Anyone can build a hemp website in a weekend. Slick photography, a lab-tested badge, a discount code, a stock photo of a white-coated technician holding a pipette. None of it is regulated, and almost none of it is verified by anybody.
What follows is a checklist you can run in about ten minutes, in order, on any brand. We built it out of an audit we ran across every brand in our own review catalogue — and several of the failure modes below are ones we found repeatedly, at companies with polished websites and large followings.
This article is for general educational purposes and is not medical or legal advice.
Minute 1–2: Can you open a lab report at all?
Go to the site and look for "Lab Results," "COAs" or "Certificate of Analysis." Try to open one.
That sounds trivial. It is the step that eliminates the most brands.
What we found repeatedly: lab pages that list batch numbers but where the PDF links never load. Entire libraries handed off to a Google Drive or Zoho folder that shows a spinner and nothing else. Pages advertising "third-party tested" with no document behind the claim anywhere on the site.
The standard: a report should open in a couple of clicks, without an account, without giving an email address, without a support ticket.
Why it matters: a COA you cannot open is functionally identical to a COA that does not exist. It is worth being blunt about this, because "the reports are there, the viewer is just broken" is not a meaningful distinction from the buyer's side. If the brand cannot be bothered to check that its own evidence loads, that tells you something.
Minute 3–4: Does it match the batch on your package?
This is the criterion most people skip and the one that determines whether the document means anything at all.
A COA describes one batch. A report for "Blue Dream" tells you what one harvest of Blue Dream contained. It does not tell you what is in the jar in your hand.
The standard: you can find the specific report matching the batch or lot number printed on your package — via a search field, a QR code on the packaging, or a batch-indexed list.
What falls short: a library organised only by strain or product name. A single PDF representing an entire product line. A QR code that lands on the brand's homepage rather than the report.
Batch lookup is much rarer than you would expect. In our own audit, only a third of brands offered it. If you take one habit from this article, take this one.
Minute 5–6: Who ran the test, and when?
Open the report and look at the top and bottom of the first page.
Lab name. There should be a named, independent laboratory with an address — and ideally an ISO/IEC 17025 accreditation number or a state licence number. Names you will see legitimately include Kaycha, ACS, PharmLabs, Green Scientific, Botanacor, KCA and Columbia, among many others.
A report with no letterhead, no lab identifiers and no signature is a red flag. So is a brand that describes its testing only in vague terms — "top-tier labs" with no lab ever named is not a claim you can check.
Date. Look for a test date within roughly twelve months. We found published reports three and four years old sitting on current product pages. At that age the document has stopped being evidence.
Batch and sample ID. These should be present and populated. If the batch field is blank, the report is not about any particular product.
Minute 7–8: Does it test for more than potency?
Now scan what the report actually covers. A potency panel tells you the strength. It tells you nothing about safety.
A complete report includes:
- Cannabinoid potency — how much of each cannabinoid is present
- Pesticides — residues from cultivation
- Heavy metals — arsenic, cadmium, mercury, lead
- Residual solvents — left over from extraction or cannabinoid conversion
- Microbials — mould, yeast, E. coli, salmonella, aspergillus
- Mycotoxins — toxins produced by mould
A great many published COAs cover only the first item.
The pattern worth knowing about: across the brands we examined, smokable products consistently received thinner testing than edibles. The same company would run a full six-panel test on its gummies and a potency-only test on its flower and pre-rolls.
That is backwards. Cannabis is a hyperaccumulator — it draws heavy metals out of soil and concentrates them in the plant. Flower carries whatever was sprayed on it and whatever mould grew during cure. And combustion delivers all of that straight to lung tissue.
So if you are buying flower, pre-rolls, vapes or concentrates, check the contaminant panels specifically. Do not assume that a brand testing thoroughly in one category tests thoroughly in all of them. Our guide to reading a COA walks through each panel in more detail.
Minute 9: Read the values, not just the stamps
A green PASS stamp is a summary, not a result. Look underneath it.
Things that should make you stop:
- Panels stamped PASS with no underlying values. A blank table under a pass banner is a template, not a test.
- Every cannabinoid reading ND. If a THC product's report shows no detectable THC, the report does not describe that product.
- Potency wildly off the label. Some variance is normal; a large gap is not.
- Blank dates or lab IDs anywhere on the document.
- A report from the brand's own lab rather than an independent third party.
On a legitimate report, ND on a contaminant panel is exactly what you want — it means the substance was below the lab's detection limit. ND on a cannabinoid panel for the cannabinoid you are buying means something has gone wrong.
Minute 10: The commercial checks
Lab documentation is most of the job. These take under a minute between them and catch a different category of problem.
Is there a real business behind it? A physical address, a working phone number, a contact route that is not just a chat widget. Anonymous brands are hard to hold accountable.
What are the subscription terms? If there is an auto-ship or subscribe-and-save option, find the cancellation terms before ordering. Look for how much notice is required, whether you can cancel without emailing someone, and what happens to a shipment already in transit.
What is the return policy on opened product? Many hemp brands accept returns only on unopened items, which means a product you dislike is a product you have bought.
Do they ship to your state? And separately — is it legal where you are? Those are different questions. A retailer's shipping map reflects its own risk tolerance and payment processor rules, not the law. Check our state-by-state guide for where things actually stand.
How are the health claims worded? Hemp companies cannot legally claim to treat, cure or prevent disease. A brand making explicit medical claims is either unaware of the rules or unconcerned by them, and neither is reassuring.
What a failing grade actually means
Worth being precise here, because it is easy to over-read this.
A brand that publishes lab documentation badly is not thereby selling a dangerous product. Plenty of companies test properly and publish carelessly. What poor documentation means is that you cannot tell — and that the company has not prioritised letting you.
The checklist measures transparency, which is the only thing a buyer can actually assess from outside. Use it to know what you are and are not being told, then decide what you are comfortable with.
The ten-minute version
- Open a COA. Two clicks, no email. If you cannot, stop.
- Find your batch number on it. If there is no batch lookup, the document is not about your product.
- Check the lab name and the test date. Named lab, within twelve months.
- Check the panels. Potency plus pesticides, heavy metals, solvents, microbials — especially on anything you inhale.
- Read the values under the PASS stamps. Blank fields and all-ND cannabinoid panels are disqualifying.
- Check the business, the subscription terms, the return policy, and your own state's law.
Six checks. Ten minutes. It is a better filter than any badge on a homepage.
Frequently Asked Questions
What is the single most important check?
Batch matching. A COA describes one batch, so a report that does not correspond to the number printed on your package tells you nothing verifiable about what you bought.
Is potency-only testing a dealbreaker?
It depends on the product. For anything inhaled — flower, pre-rolls, vapes, concentrates — a potency-only report leaves out exactly the information that matters most, because combustion delivers contaminants directly to the lungs.
How recent does a lab report need to be?
Within roughly twelve months, and matched to your batch. Reports several years old are still routinely published on current product pages.
Can a COA be faked?
Yes. Verify the report through the lab's own portal or a QR code with lab contact details you can independently check. A flat image with no lab identifiers, batch number or signature is a warning sign.
What does ND mean on a lab report?
Not detected — below the lab's limit of quantitation. On a contaminant panel that is the good result. On a cannabinoid panel it means the compound is not present in measurable amounts, which is a problem if it is the compound you paid for.
