost and time before harvest, not after.
Share a Certificate That Confuses You
Post the certificate below this topic. Black out the producer’s and the laboratory’s names first. Then say what puzzles you: whether a total adds up, why two laboratories disagree on one batch, or whether a test list looks short for the market you are selling to. Reading real documents together is the fastest way to tell a certificate that means something from one that only looks like it.
References
- California Department of Cannabis Control: laboratory licensing, ISO/IEC 17025 requirement, required test categories, and the representative sampling checklist for distributors.
- European Medicines Agency. Guideline on Good Agricultural and Collection Practice (GACP) for starting materials of herbal origin, EMA/HMPC/246816/2005 Rev. 1.
- Giordano and colleagues. Scientific Reports, 2025 (label accuracy of 277 Colorado cannabis products by HPLC).
- Montoya and colleagues. Frontiers in Pharmacology, 2020 (CBD label accuracy, heavy metals and pesticide contamination).
- Gwinn and colleagues. Frontiers in Microbiology, 2023 (microbial testing, total yeast and mould, mycotoxins and water activity).
- Tilleke & Gibbins. Summary of the Thai Notification of the Ministry of Public Health Re: Controlled Herbs (Cannabis), B.E. 2568, and GACP requirements.
This article is part of the Asiannabis Community educational series on cultivation standards, testing and export. It is general information, not legal or regulatory advice. Content is for educational purposes within jurisdictions where cannabis is legally permitted.