PECB ISO/IEC 17025 Lead Implementer cheat sheet

ISO/IEC 17025 applies to laboratories that perform testing, sampling, and/or calibration, including associated decision rules and opinions and interpretations.

The standard is structured in 8 clauses: 1-3 informative (scope, normative references, terms), 4-8 normative (general requirements, structural, resource, process, management system requirements).

Impartiality means the presence of objectivity; identify risks to impartiality from ownership, governance, personnel, and financial relationships, and eliminate or minimize them.

Confidentiality requires the laboratory to be responsible for managing all information obtained or created during laboratory activities; legally binding commitments are made when the laboratory is legally compelled to release information.

The process approach and risk-based thinking underlie the standard; risk and opportunity identification is required in planning (Clause 6.1) and is not a separate formal risk-management system.

Results validity is the central outcome: the standard requires the laboratory to ensure validity of results through monitoring, measurement, and appropriate quality control techniques.

Management system requirements are offered in two options: Option A (Clause 8) or Option B (ISO 9001), with Option B requiring the laboratory to establish and maintain a management system that fulfills ISO 9001 plus Clauses 4-7.

Accreditation is third-party attestation by an accreditation body of competence, not certification of conformity; a laboratory may be accredited for a defined scope of activities.

Key definitions: 'laboratory' performs testing/calibration/sampling; 'reference material' is sufficiently homogeneous and stable; 'certified reference material' is accompanied by a certificate with metrological traceability to a stated reference.

Clause 4.1 requires the laboratory to be a legal entity or a defined part of one, and to define the range of laboratory activities for which it conforms to the standard.

Clause 5 structural requirements define organizational charts, responsibilities, authorities, and documentation of procedures to ensure consistent results and management of the laboratory's activities.

Clause 6 resource requirements cover personnel, facilities and environmental conditions, equipment, metrological traceability, and externally provided products and services.

Clause 7 process requirements span review of requests, tenders and contracts; selection, verification and validation of methods; sampling; handling of test or calibration items; technical records; evaluation of measurement uncertainty; ensuring validity of results; reporting results; complaints; nonconforming work; and control of data and information management.

Clause 8 management system requirements (Option A) comprise management system documentation, control of management system documents, control of records, actions to address risks and opportunities, improvement, corrective actions, internal audits, and management reviews.

Documented information includes both documents (policies, procedures, forms) and records (technical and quality records); records must be retained per defined retention periods and protected against alteration.

Personnel requirements include documented competence, authorization for specific activities, supervision, and monitoring of competence; job descriptions define duties and required competence.

Equipment requirements include calibration/verification programmes, unique identification, protection from adjustment, and intermediate checks where needed to maintain confidence in calibration status.

Gap analysis: compare current laboratory practices against each clause of ISO/IEC 17025 and record conformity, partial conformity, or nonconformity with evidence to establish the implementation baseline.

Scope definition: define the range of laboratory activities (tests/calibrations, methods, materials, sites) for the management system and, later, for accreditation; scope drives resources and method validation needs.

Clause 6.1 requires planning actions to address risks and opportunities, integrated into management system processes, with evaluation of effectiveness of those actions.

Clause 8.5 requires planning for improvement: identify opportunities, implement necessary actions, and evaluate results; improvement is not limited to corrective actions.

Interested-party analysis and context determination help prioritize processes, resources, and documented information; ISO/IEC 17025 does not require Clause 4 of ISO 9001 context analysis, but Option B users inherit ISO 9001 requirements.

Implementation roadmap should sequence: leadership commitment, gap analysis, scope, process mapping, resource acquisition (personnel, equipment, facilities), method validation, documentation, internal audit, management review, then accreditation application.

Risk assessment for planning: identify risks to impartiality, validity of results, resource availability, information security, and competence; assign owners and timeframes.

Resource planning must account for metrological traceability chains (calibration of equipment to SI units or certified reference materials) and for participation in proficiency testing/interlaboratory comparisons.

Implement Clause 7 processes in the defined sequence: request review, method selection/validation, sampling plan, item handling, technical records, MU evaluation, validity of results, reporting, and handling complaints and nonconforming work.

Method validation: non-standard methods, laboratory-developed methods, and methods used outside their intended scope require validation; validation is fit-for-purpose and documented with results and a statement of validity.

Measurement uncertainty: laboratories shall identify contributions and evaluate MU; for testing, this is required where the client requires it, where the test method specifies it, or where it is needed to interpret results against a specification.

Ensuring validity of results: use quality control (e.g., use of reference materials, replicate tests, control charts, interlaboratory comparisons, review of reported results) and analyse results with statistical techniques where appropriate.

Control of data and information management (Clause 7.11) requires validation of information management systems before use, protection of data integrity, and maintenance of systems in a way that supports the laboratory's activities.

Nonconforming work (Clause 7.10) requires actions based on the risk of the nonconformity, evaluation of significance, notification to the client where relevant, and authorization to resume work.

Complaints (Clause 7.9) require a documented process, receipt and acknowledgement, investigation, and communication of the outcome; the complainant is informed of the progress and outcome.

Corrective action (Clause 8.7) requires root-cause analysis, action to eliminate the cause, review of effectiveness, and updating risks and opportunities; it is distinct from correction (fixing the immediate issue).

Internal audits (Clause 8.8) must be planned at intervals, cover all management system elements over a defined cycle, and be performed by trained, independent auditors where practicable; results are reported to management.

Management review (Clause 8.9) requires defined inputs (audit results, complaints, nonconforming work, corrective actions, external assessments, resource adequacy, risks/opportunities, improvement) and outputs (improvement, resource needs, changes to the management system).

Monitoring and measurement of the management system uses key performance indicators, control charts for quality control, and trend analysis of nonconformities and complaints.

Proficiency testing and interlaboratory comparisons are performance evaluation tools; results outside acceptable criteria trigger investigation and corrective action.

Evaluation of measurement uncertainty and method performance (e.g., trueness, precision, linearity, limit of detection) provides objective evidence of technical competence during assessment.

Effectiveness of corrective actions is verified after implementation; the verification method and result must be recorded.

Records of monitoring, audits, reviews, and corrective actions are retained as evidence for accreditation assessment and must be traceable to the activity concerned.

Clause 8.6 requires the laboratory to identify and select opportunities for improvement and implement necessary actions, with feedback from management review, internal audits, and complaints.

Continual improvement is driven by analysis of data: nonconformity trends, complaint patterns, audit findings, proficiency testing performance, and client feedback.

Improvement actions should be evaluated for effectiveness and incorporated into the management system, with records of what was changed and the result.

Risk-based thinking supports improvement: as risks change, controls and processes are updated; opportunities are tracked alongside risks.

Corrective action feeds improvement: root cause analysis identifies systemic issues that, when eliminated, improve overall performance rather than only the specific case.

Management review output is a formal improvement mechanism: decisions on changes to the management system, resource needs, and improvement actions.

Accreditation surveillance and reassessment findings are inputs to improvement; the laboratory should treat them as opportunities to strengthen the management system.

Select an accreditation body that is a signatory to the ILAC MRA (or regional equivalent) for the scope sought; confirm the accreditation scheme covers the laboratory's activities.

Define the accreditation scope precisely: tests/calibrations, methods, materials, and any sampling; the scope must match demonstrated competence and available resources.

Prepare evidence: management system documentation, records of internal audits, management reviews, corrective actions, method validation, measurement uncertainty, proficiency testing, and personnel competence records.

Conduct a pre-assessment gap audit against ISO/IEC 17025 and the accreditation body's specific requirements before applying, and close identified gaps.

Complete the application with the accreditation body, including scope, quality manual or system documentation, and any required fees; the body reviews the application for completeness.

Prepare for the assessment: brief staff, ensure records are current and retrievable, and confirm equipment calibration status and traceability evidence are available.

Respond to assessment findings: correct nonconformities, perform root cause analysis, implement corrective actions, and provide objective evidence of closure within the body's timeframe.

Maintain accreditation: participate in surveillance assessments, proficiency testing where required, and notify the body of significant changes (key personnel, facilities, scope, method changes).