Checklist · Cannabis · Laboratory Testing

Certificate of Analysis (COA) & Lab-Testing Compliance Checklist

Trace a cannabis batch from sample collection through the laboratory result, release decision, labeling, state tracking, and downstream records before treating a COA as clearance to sell.

By Lincoln Square Law · 8-minute read

🖨 Print this checklist

A certificate of analysis is evidence about a tested sample. It is not, by itself, proof that the correct batch was sampled, the laboratory was authorized, the product remained unchanged after sampling, the correct legal limits were applied, or the right COA was attached to the units offered for sale. A useful testing program therefore controls the entire path from batch definition through sampling, laboratory result, release decision, label data, and downstream record retention.

Audit the chain from production batch to retail unit

Start with a physical package ready for transfer or sale. Trace it backward to its batch or lot, the state-system record, the sample collection event, the laboratory report, and the production record. Then reverse the test: choose one laboratory report and identify every package or finished unit that relies on it. A mismatch in either direction is a compliance problem even if each individual document looks complete.

COA and laboratory-testing controls

• Identify the exact batch or lot being sampled and lock the production record before the sample is collected.
• Confirm the laboratory is currently authorized for the jurisdiction and testing activity involved.
• Document who selected the sample, when it was collected, the quantity taken, seal or package identifiers, and chain of custody.
• Verify the sampled batch remains segregated and cannot be sold or transferred until the governing release criteria are met.
• Match the laboratory result to the state-system package or batch identifier before using the COA for release or labeling.
• Confirm every required analyte or testing category appears for the product type and jurisdiction.
• Review units, limits of quantitation, pass/fail fields, dilution or preparation notes, and any qualifiers that affect interpretation.
• Do not treat a potency value as proof that contaminant, pesticide, solvent, heavy-metal, microbial, or mycotoxin requirements passed.
• Confirm the tested formulation and packaging configuration still match the batch that will be sold.
• Recalculate label cannabinoid values from the correct result and verify rounding and unit conversions before artwork approval.
• Maintain a controlled rule for failed tests, administrative holds, resampling, retesting, remediation, destruction, and regulator notice.
• Prevent sales staff, production staff, or vendors from replacing a failed COA with a different result unless the regulator-authorized process permits it.
• Provide downstream dispensaries with required laboratory results and retain the record for the required period.
• Keep the original laboratory report, not only a marketing COA reformatted by a manufacturer or distributor.
• Tie every correction to an audit trail showing who changed the record, why, and which source result supports the change.
• Audit a sample of COAs against physical inventory and state-system records each month or at another documented risk-based cadence.

Illinois requires testing before product moves into specified sale-ready stages

Illinois law requires approved laboratory testing and independence requirements for testing facilities (410 ILCS 705/50-5). The Department of Agriculture’s current rule requires each batch to be made available for an approved laboratory employee to select a random sample immediately before specified manufacturing, natural processing, or packaging for sale to a dispensary. The rule identifies required testing categories including microbiological contaminants, mycotoxins, pesticide active ingredients, residual solvents, heavy metals, and active ingredient analysis (8 Ill. Adm. Code 1300.700).

The rule also addresses representative sampling, batch size for cured flower, failed-test reporting, laboratory retention, and providing laboratory results to dispensaries. Build those requirements into the production release gate. The employee who needs inventory tomorrow should not be able to bypass the status merely because a PDF with the right product name appeared in email.

Missouri treats testing as part of the statewide control system

Missouri 19 CSR 100-1.110 sets the testing framework, including requirements for testing licensees, accreditation, sampling and product testing. Section 100-1.130 links regulated inventory to the statewide track-and-trace system, while dispensary rules require the seller to verify through that system that product has passed mandatory testing and is not on administrative hold, recalled, or required to be destroyed before sale or distribution.

For a multi-state company, do not copy an Illinois release checklist into Missouri and assume the analyte, sampling, retest, or status rules are identical. Maintain a jurisdiction matrix that tells the employee which rule set applies to the facility and product.

The common control is the evidence path: authorized laboratory, identified sample, controlled batch status, verified result, permitted release.

Read the result, not just the green box

Laboratory reports can include qualifiers, method information, detection or quantitation limits, units, and observations that matter to interpretation. An internal reviewer should verify the result is internally consistent before entering values into a label or product record. Check decimal placement, percentage versus milligram units, wet- or dry-weight assumptions where relevant, and whether a reported “ND” means not detected under the applicable method rather than an absolute zero.

Where the product label uses cannabinoid information from the COA, treat label generation as a controlled calculation. Record the source report and formula used. A hand-entered potency number copied from an earlier batch can create a labeling problem even though the current batch passed testing.

Failed testing needs a prewritten decision tree

The worst time to decide what a failed test means is after a production deadline has been missed. The SOP should identify who freezes the affected inventory, who reviews the laboratory record, what resampling or retesting is permitted, whether remediation is allowed, when regulators must receive information, and when destruction becomes the required path. The team should be prohibited from shopping for a more favorable COA outside the authorized process.

Preserve every version of the record. If a laboratory corrects a report, keep the original, the correction, and the explanation. If the facility makes a state-system adjustment, preserve who made it and why. Testing compliance is easier to defend when the file shows the problem and the controlled response instead of presenting a record that looks artificially perfect.

Use COA audits as an early-warning system

Periodic sampling of released inventory can detect recurring data-entry mistakes, supplier changes, label drift, expired or incorrect results, and weak batch controls. Track findings by cause. If the same discrepancy appears across products or locations, correct the shared process instead of fixing one SKU at a time.

A defensible testing program should let management answer four questions quickly: what was sampled, who tested it, what the result authorized, and where every unit tied to that result went. If the record cannot answer all four, the organization has more work to do before calling the batch release complete.

Control external laboratory and internal data handoffs

Many testing errors occur after the laboratory performs its work correctly. A report may arrive under a filename that does not contain the state package number, an employee may manually copy potency into a spreadsheet, artwork may be generated from an old result, or a distributor may receive a reformatted COA that omits qualifiers. Treat each handoff as a controlled data transfer. Define the authoritative identifier, require a second check for manually entered values, and prevent label release until the batch, state-system identifier, laboratory report, and packaging record agree.

Vendor oversight should also be documented. Maintain the laboratory’s current approval or accreditation evidence, contact information, method or service scope used by the facility, and a process for receiving corrected reports or regulator communications. When a method, laboratory, product formulation, or legal testing requirement changes, review whether existing templates, label calculations, or release criteria also need to change. The purpose is not to second-guess laboratory science. It is to ensure the company does not convert a valid laboratory result into an invalid business decision through weak record handling.