Managing an ISO/IEC 17025 internal audit program
This domain tests the internal audit programme under clause 8.8 and ISO 19011: establishing, implementing, monitoring and improving the programme, with auditor competence and independence.
Programme requirements
- Clause 8.8 requires internal audits at planned intervals to verify that the LMS conforms to the laboratory’s own arrangements and to the standard, and is effectively implemented and maintained.
- The programme considers the importance of activities, changes, previous audit results and risks; it is not all clauses once a year.
- Define objectives, scope, frequency, methods, criteria, auditor selection and reporting.
- Auditor independence: auditors must not audit their own work; use cross-functional auditors or external support.
- Competence: standard knowledge, laboratory processes and audit techniques; technical auditors for technical areas.
- Records: plan, checklists, findings, reports, corrective actions and follow-up; feed results into management review under 8.9.
- Monitor and improve: track completion, repeat findings, timeliness and value.
Worked example
A laboratory’s internal audit programme is a fixed annual checklist covering clauses 4–8, and the quality manager audits the quality manager’s own work. A repeat finding appears for equipment records. The programme is weak on three counts: it does not consider risk or changes; the auditor lacks independence; and repeat findings are not analysed for programme effectiveness. A better programme would set frequency by risk, assign an auditor from another department or an external auditor, include technical witnessing and review repeat findings in management review. The standard does not require every clause every year; it requires planned intervals based on importance and risk.
Traps
- Believing annual full-clause audits are mandatory.
- Using one auditor for everything.
- Auditing only records, not processes.
- Not following up corrective actions.
- Keeping the programme out of management review.
- Calling a desk review an internal audit.