Scope Extension for Static Analysis in an Accredited Test Laboratory
An accredited software test laboratory is seeking an extension of its ISO/IEC 17025 scope to include static analysis for MISRA C compliance. The assessment team reviews the validation file. The tool was updated from version 4.2 to 4.3 during validation. The laboratory validated against 30 files containing known defects, but the expected results were produced by the same tool version, not an independent oracle. Two analysts are listed as competent; only one performed the validation, and the second has no recorded practical assessment. There are no records of false-positive or false-negative rates, and no participation in proficiency testing because none is available for this tool. The laboratory argues that the tool vendor's ISO/IEC 17025 certificate covers the tool, so the laboratory does not need its own validation. The assessment is a scope extension, not initial accreditation.
1. Should the assessment team recommend grant, defer or partial grant for the extension? Justify the recommendation.
Read the worked answer
Defer the extension. The laboratory has not demonstrated that the method produces valid results for its scope. Validation against 30 files is a reasonable start, but the oracle is not independent: expected results generated by the same tool version make the exercise a self-consistency check, not validation. The version change during validation adds an uncontrolled variable; the validation must be repeated or bridged on the locked version 4.3. Only one analyst performed the work, so the competence of the second analyst is not evidenced. The absence of false-positive and false-negative data means the laboratory cannot state the method's performance. Proficiency testing is unavailable, so the laboratory must use an alternative, such as an inter-laboratory comparison, blind re-analysis or a curated benchmark with independently adjudicated results. A partial grant for non-safety-related code could be considered only if the scope is clearly limited and the scheme allows it; MISRA C compliance is normally safety-related, so deferral is the defensible recommendation.
2. What corrective action requests and evidence would you issue before the extension can be granted?
Read the worked answer
Issue corrective action requests covering five areas. First, independent validation with expected results from an oracle other than the tool, covering the MISRA C rules in scope, with a documented sample rationale and adjudication of disagreements. Second, version lock and change control for 4.3, including a regression comparison of 4.2 and 4.3 results and an assessment of rule-coverage changes. Third, competence records for both analysts: training, witnessed practical assessment and sign-off by a qualified reviewer. Fourth, method performance data: false-positive and false-negative rates on the validation set, with confidence intervals if possible. Fifth, an alternative validity check, such as an inter-laboratory comparison or blind re-analysis, because proficiency testing is unavailable. Require the laboratory to update its method statement, validation report and limitation statement. Verify the corrective actions by document review and a witnessed analysis before recommending the extension.
3. How should the assessor respond to the laboratory's argument that the vendor's ISO/IEC 17025 certificate removes the need for the laboratory's own validation?
Read the worked answer
Reject the argument. The vendor's certificate covers the tool's development and the vendor's own quality system; it does not cover the laboratory's use of the tool on its projects, its rule configuration, its data or its analysts. ISO/IEC 17025 requires the laboratory to validate methods and demonstrate competence for its scope. Supplier evidence can support tool selection, but it cannot replace the laboratory's validation. The laboratory must show that the tool configuration and rule set are controlled, that analysts can interpret findings correctly, and that the method's limitations are understood. The assessor should record the laboratory's argument and the rejection in the assessment report, and require the laboratory to revise its method statement so it does not rely on the vendor certificate as the sole basis for validity.