Why COAs Matter More Than Reviews
Sep 08, 2025
A Certificate of Analysis (COA) is a third-party lab report that proves what is — and what isn't — inside a hemp product. Online reviews tell you how a stranger felt; a COA tells you how much THCa, Delta-9 THC, pesticide, solvent, and heavy metal your jar actually contains. When you're spending money on something you're going to put in your body, the COA is the document that should drive the decision, not the star rating. Reviews are a useful sanity check on taste and customer service; they are not a substitute for chemistry.
This guide walks through why COAs outrank reviews for any THCa flower, gummy, cart, or disposable purchase — what a real COA proves, what reviews can't tell you, the six items every buyer should check before clicking "add to cart," and the way thisthat actually vets a batch before it goes on the shelf.
What Is a COA, in One Paragraph?
A Certificate of Analysis is a PDF (sometimes a QR-linked web page) produced by an independent, accredited laboratory after testing a specific batch of hemp. A complete COA reports the cannabinoid potency (THCa percentage, Delta-9 THC percentage, CBD, CBG, CBN, and total THC), the terpene profile, and four safety panels: pesticides, heavy metals, residual solvents, and microbial contamination (including mycotoxins). Every COA is tied to a specific lot or batch number that matches the number printed on the product packaging. If those numbers don't match — or there's no COA at all — you don't have proof of anything.
Why Reviews Can Lie (and COAs Cannot)
Online reviews are a popularity signal, not a safety signal. There are at least four reasons a five-star average doesn't mean what buyers assume it means.
1. Paid placements and incentivized reviews. Many brands offer discounts, free product, or affiliate commissions in exchange for a review. Review platforms try to flag these, but the enforcement is uneven. A "verified buyer" badge means a transaction happened; it does not mean the reviewer was unpaid or honest.
2. Survivorship bias. Most buyers don't leave a review unless they had an extreme experience — really good or really bad. The silent middle (the 70–80% of customers who got an okay-but-not-life-changing product) doesn't show up in your sample, and that skews the average upward in most catalogs.
3. Taste is not safety. A reviewer can love a strain's smell, lean back into a couch lock, and write a glowing review while smoking flower contaminated with pesticide residue or sprayed with synthetic cannabinoids. None of that registers in a five-star rating — but it will show on a lab report.
4. The brand controls the page. On a brand's own site, reviews are moderated. Negative reviews can be deleted, edited, or buried. Independent third-party platforms are better, but every system can be gamed. The COA, by contrast, is produced by a lab that doesn't know or care about the brand's marketing — its incentive is to be right, not popular.
What a COA Proves That a Review Cannot
A real COA from an accredited lab proves four categorical facts about a product that no review system can verify:
- Compliance with the 0.3% Delta-9 THC federal hemp limit. If the Delta-9 number on the COA is over 0.3% by dry weight, the product is not federally legal hemp — full stop.
- Actual cannabinoid content. The THCa percentage on the label has to match the COA. If a brand prints "32% THCa" on a jar but the COA shows 24%, you're being overcharged for a weaker product.
- Absence of dangerous contamination. Pesticides, heavy metals (lead, arsenic, cadmium, mercury), residual solvents from extraction (butane, propane, ethanol), and microbial contamination (E. coli, salmonella, aspergillus mold, mycotoxins) all have action limits — concentrations above which the product fails.
- The terpene profile. Terpenes shape how a strain feels more than the indica/sativa label. The COA shows which terpenes dominate and at what concentration, so you can match the chemovar to the effect you want.
The 6 Things to Check on Every COA (60-Second Routine)
Here's the checklist a smart buyer runs on every COA before adding to cart:
- Lab name and accreditation. The COA should clearly identify the testing lab and ideally state ISO/IEC 17025 accreditation. ISO 17025 is the international standard for analytical lab competence — it's the credential that says the lab's method, calibration, and personnel are validated by an outside body. Texas, like many states, requires consumable hemp to be tested at an ISO 17025-accredited lab.
- Test date. A COA from 18 months ago tells you nothing about what's in this jar today. Flower especially should have testing within the last 6–12 months. Old COAs on a current product is a red flag — it usually means the brand is reusing a document.
- Batch / lot number match. The batch number on the COA should match the batch number on the product label or jar. If those don't match, the COA might be from an entirely different harvest.
- Cannabinoid potency vs. label. Total cannabinoids on the COA should be within ~10% of what the brand advertises. The Delta-9 THC number should be at or below 0.3% to be legally hemp.
- Four safety panels: all "Pass" or "ND." Look for "Not Detected" or "Pass" on pesticides, heavy metals, residual solvents, and microbials. Anything above an action limit and the product should not be on a shelf.
- Terpene profile present. A COA without a terpene panel is incomplete. The terpene table is how you predict effect.
ISO 17025 and Why It Matters in 2026
One of the biggest shifts in cannabis lab testing this year is the widespread adoption of ISO/IEC 17025 as the floor — not the ceiling — of credibility. State licenses alone are now considered insufficient by most regulators and serious brands. ISO 17025 requires labs to demonstrate that they produce valid results through rigorous method validation, regular equipment calibration, ongoing technician training, and independent auditing.
thisthat works with ISO 17025-accredited labs, including Green Leaf Lab, which has been ISO 17025-accredited in both its Oregon and California facilities since 2016. When you scan the QR on a thisthat product and the COA opens, the lab name and accreditation status should be the first thing you see.
When Reviews ARE Useful — Just Not for Safety
Reviews aren't useless. They're great signals for a few specific things that a COA cannot tell you: customer service responsiveness, shipping speed, packaging quality, taste consistency from batch to batch, and the brand's willingness to make right on a complaint. If you're choosing between two brands whose COAs both look clean, then reviews — especially independent platform reviews and Reddit discussion — become the tiebreaker.
The order of operations is: COA first, reviews second. Not the other way around.
Red Flags That Should End the Purchase
Walk away from any THCa, live resin, gummy, or cart product if you see any of the following:
- No COA available at all. If the brand can't or won't show a COA tied to your specific batch, that's the single biggest red flag.
- COA from a lab you can't verify. The lab should be on the ISO 17025 registry of either ANAB, A2LA, or a comparable accreditor.
- Batch numbers don't match. COA is for a different harvest.
- Pesticides or heavy metals showing a "Fail" or above action limit. Some brands hope you won't read the full document.
- Cannabinoid total below 70% of what the label claims. You're being overcharged for weaker product.
- No terpene panel. A potency-only COA is half a report.
How thisthat Reviews Flower Before It Ships
Every batch of THCa flower, every live resin disposable, every dripper, every gummy, and every 510 cart sold at thisthat ships with a COA tied to its specific batch number, accessible by QR or by visiting thisthatcbd.com/pages/lab-results. The cannabinoid potency on the label must match the lab report within tolerance. The four safety panels must all read Not Detected or Pass. The terpene profile must be present and match the strain claim. If a sample fails any one of those checks, the batch does not ship.
That is the difference between buying flower because a Reddit thread liked the smell, and buying flower because chemistry confirmed it's clean and matches the claim.
The Short Version (60-Second Recap)
A COA is third-party proof of what is in a hemp product. Reviews are a popularity signal that can be paid, biased, or moderated. Before any THCa purchase, pull the COA, confirm an ISO 17025 lab issued it, check that the batch numbers match, verify Delta-9 is under 0.3%, scan the four safety panels for "Pass" or "ND," and confirm a terpene profile is present. If any step fails, walk away. Reviews are the tiebreaker between two products that already passed the chemistry.
Frequently Asked Questions
Is a COA legally required for hemp products in Texas?
Yes. Texas DSHS requires consumable hemp products to be tested by an ISO/IEC 17025-accredited lab and to verify that Delta-9 THC is at or below 0.3% by dry weight, with documentation available to the consumer. A product offered for sale without an accessible COA is out of compliance.
What does ISO 17025 mean on a COA?
ISO/IEC 17025 is the international standard for analytical laboratory competence. A lab with ISO 17025 accreditation has had its testing methods, equipment calibration, and personnel training independently validated by an accrediting body such as ANAB or A2LA. It's the most reliable single credential to look for on a hemp COA.
How recent should a COA be for THCa flower?
For flower, COAs should ideally be from within the last 6–12 months because terpene content and total cannabinoid percentages degrade with storage. For shelf-stable products like gummies, a COA from the last 12 months is acceptable. Anything older than 18 months on a current product is a red flag.
What's the difference between a COA and a lab certification?
A COA is a report for one specific batch of one specific product. A lab certification (such as ISO 17025) is a credential for the lab itself. You want both: an ISO-accredited lab producing a batch-specific COA. A lab cert without a matching COA proves nothing about your jar.
Can a brand fake a COA?
Yes, and some have. The defenses are: (1) verify the lab name on an accreditor's public registry, (2) check that the batch number on the COA matches the number printed on your product, (3) look at the COA's URL — it should be hosted by the lab, not the brand, and (4) cross-reference the cannabinoid total to the label claim. A fabricated COA usually fails at least one of those checks.
Why are reviews still helpful at all?
Reviews are useful for things chemistry can't measure: shipping speed, customer service, packaging quality, taste consistency, and whether the brand handles complaints well. They are a tiebreaker after two products both pass the COA check. They are not a substitute for the COA itself.
