ISO/IEC 17025:2017 - General Requirements for Testing and Calibration Laboratories

Conduct internal audits at planned intervals to provide information on whether the management system conforms and is effectively implemented.

• Audit programme
• Audit reports
• Findings register

• Programme does not cover all clauses
• Auditors not independent of audited area

Certification bodies must be legal entities accountable for ISMS certification decisions and impartiality.

• Legal entity registration
• Certification body charter
• Liability insurance certificate

• Unclear legal accountability
• Missing insurance coverage

Identify, analyse, and treat threats to impartiality in ISMS audit and certification activities.

• Impartiality risk register
• Impartiality committee minutes
• Conflict of interest declarations

• Stale impartiality assessments
• No oversight committee

Competence requirements for personnel involved in the certification process

• Competence matrix for laboratory personnel
• Training and qualification records
• Authorization records for examination activities
• Continuing professional development log

• Competence reassessment intervals not defined
• Authorization tied to job title rather than verified competence
• No evidence of practical assessment for new methods
• Training records missing for locum or agency staff

Maintain up to date records of qualifications, training, experience and performance for ISMS personnel.

• Personnel files
• Performance evaluations
• CPD records

• Out of date records
• No performance evidence

Have a documented process to receive, evaluate, and make decisions about complaints.

• Complaint log
• Resolution records
• Customer responses

• Complaints handled informally
• No trend analysis

When a nonconformity occurs, react, evaluate the need for action to eliminate causes, and review effectiveness.

• CAPA records
• Root cause analyses
• Effectiveness verifications

• Effectiveness not verified
• Causes not analysed

Manage and control data and information from laboratory activities, including LIMS validation and protection.

• LIMS validation
• Access controls
• Backup records

• Spreadsheets used without validation
• Backups not tested

Laboratory activities are undertaken impartially and structured and managed to safeguard impartiality, with risks to impartiality identified and managed.

• Impartiality policy
• Impartiality risk register
• Mitigation records

• Commercial pressure not assessed
• No periodic review of impartiality risks

Manage information obtained or created during laboratory activities as confidential through enforceable commitments.

• Confidentiality agreements
• Customer notification records
• Disclosure logs

• Verbal commitments only
• No customer notification for legal disclosure

Identify and select opportunities for improvement and implement actions including obtaining customer feedback.

• Improvement register
• Customer feedback
• Action records

• Feedback collected but not used
• Improvements not tracked

Establish, document, and maintain policies and objectives for the management system addressing competence, impartiality, and consistent operation.

• Quality manual
• Policy statements
• Objectives

• Manual not maintained
• Objectives not measurable

Select appropriate methods and verify or validate them before use to demonstrate fitness for the intended application.

• Validation reports
• Verification records
• Method files

• Modified methods not revalidated
• Validation data insufficient

Implement a procedure for when laboratory activities or results do not conform to requirements, including evaluation of significance.

• NC records
• Halt-recommence authorisations
• Customer notifications

• Significance not evaluated
• Customers not notified

When sampling, have a sampling plan and method available, with records of sampling activities.

• Sampling plans
• Sampling records
• Chain of custody

• Sampling deviations not recorded
• Chain of custody breaks

Have procedures for transportation, receipt, handling, protection, storage, retention, and disposal of items.

• Item registers
• Storage records
• Disposal records

• Storage conditions not monitored
• Disposal not documented

Establish procedure for review of requests, tenders, and contracts to ensure requirements are defined and the laboratory has capability.

• Contract review records
• Method capability statements
• Change records

• Method capability not confirmed
• Changes not re-reviewed

Monitor validity of results through internal quality control and participation in interlaboratory comparisons or proficiency testing.

• QC charts
• Proficiency testing reports
• Trend analyses

• Proficiency testing gaps in scope
• QC failures not investigated

Ensure technical records contain results, reports, and sufficient information to identify factors affecting measurements.

• Worksheets
• Instrument printouts
• Retained data

• Records lack analyst identification
• Audit trail incomplete

Report results accurately, clearly, unambiguously, and objectively in test reports or calibration certificates.

• Report templates
• Authorisation records
• Customer agreements

• Statements of conformity without decision rule
• Opinions issued by unauthorised staff

Ensure personnel have the competence to perform laboratory activities and to evaluate the significance of deviations.

• Competence matrix
• Authorisation records
• Training plans

• Authorisations expired
• No competence re-assessment

Facilities and environmental conditions must be suitable for laboratory activities and must not adversely affect the validity of results.

• Environmental monitoring records
• Access control logs
• Facility validation

• Temperature excursions not investigated
• Access uncontrolled

Have access to equipment required for correct performance of laboratory activities, including verification before placing into service.

• Equipment inventory
• Verification records
• Maintenance logs

• Verification missed before first use
• Maintenance overdue

Ensure that externally provided products and services affecting laboratory activities are suitable.

• Approved supplier list
• Evaluation records
• Specifications

• Critical consumables sourced without evaluation
• No incoming verification

Top management reviews the management system at planned intervals to ensure suitability, adequacy, and effectiveness.

• Review agenda
• Minutes
• Action register

• Required inputs missing
• Reviews postponed

Consider risks and opportunities associated with laboratory activities and plan actions to address them.

• Risk register
• Action plans
• Effectiveness reviews

• Risk register static
• No opportunity actions

Define the laboratory as a legal entity, identify management, define scope of activities, and identify personnel who manage and influence laboratory activities.

• Legal registration
• Organisational chart
• Scope of accreditation

• Out-of-scope work performed
• Org chart outdated

Establish and maintain metrological traceability of measurement results through an unbroken chain of calibrations to the SI.

• Calibration certificates
• Traceability statement
• Reference material certificates

• Calibration laboratory not accredited
• Reference materials expired

Identify contributions to measurement uncertainty and evaluate it for all calibration and testing as applicable.

• Uncertainty budgets
• Calculation records
• Reported uncertainty values

• Budgets missing contributions
• Uncertainty not reported to customers