Cannabis Lab Testing: What Gets Tested and How to Read Results

Why Cannabis Testing Exists

Before legal regulated markets, consumers had no way to verify what was in the cannabis they purchased. There were no potency labels, no pesticide disclosures, and no contamination checks. Illicit-market cannabis has been found to contain residues of banned pesticides such as myclobutanil (which converts to hydrogen cyanide when combusted), heavy metals from contaminated growing media, and mold capable of causing fatal lung infections in immunocompromised patients.

Legal markets addressed this by requiring mandatory third-party testing at licensed, accredited laboratories before any cannabis product can be sold at retail. Testing serves three functions: patient and consumer safety, regulatory compliance verification, and consumer information so buyers can make informed choices about potency and effect profile.

Testing Panel Overview

Potency Testing: HPLC, Accuracy, and the Lab Shopping Problem

The industry standard method for cannabinoid potency testing is HPLC — high-performance liquid chromatography. In HPLC testing, a cannabis sample is dissolved in a solvent and pushed through a column that separates individual cannabinoids by their chemical properties. A detector measures the concentration of each compound as it exits the column. Because HPLC does not apply heat, it can accurately distinguish between THCA (the raw acid form) and delta-9-THC (the active form), which is critical for accurate potency reporting.

Even with HPLC, inter-laboratory variability of ±3–5 percentage points is documented in peer-reviewed research. A product that tests at 22% THC at one accredited lab might legitimately test at 18% or 26% at a different accredited lab. This variability arises from differences in sample preparation, instrument calibration, and the inherent heterogeneity of cannabis flower itself — different parts of the same bud have measurably different cannabinoid concentrations.

Lab shopping exploits this variability. Producers identify which labs in their state consistently return high THC numbers and send samples exclusively to those facilities. The result is systematic inflation of potency claims across the market. Extreme potency claims above 35% THC for flower warrant additional scrutiny of the lab’s accreditation status and testing methodology, since 35% THC approaches the biological limit of THCA synthesis in cannabis genetics.

Pesticide Testing: State Requirements and Key Compounds

Pesticide testing requirements vary significantly by state. California has the most comprehensive panel, screening for 66 or more individual compounds with strict action limits. Other states require testing for fewer compounds or allow higher residue thresholds. A product that passes testing in one state might fail under California’s standards — an important consideration for consumers in less rigorous markets.

Key pesticide categories include organophosphates (such as chlorpyrifos and malathion), pyrethrins and pyrethroids (bifenthrin, permethrin), fungicides (myclobutanil, trifloxystrobin), and plant growth regulators (paclobutrazol). Myclobutanil is particularly concerning because it converts to hydrogen cyanide at temperatures reached during smoking or vaporizing. Organically grown cannabis still requires testing — organic certification does not automatically mean pesticide-free.

Microbial Testing: Why It Matters for Vulnerable Consumers

Cannabis can harbor dangerous microorganisms. Aspergillus fumigatus, Aspergillus flavus, Aspergillus niger, and Aspergillus terreus are the four species most commonly tested because they produce mycotoxins and can cause invasive aspergillosis — a life-threatening lung infection in immunocompromised individuals. HIV/AIDS patients, transplant recipients, and people undergoing chemotherapy face the highest risk from contaminated cannabis.

Total yeast and mold (TYM) counts measure general microbial contamination. Acceptable TYM limits vary by state but are typically around 10,000 CFU/g. E. coli and Salmonella testing ensures the product has not been contaminated through handling, irrigation water, or processing. Microbial contamination is most common in outdoor-grown cannabis or in product that was improperly dried or stored after harvest.

Heavy Metal Testing: Why Cannabis Absorbs What’s in the Soil

Cannabis is a known phytoremediator — it actively absorbs compounds from the soil, including heavy metals. This property has been explored as a remediation tool for contaminated land, but it also means cannabis grown in lead-contaminated urban soil or near industrial sites can accumulate dangerous metal concentrations. The four metals routinely tested are lead, arsenic, cadmium, and mercury, all of which cause serious organ damage with chronic or high-level exposure.

Concentrates carry higher heavy metal risk than flower because the extraction process concentrates everything in the plant material — including metals. A trace amount of lead in flower can concentrate 5–10 times in an extract. State action limits for heavy metals in concentrates are typically stricter than for flower to account for this concentration effect.

Lab Accreditation: ISO/IEC 17025, NELAP, and ORELAP

ISO/IEC 17025 is the international standard for the competence of testing and calibration laboratories. A lab holding this accreditation has demonstrated to an independent assessor that personnel are qualified, equipment is properly calibrated, test methods are scientifically valid, and quality management systems meet defined standards. In cannabis testing, ISO/IEC 17025 is the baseline credential to look for.

NELAP (National Environmental Laboratory Accreditation Program) and ORELAP (Oregon Environmental Laboratory Accreditation Program) are additional accreditation bodies relevant in specific states. To verify a lab’s accreditation in the US, check the A2LA (American Association for Laboratory Accreditation) or PJLA (Perry Johnson Laboratory Accreditation) registries directly. Never rely on a lab’s self-claim of accreditation without independent verification.

Reading a Dispensary COA: Step by Step

Every legal cannabis product should have an accessible Certificate of Analysis. Here is how to evaluate one efficiently:

1. Scan the QR code on the product packaging. This should link directly to the COA on the testing lab’s own website — not a brand-hosted PDF that could be modified.
2. Match the batch number. The batch or lot number on the COA must match the number on your product label. A COA from a different batch provides no assurance about your product.
3. Check the test date. COAs older than 12 months may not reflect current product condition. Microbial contamination can develop post-testing if the product is stored improperly.
4. Review the cannabinoid panel. Verify that total THC (THCA × 0.877 + delta-9-THC) closely matches the label claim. Large discrepancies are a red flag worth investigating.
5. Inspect all safety panels. Every pesticide, heavy metal, and microbial entry should show PASS or ND (not detected). Any FAIL entry means the product should not legally be on sale.
6. Confirm lab accreditation. Note the lab name and verify its ISO/IEC 17025 status through an independent accreditation registry, not the lab’s own marketing materials.

Red Flags When Evaluating a COA

A missing COA means the product has not been third-party tested or the brand is hiding results — unacceptable in any legal market. An expired COA or one from a different production batch provides no assurance about the current product. COAs from unaccredited labs can be unreliable or fabricated. Cannabinoid totals exceeding 100% indicate a calculation or reporting error. Uniformly round potency numbers with no decimal variation suggest manual entry rather than instrument-generated data. Flower potency claims above 35% THC are biologically implausible given known limits of THCA synthesis in cannabis genetics.

Frequently Asked Questions