HPLC, GC-MS, terpene profiling, heavy metals, pesticides, microbial testing, and how to decode a Certificate of Analysis like an expert.
Before legal cannabis markets introduced mandatory third-party testing, consumers had no reliable way to know what was actually in the product they were purchasing. Potency claims were guesses. Pesticide residues from conventional growing went undetected. Mold spores in improperly dried flower caused respiratory infections in immunocompromised patients. Heavy metals accumulated from contaminated soil made their way into concentrates at concerning concentrations.
State-mandated cannabis laboratory testing programs, which became standard in Colorado and Washington after their 2012 legalization votes and expanded to every recreational market since, created a framework where every batch of cannabis sold to consumers must pass a battery of analytical chemistry tests before it can be sold. The result is that legal cannabis is now among the most heavily tested consumer products in the United States — more tested per unit than most conventional food items.
Understanding what those tests are, how they work, and how to read the results is one of the most valuable skills any cannabis consumer can develop. The Certificate of Analysis (COA) attached to every legal product is a transparent window into its chemistry — if you know how to look through it.
High-Performance Liquid Chromatography separates the chemical compounds in a cannabis extract by passing a dissolved sample through a column packed with a stationary phase material at high pressure. Different cannabinoid molecules interact with the stationary phase at different rates, causing them to elute — wash out — at different times. A UV detector or mass spectrometer at the end of the column measures each compound as a distinct peak, and software calculates concentration from peak area.
The critical advantage of HPLC over Gas Chromatography for cannabinoid testing is temperature. GC requires vaporizing the sample, which applies heat that decarboxylates acid-form cannabinoids: THCA becomes THC, CBDA becomes CBD, CBGA becomes CBG. This means GC cannot directly measure acid-form cannabinoids in their natural state. HPLC runs at room temperature or mild heat, preserving the native chemistry and allowing direct measurement of both acid and neutral forms separately.
Modern cannabis labs use either HPLC-UV (ultraviolet detection, less expensive, sufficient for routine potency panels) or HPLC-MS/MS (tandem mass spectrometry, capable of simultaneously detecting and quantifying dozens of cannabinoids with sub-ppm detection limits). ISO/IEC 17025 accredited labs are required to validate their HPLC methods and report measurement uncertainty — a confidence interval on each reported value — which responsible COAs will include.
Gas Chromatography-Mass Spectrometry is the workhorse method for two other critical cannabis test categories: terpene profiling and residual solvent analysis. For these applications, the ability to vaporize compounds is an advantage rather than a limitation.
Terpene profiling by GC-MS or GC-FID (flame ionization detection) identifies and quantifies the aromatic volatile compounds that give cannabis strains their distinctive scent and flavor profiles — and which contribute pharmacologically to the entourage effect. A full terpene panel typically covers 30-50 terpenes including myrcene, limonene, linalool, beta-caryophyllene, alpha-pinene, terpinolene, ocimene, and humulene. Results are expressed as weight percentages or mg/g. Premium products often show total terpene concentrations above 3%, while well-cured flower typically ranges 1-2%.
For residual solvent testing in cannabis concentrates — BHO, CO2 oil, distillate, Rick Simpson Oil — headspace GC-FID or GC-MS is the standard approach. The sample is heated in a sealed vial and the vapor space analyzed for volatile organic compounds including butane, propane, hexane, ethanol, isopropanol, acetone, and benzene. State action limits are derived from USP 467 pharmaceutical residual solvent guidelines and International Council for Harmonisation (ICH) Class I, II, and III solvent classifications.
Inductively Coupled Plasma Mass Spectrometry is the analytical method used to screen cannabis for heavy metal contamination — one of the most serious safety concerns in the industry. The four primary heavy metals tested in all major cannabis markets are arsenic, cadmium, lead, and mercury, which cannabis plants can bioaccumulate from contaminated soils through a process called phytoremediation.
ICP-MS works by digesting the cannabis sample in acid, then atomizing it in a plasma torch at approximately 6,000-10,000 Kelvin. This strips electrons from every element present, creating positively charged ions that are accelerated through a mass spectrometer and detected according to their mass-to-charge ratio. The technique can detect elements at parts-per-trillion concentrations — more than adequate for cannabis safety testing.
Heavy metal limits for inhalable cannabis products (flower, concentrates) are typically set at more stringent levels than for ingestible products (edibles, tinctures) because inhalation bypasses digestive absorption barriers. California’s limits for inhalable products set action levels at 0.5 ppm arsenic, 0.1 ppm cadmium, 0.5 ppm lead, and 0.1 ppm mercury. Products testing above these limits are quarantined and cannot be sold.
Cannabis pesticide testing is among the most analytically complex components of a full COA, requiring screening for 50-100+ individual compounds at very low concentrations. Two complementary techniques handle the full range of pesticide chemistries:
Liquid Chromatography-Tandem Mass Spectrometry (LC-MS/MS) is used for polar, thermally labile, and high-molecular-weight pesticides including organophosphates, neonicotinoids, carbamates, and systemic fungicides like myclobutanil. GC-MS/MS handles nonpolar, volatile organochlorine and pyrethroid pesticides. Running both methods gives labs comprehensive coverage.
Myclobutanil deserves special mention because of a unique toxicity concern specific to cannabis: when combusted at smoking temperatures, myclobutanil generates hydrogen cyanide gas. This pesticide, used on conventional food crops as a fungicide, was found in significant quantities in cannabis samples before states introduced mandatory testing. Its detection in legal-market testing has largely removed it from compliant products, but it remains a concern in illicit-market cannabis.
Microbial contamination of cannabis poses especially serious risks to immunocompromised patients — chemotherapy recipients, organ transplant patients, HIV-positive individuals — for whom exposure to fungal spores or bacterial pathogens can be life-threatening. Standard microbial test panels for cannabis include:
Water activity testing — measuring the amount of free (unbound) water in a cannabis sample on a scale of 0-1 — is increasingly included in COAs because water activity predicts mold growth risk during storage far more accurately than moisture content alone. Cannabis flower with water activity above 0.65 Aw is considered at risk for mold; optimal range for storage is 0.55-0.65 Aw.
A professional Certificate of Analysis includes several sections. Here is what to check in each:
| Product Type | Key Tests | Special Considerations |
|---|---|---|
| Flower | Potency, terpenes, microbials, pesticides, heavy metals, water activity | Heterogeneous sample — homogenization critical |
| Concentrates (BHO/CO2) | Potency, residual solvents, pesticides, heavy metals | Pesticides concentrate 5-10x vs. source flower |
| Edibles | Potency (homogeneity testing), microbials, pesticides | Even distribution of cannabinoids in matrix is regulatory focus |
| Tinctures/Oils | Potency, residual solvents, heavy metals, pesticides | Stated mg/mL vs. actual measured concentration is a common variance point |
| Vape Cartridges | Potency, residual solvents, pesticides, heavy metals, vitamin E acetate | Post-EVALI, vitamin E acetate (tocopheryl acetate) is now screened in most markets |
Most dispensaries display QR codes on product packaging that link directly to the COA for that batch. If a QR code is missing, ask the budtender for the batch COA — any compliant dispensary will have it available. Red flags to watch for include: COA dates older than six months (potency degrades; microbial risk increases in improperly stored products), lab names you can’t verify as ISO-accredited, potency results without uncertainty ranges, or a COA that only shows a summary PASS/FAIL without individual analyte data.
The Oregon Liquor and Cannabis Commission, California DCC, and Colorado MED all publish publicly searchable license databases for testing labs — cross-referencing the lab name on a COA against these databases takes 30 seconds and confirms the lab is legitimately licensed in the state of sale.
One of the most persistent integrity issues in cannabis testing markets is lab shopping: producers submit samples to multiple licensed laboratories and publish only the most favorable results. Because cannabis testing regulations in most states require that a sample pass testing but do not require disclosure of failed tests or averaging of multiple results, producers face a financial incentive to route batches to labs known for reporting higher potency numbers or passing borderline samples.
A 2020 study published in PLOS ONE analyzed 8,505 cannabis samples from Oregon’s mandatory testing database and found statistically improbable clustering of results just above the 20% THC threshold — consistent with lab shopping behavior. The study authors estimated that true average THC content in Oregon recreational flower was likely 2-3 percentage points lower than reported figures suggested.
Proposed solutions include mandatory split-sample testing (one sample sent to two labs with results averaged), blind proficiency testing of all licensed labs, and public disclosure of all test results including failures. Washington State has implemented some of these measures. California’s Bureau of Cannabis Control launched an enhanced laboratory monitoring program with unannounced audits and public posting of compliance records.
High-Performance Liquid Chromatography (HPLC) is the gold-standard method for cannabis cannabinoid potency testing because it measures cannabinoids in their native acid forms — THCA, CBDA, and others — without applying heat. Unlike Gas Chromatography, which decarboxylates acid-form cannabinoids during vaporization, HPLC separates compounds at room temperature by passing a dissolved sample through a pressurized column. Different compounds elute at different rates and are measured by UV or mass spectrometer detectors. The resulting data allows accurate calculation of Total THC using the decarboxylation formula: (THCA x 0.877) + Delta-9 THC. ISO-accredited labs using HPLC report measurement uncertainty ranges alongside each result.
A comprehensive COA covers six major categories: cannabinoid potency (10-15 compounds), terpene profile (30-50 terpenes by GC-MS), pesticide residues (50-100+ compounds by LC-MS/MS and GC-MS/MS), heavy metals (arsenic, cadmium, lead, mercury by ICP-MS), microbial contaminants (yeast, mold, coliforms, pathogens), and residual solvents for concentrate products. Some states add water activity testing, mycotoxin screening, and vitamin E acetate testing for vape cartridges.
Cannabinoids are listed as percentages by dry weight for flower. Look for separate THCA and Delta-9 THC columns — total potential THC = (THCA x 0.877) + D9-THC. Terpenes appear as percentages or mg/g. Contaminant results show numeric concentrations compared to state action limits, or ND (non-detect). Microbials are measured in colony-forming units per gram. Always check the lab’s ISO 17025 accreditation number, the batch ID matching the product, and the date gap between sample collection and report issuance.
Inter-laboratory variability is a documented problem in cannabis testing. Proficiency testing programs show 10-20% divergence in potency results between facilities on the same samples. Root causes include differences in sample homogenization, calibration standards, and HPLC methodology. Lab shopping — where producers submit to multiple labs and publish only the highest result — further inflates reported potency numbers. Look for ISO/IEC 17025 accredited labs that participate in external proficiency testing programs and publish measurement uncertainty ranges on their COAs.