PECB ISO/IEC 17025 Lead Assessor cheat sheet

ISO/IEC 17025 is a competence standard for testing and calibration laboratories; it applies to all laboratory activities including sampling, and it is used by accreditation bodies, laboratories, customers and regulators.

The standard is built on two pillars: management requirements (impartiality, confidentiality, structure, document control, records, risks, improvement, complaints, nonconformity, internal audits, management review) and technical requirements (personnel, facilities, equipment, metrological traceability, methods, sampling, handling of items, technical records, uncertainty, result validity, reporting).

Risk-based thinking is explicit: the laboratory must consider risks and opportunities affecting result validity and act proportionately; there is no mandated risk methodology, only documented decisions.

Impartiality means the laboratory is free from commercial, financial or other pressures that could influence technical judgement; confidentiality covers information obtained in performing laboratory activities.

A management system is defined as a set of interrelated or interacting elements used to establish policies, objectives and processes to achieve those objectives; the LMS must be documented, implemented and maintained.

Metrological traceability is a property of a measurement result, not of an instrument: it requires an unbroken chain of calibrations to a reference, each contributing to the measurement uncertainty.

The standard distinguishes requirements (shall), recommendations (should) and permissions (may); only 'shall' clauses are auditable as conformity requirements.

ISO/IEC 17025:2017 is structured by process (general, structural, resource, process, management system requirements) and is intended to be used with ISO 9001 principles without duplicating certification.

Structural requirements: the laboratory must be a legal entity or a defined part of one, have defined responsibility for its activities, and have documented procedures for the scope of activities performed at permanent and site locations.

Resource requirements cover personnel (competence, authorization, supervision), facilities and environmental conditions (monitoring, control, recording), equipment (programme for calibration, verification, maintenance) and metrological traceability.

Equipment records must include identity, manufacturer, serial number, verification of conformity, location, calibration dates and results, and evidence of maintenance; equipment giving suspect results must be taken out of service and labelled.

Process requirements: review of requests, tenders and contracts; selection, verification and validation of methods; sampling plan and method; handling of test or calibration items; technical records; evaluation of measurement uncertainty; ensuring validity of results; reporting results.

Method validation is required for non-standard methods, laboratory-developed methods, methods used outside their intended scope, and amplifications or modifications of standard methods; validation extent must be proportionate and documented.

Measurement uncertainty must be evaluated for all calibrations and for testing where it affects compliance with a specification limit; reporting rules depend on customer request, specification limits or interpretation of results.

Reporting must include a statement of conformity with a decision rule when conformity is claimed, and the decision rule must be communicated and agreed with the customer.

Nonconforming work requires a documented procedure with actions: stop work, evaluate significance, correct or withhold results, recall work, and authorize resumption by a designated person.

An audit is a systematic, independent and documented process for obtaining objective evidence and evaluating it objectively to determine the extent to which audit criteria are fulfilled.

Audit criteria are the set of policies, procedures, requirements or standards used as a reference; audit evidence consists of records, statements of fact or other verifiable information.

Audit findings are classified as conformity or nonconformity; nonconformities are graded (for example major or minor) depending on the significance of the failure and its effect on the validity of results.

Three audit types: first-party (internal), second-party (supplier or customer), third-party (accreditation or certification body); the ISO/IEC 17025 lead assessor primarily conducts third-party accreditation assessments.

Independence and objectivity are core principles: an assessor must not assess their own work, and any conflict of interest must be declared and managed.

Evidence-based approach: findings must be supported by verifiable evidence, and the auditee has the opportunity to challenge or clarify evidence before the finding is finalized.

Sampling in assessment is a risk-based selection of activities, not a statistical guarantee of conformity; the audit conclusion reflects only the evidence sampled.

The audit programme is a set of one or more audits planned for a specific timeframe, directed at a specific purpose; the audit plan is the description of activities and arrangements for one audit.

Preparation starts with a document review of the applicant's quality manual, procedures, scope, method lists, organization chart, internal audit and management review records, and previous assessment findings.

The assessment scope must specify the tests or calibrations, the methods, the locations (permanent, site, mobile) and any exclusions; scope must be matched to the applicant's competence evidence.

The assessment team must be selected for technical competence covering the requested scope; technical experts may support but do not assess conformity independently of the assessor.

The assessment plan must define objectives, scope, criteria, dates, locations, team, schedule of activities, and be communicated to the applicant sufficiently in advance for preparation.

A risk-based approach allocates more time to high-risk activities: new methods, new personnel, complex equipment, critical measurements, and areas with prior nonconformities.

The opening meeting should confirm the plan, scope, criteria, team roles, confidentiality, safety rules, and the mechanism for reporting findings and closing the assessment.

Documented information to request in advance includes calibration certificates, method validation reports, uncertainty budgets, proficiency testing results, personnel competence records and equipment lists.

A readiness check should confirm the laboratory has completed at least one full internal audit cycle and a management review covering the relevant period before the on-site assessment.

Evidence gathering techniques include interviews, observation of activities, review of records, examination of equipment and traceability chains, and witnessing of tests or calibrations.

Witnessed activities must be compared against documented procedures and method requirements; deviations observed in real time are stronger evidence than document-only findings.

Traceability verification follows the chain from working standard or reference material back to a national or international standard, checking each calibration certificate for uncertainty and validity.

Measurement uncertainty review checks the uncertainty budget, the model, the sources considered, and whether reported uncertainty is consistent with the claimed conformity decisions.

Proficiency testing and interlaboratory comparison participation must be reviewed against the laboratory's scope; unsatisfactory results require investigation, corrective action and evidence of effectiveness.

Findings must be recorded with the requirement reference, the objective evidence, and the location or activity; the auditee should confirm the factual accuracy of the evidence.

Major nonconformity is typically a failure that affects the validity of results or the integrity of the management system; minor nonconformity is an isolated lapse without systemic impact.

The closing meeting presents findings, the assessment conclusion and the timeline for corrective action, and allows the laboratory to ask questions; it does not replace the formal report.

The assessment report must state the scope, criteria, team, dates, activities covered, findings with evidence, and the conclusion on conformity with the standard and the requested scope.

Corrective action submissions must address root cause analysis, correction, corrective action, and evidence of implementation and effectiveness, not just a statement of intent.

Verification of corrective action may be by document review, follow-up visit or witnessed activity depending on the significance of the nonconformity.

The accreditation decision is taken by an independent decision-maker or committee, not by the assessment team, based on the assessment report and the corrective action evidence.

The accreditation certificate and scope schedule define the accredited activities; any change to scope, methods, locations or key personnel must be notified to the accreditation body.

Surveillance and reassessment cycles maintain accreditation; the cycle length depends on the accreditation body's rules and the laboratory's risk profile.

Appeals and complaints about the assessment outcome must follow a documented process that preserves independence and confidentiality.

Records of the assessment, including findings, corrective action evidence and decision records, must be retained per the accreditation body's documented retention policy.

The internal audit programme must cover all elements of the management system and all laboratory activities over a defined cycle, with frequency based on risk and prior results.

Audit criteria for internal audits include ISO/IEC 17025, the laboratory's own management system documentation, method requirements and customer or regulatory requirements.

Internal auditors must be independent of the activity being audited; where full independence is impossible, cross-auditing or external auditors may be used.

Auditor competence must be defined and maintained: knowledge of the standard, audit techniques, and technical knowledge of the activity being audited.

Findings from internal audits feed corrective action, risk assessment and management review; the effectiveness of actions must be verified and recorded.

The audit programme should be a documented plan covering objectives, scope, criteria, schedule, auditors and reporting arrangements, and should be reviewed for continuing suitability.

Audit records must include the plan, checklists or evidence notes, findings, reports and follow-up actions; they provide the traceability needed at the accreditation assessment.

Management review must consider internal audit results, and the laboratory must demonstrate that the programme is implemented, not merely documented.