PECB ISO/IEC 17025 Foundation cheat sheet

ISO/IEC 17025 is a competence standard for testing and calibration laboratories, structured around a management-system core plus laboratory-specific technical requirements; its two main clauses are 4 (General requirements) and 5 (Structural), 6 (Resource), 7 (Process) and 8 (Management system).

The standard applies to all laboratories performing testing, sampling or calibration, regardless of size, scope or the number of personnel; it covers in-house (first-party) as well as third-party laboratories.

Impartiality is a general requirement: laboratory activities must be undertaken impartially, and risks to impartiality arising from ownership, governance, personnel or commercial relationships must be identified and addressed.

Confidentiality is a general requirement: the laboratory manages information obtained or created during its activities, and releases it only when authorized by law, the customer or the contract.

A laboratory management system is the set of interrelated or interacting elements (policy, objectives, processes, resources) used to achieve the laboratory's quality objectives; it is not a document set but the way work is managed.

The risk-based approach requires the laboratory to plan actions that address risks and opportunities associated with its activities, and to evaluate their effectiveness; the standard does not prescribe a formal risk-management method.

Documented information is the term used for both documents (retained as information) and records (retained as evidence); the standard sets requirements for its creation, updating and control rather than for a fixed documentation hierarchy.

The process approach (Plan-Do-Check-Act) underlies the management-system clauses: plan objectives and processes, implement them, monitor and measure against criteria, and act on results to improve.

Conformity assessment context: an accredited laboratory demonstrates competence to a third-party accreditation body, which assesses against ISO/IEC 17025 and is itself guided by ISO/IEC 17011; accreditation is voluntary unless imposed by a customer or regulator.

Structural requirements (clause 5) include: the laboratory is a legal entity (or a defined part of one) with defined responsibilities, has management with overall responsibility for the LMS, and defines the scope of its activities.

Resource requirements (clause 6) cover personnel, facilities and environmental conditions, equipment, metrological traceability, and externally provided products and services.

Personnel competence is established through defined education, qualification, training, technical knowledge, skills and experience, and evidence of competence must be retained; competence must be re-evaluated where needed.

Facilities and environmental conditions must be monitored, controlled and recorded where they influence the validity of results (for example temperature, humidity, contamination, electromagnetic interference, vibration).

Equipment must be calibrated or verified at specified intervals before use, have a defined programme for maintenance and identification, and its calibration status must be known and traceable.

Metrological traceability requires an unbroken chain of calibrations to a national or international standard; where this is impossible, the laboratory must demonstrate traceability by other documented means (for example, consensus standards or reference materials).

Method selection and validation (clause 7) requires use of appropriate methods, validation of non-standard methods, verification of standard methods, and documented fitness for the intended use; measurement uncertainty must be evaluated and reported where required.

Sampling, handling of test or calibration items, technical records, and evaluation of measurement uncertainty are process requirements (clause 7); reports and certificates must contain the information specified by the standard, including results, uncertainty and conformity statements where relevant.

The management system (clause 8) requires documented policies and objectives, control of management-system documents and records, actions to address risks and opportunities, internal audits, management reviews, and handling of complaints and nonconforming work.