Reading Microbial and Mold Results on a Cannabis COA

August 28, 2026

Photo by MART PRODUCTION via Pexels.

Most people scanning a certificate of analysis go straight for one number: THC percentage. Understandable, but it's also the part of the document that matters least for your health. The microbial and mycotoxin panel, usually buried lower on the page in smaller type, is the section that's actually keeping you out of the hospital. Nobody's ever been harmed by a bud testing 24% instead of 28%. People have been harmed by Aspergillus.

On February 27, 2026, New York's Office of Cannabis Management pulled products off shelves statewide after an audit found that Keystone State Testing New York had falsified Aspergillus results on 54 separate product lots, plus a falsified Cadmium heavy-metal result on a 55th. That's not a rounding error or a lab hiccup. That's a testing facility telling regulators and consumers that dangerous mold wasn't present when, according to OCM's own records, it was.

And New York isn't an outlier. Massachusetts suspended an accredited lab in 2025 after it failed to report yeast and mold failures across more than 7,000 samples. Michigan permanently pulled the license of one of its largest testing labs in August 2025 for what regulators called a sustained, deliberate pattern of mold and potency manipulation. Three states, three separate enforcement actions, all within about eighteen months. That's a pattern, not a coincidence.

This piece is about what's actually being measured when a lab reports on microbial safety, why mold can be thriving inside a bud that looks perfectly clean from the outside, and how to read a COA the way you'd read a used car's maintenance records — with a healthy dose of skepticism about who wrote it and why.

What a Microbial Panel on a COA Actually Tests

Photo by Edward Jenner via Pexels.

A standard microbial panel on a cannabis COA typically covers seven categories: Salmonella species, Shiga toxin-producing E. coli (STEC), Aspergillus, Total Yeast and Mold (TYM), Total Aerobic Count (TAC), coliforms, and bile-tolerant gram-negative bacteria (BTGN). Each of these is measuring something different, and they don't all get graded the same way.

Pathogens like Salmonella and Aspergillus are absence/presence tests — there's no acceptable amount. Either the lab detects it in the sample and the batch fails outright, or it doesn't and that line item passes. TYM and TAC, by contrast, are quantitative. Labs report an actual colony-forming-unit count per gram (CFU/g), and that number gets compared against a state-set threshold — often somewhere in the range of 10,000 to 100,000 CFU/g depending on the state and product type. A batch can have detectable yeast and mold present and still pass, as long as the count stays under the ceiling.

Aspergillus gets its own line item on most modern panels rather than getting folded into the general mold count, and that's deliberate. It's not there because Aspergillus is unusually common — it's there because certain Aspergillus species (A. flavus, A. fumigatus, A. niger, A. terreus) are disease-causing organisms, not just spoilage indicators. A high total yeast and mold count might mean your flower degrades faster or tastes musty. A positive Aspergillus result means something that can actually make someone sick, particularly if it's smoked or vaporized rather than ingested.

How rigorously any of this gets enforced depends entirely on where you're standing. As of June 2026, roughly 38 states plus DC mandate microbial testing for cannabis products, but the specifics — which organisms, what thresholds, which product categories are exempt — vary a lot state to state. Some medical-only programs still have no codified microbial testing rules at all. California's Department of Cannabis Control offers a useful look at where the regulatory ceiling is heading: its framework effective January 1, 2026 separates microbial impurities testing (§15721), mycotoxin testing (§15722), and COA reporting requirements (§15726) into distinct, detailed sections. That level of specificity is becoming the direction every serious state program is moving, even if most haven't caught up yet.

Why Mold Hides Until the Lab Finds It

Mold doesn't need visible fuzz on the outside of a bud to be a problem. Once relative humidity inside packaging or during drying climbs above roughly 60%, spores that are already present on the plant — and they're always present, mold spores are everywhere in ambient air — get enough moisture to start colonizing. That colonization can happen deep inside a dense cola while the outer bract layer still looks and smells completely normal. By the time you can see grey-white fuzz or smell that distinct musty, hay-like off-note, the infection is usually well established, not just starting.

This is a bigger risk with certain plant structures than others. The tight, dense, rock-hard bud structure that a lot of growers chase for yield and bag appeal — the kind you get from many modern high-potency indica-leaning phenotypes — traps moisture at the core of the cola far longer than the airier, more open flower structure typical of taller sativa-dominant plants. A loose sativa cola dries evenly in days. A dense, fist-sized indica cola can stay damp at the center for a week or more after the outside feels bone dry, and that's exactly the environment Botrytis and Aspergillus want.

Aspergillus specifically matters because inhaling its spores carries a real, documented health risk — invasive aspergillosis — that's particularly dangerous for immunocompromised users, people on chemotherapy, transplant recipients, or anyone with compromised lung function. Combustion doesn't reliably kill Aspergillus spores at the temperatures a joint or bowl actually reaches, which is exactly why regulators treat this species as a hard-stop pathogen rather than folding it into a general mold count with a tolerance threshold.

The actual defense against this isn't anything a lab can catch after the fact — it's what happens during drying and curing. A slow dry that brings flower down to roughly 58-62% relative humidity equilibrium, with steady low-velocity airflow and no hot spots, is what prevents the moisture pocket problem in the first place. And even a clean COA is only a snapshot of the sample pulled from that batch on that day. If the product then sits in a humid stockroom or a poorly sealed bag for weeks, conditions can shift enough that mold takes hold after testing was already done.

The New York Recall: What Went Wrong at Keystone State Testing

Photo by wrazor via Pixabay.

OCM announced its first cannabis recall of 2026 on February 27, the result of an inspection and records audit that had been running since December 2025. Investigators went back through Keystone State Testing New York's records and found that 54 separate product lots carried Aspergillus results reported as passing when the underlying data showed they didn't meet the safety standard. A 55th lot had a falsified result for Cadmium, one of the four heavy metals routinely screened on a cannabis COA.

The violations were cited under New York's own cannabis regulations — 9 NYCRR §§129(2)(c) and (e), 130.10(d), 130.22(b) and (c), and 130.23(a), (c), (e), and (g) — sections covering everything from testing methodology and sample handling to accurate result reporting and recordkeeping. In plain terms: the lab wasn't just sloppy, it was certifying products as safe when its own data said otherwise.

OCM's Executive Deputy Director, Stephen Geskey, put it bluntly in the agency's statement: when a lab reports inaccurate results, it erases the entire safety guarantee that testing is supposed to provide for consumers. That's the core problem with lab fraud in this industry — the whole regulatory structure assumes the number on the page reflects what's actually in the product. Once that assumption breaks, every downstream decision built on it, from a dispensary stocking a shelf to a patient with a compromised immune system buying flower, is built on nothing.

Three brands were named in the recall — MFNY, Nanticoke Hemp, and Veterans Holdings — all of whom had used Keystone for testing without any indication they knew results were being falsified. Notably, this was the first recall issued under John Kagia as OCM's Acting Executive Director, putting an early marker on how the agency plans to handle lab integrity going forward. The consequences for Keystone itself are severe: the lab is facing fines that can run up to $2 million, along with suspension of its testing accreditation, which effectively puts it out of business in the state until — or unless — it can prove it's fixed whatever produced this pattern.

Not an Isolated Case: A Pattern of Lab Fraud

Photo by PublicDomainPictures via Pixabay.

New York's case looks less like an isolated bad actor once you line it up against what's happened in other states over the past year and a half. Massachusetts' Cannabis Control Commission suspended an accredited testing lab in 2025 after finding it had failed to report yeast and mold failures across more than 7,000 samples — not a handful of lots, a number that suggests the underreporting was routine, not accidental. Michigan's Cannabis Regulatory Agency went further in August 2025, permanently removing one of the state's largest cannabis testing labs from its approved list after uncovering what it described as a sustained, deliberate pattern of manipulating both mold and potency results.

The common thread across all three states is financial incentive. Testing labs are paid by the cultivators and brands whose products they're testing, which creates the same conflict of interest you'd worry about if a car inspection station were paid directly by the dealership selling the car. A lab that fails too many of a client's batches risks losing that client to a competitor down the road who'll report a passing result. The industry has an actual name for the resulting behavior — lab shopping — where cultivators quietly move their business toward whichever lab is known to be more lenient, particularly on mold counts and potency, both of which have direct effects on a product's marketability.

Regulators are visibly tightening the screws in response, even if enforcement is still playing catch-up. Minnesota activated mandatory microbial, mycotoxin, heavy-metal, and pesticide testing in October 2025, closing a gap that had left the state's newer adult-use market largely untested for these hazards. New York, ironically, had just updated its Aspergillus, Salmonella, and STEC absence requirements in February 2025 — a year before the Keystone fraud was uncovered, meaning the rules on paper were already reasonably strong when a lab simply chose not to follow them.

That's really the lesson underneath all three cases: a COA is only as trustworthy as the lab that issued it, and a state's regulations are only as good as its willingness and capacity to actually audit compliance. Accreditation status, a lab's enforcement history, and whether a state has recently caught anyone cutting corners are all now relevant questions for a buyer or grower to ask, not just theoretical ones.

How to Actually Read and Vet a Microbial Section

Reading a COA properly means resisting the urge to just look for the word PASS in bold at the top of the page and move on. That summary banner is a convenience for marketing, not a substitute for checking the individual line items underneath it. Scroll down to the actual microbial panel and confirm that Salmonella, STEC, and Aspergillus are each individually marked as not detected, and that the TYM and TAC counts are reported as actual CFU/g numbers sitting below the state's threshold — not just a generic pass/fail with no supporting figure.

Next, find the lab's name and its ISO 17025 accreditation number, which should be printed somewhere on the document, usually near the header or footer. Take thirty seconds to cross-check that lab against your state's current list of licensed or accredited testing facilities — most cannabis regulatory agencies publish this online and update it when a lab gets suspended or pulled, exactly as happened with Keystone State Testing New York. A COA from a lab that's no longer accredited, or that isn't accredited in the state where the product was sold, is worth more scrutiny than one from a lab in good standing.

Red flags worth watching for include a missing or mismatched batch/lot number that doesn't correspond to the actual package in your hand, a vague or missing sampling date, and no signature or named reviewer attached to the results. Legitimate labs put their name behind their data; fraudulent ones tend to be thinner on these accountability details because there's less to defend if questioned.

If you're a home grower curious about your own harvest, at-home mold test kits and handheld ATP meters do exist, and they're fine as a rough early screening tool — but they can't replicate accredited lab methodology or give you a real CFU/g figure, so don't treat a clean home test as equivalent to a passing COA. The far more reliable strategy is prevention: starting with quality genetics, keeping your grow space sanitized, and controlling humidity and airflow through drying and cure so you never end up with a borderline batch in the first place. Seedtiva breeds and selects its seed stock with resilience in mind, but final microbial outcomes always come down to the grower's own climate, setup, and post-harvest handling — genetics can tilt the odds, they can't override poor drying conditions.

Potency numbers tell you how strong a product is. The microbial panel tells you whether it's safe to put in your body at all — that's the section of a COA that deserves the closer read, not the quicker one. Every case covered here, from Keystone State Testing New York's falsified Aspergillus results to Massachusetts' 7,000-sample failure and Michigan's dismissal of one of its largest labs, involves the same category of harm: a document that said clean when the underlying reality wasn't.

What's changed, and what's worth noting, is that consequences are catching up to the incentive to cheat. A $2 million fine and an accreditation suspension aren't symbolic gestures — they're the kind of enforcement that actually shuts a lab down. Regulation on paper never guaranteed accuracy in practice, but 2025 and 2026 are starting to show that getting caught now comes with real cost attached, which is the first condition necessary for the incentive structure to actually shift.

The two groups with the least exposure when a lab's numbers turn out to be wrong are growers who control their own environment closely enough that they're not relying on a COA to catch a problem that shouldn't have existed in the first place, and buyers who take the extra thirty seconds to check who actually tested the product and whether that lab is still in good standing. Neither takes much effort. Both are cheaper than finding out the hard way that a passing result wasn't true.