ISO 17025 common mistakes: the ten that fail accreditation assessments, and the fix for each

What failing an ISO 17025 assessment looks like

An accreditation body gives no pass or fail at the closing meeting. Its lead assessor and technical assessors review the documents, witness tests or calibrations and raise findings. Each finding needs corrective action and evidence inside the body's deadline, about 12 weeks at UKAS and 30 days in NABL's published guidance, before the body's committee decides.

In practice "failing" means months lost, a decision that slips past a customer's or a tender's date, and analysts pulled off paid work to rebuild files. The table lists the ten mistakes that, in our experience, cause most of it. Grading and closure are covered in the nonconformities guide, the day itself in the assessment guide.

Mistakes 1 to 3: scope, impartiality and methods

1. A scope wider than the evidence

• Why: every test on the price list, or every range the instruments reach, goes on the application because a customer asked for "full accreditation".
• In the assessment: the assessor picks entries and asks for the validation, uncertainty and quality control data behind each; whatever cannot be shown becomes a finding.
• Fix: start with the methods customers or regulators need and that already have evidence, then extend. See the scope of accreditation guide.

2. Impartiality reduced to a signed statement

• Why: staff sign a declaration once, although risks to impartiality must be identified on an ongoing basis.
• In the assessment: the assessor asks how a sales target, an owner's interest or a relative at a customer is kept away from results, and what was done about each risk.
• Fix: a short risk assessment covering ownership, commercial pressure and relationships, with actions, revisited when the organisation changes.

3. Methods in routine use, never verified or validated

• Why: the method has run for years without complaint, so nobody sees a need to prove it.
• In the assessment: for a standard method, evidence that this laboratory achieves its performance; for an in-house method, the validation file. Years of use are not evidence.
• Fix: one file per method, planned with the analysts who run it. The method verification and validation guide sets out the contents.

Mistakes 4 to 6: uncertainty, traceability and competence

4. Uncertainty never evaluated, conformity stated anyway

• Why: the laboratory reports pass or fail against a specification and treats uncertainty as a calibration laboratory's concern.
• In the assessment: the assessor asks for the budget behind a reported value, then which decision rule produced a statement of conformity and whether the customer agreed it at contract review.
• Fix: a budget per method the technical lead can explain line by line, and a decision rule settled before the work starts. See the measurement uncertainty guide.

5. Traceability that nobody can draw

• Why: calibration certificates are filed, but nobody has followed the chain from a result back to the SI.
• In the assessment: an instrument from a witnessed test is followed through the equipment register, its calibration status, the certificate and its intermediate checks. One missing link, or an overdue calibration, questions every result it produced.
• Fix: a register with calibration programmes and intermediate checks, certificates that establish traceability and evaluated providers. See the equipment and calibration guide.

6. Competence assumed rather than evidenced

• Why: senior analysts are trusted, new staff learn by watching, and nobody records who is authorised for what.
• In the assessment: the analyst in the witnessed test is asked for the authorisation for that method, and the laboratory for how that competence was judged.
• Fix: competence criteria and a written authorisation per method and person. The training guide covers who needs what.

Mistakes 7 to 9: validity of results, records and internal checks

7. Proficiency testing that is patchy, or ignored when it goes wrong

• Why: the laboratory joins the convenient rounds and files every report, the unsatisfactory ones included.
• In the assessment: the plan is compared with the scope, and the assessor asks what happened after each poor score.
• Fix: a plan covering the scope, interlaboratory comparison where no scheme exists, and a recorded investigation of every failed result. See the proficiency testing guide.

8. Technical records that cannot rebuild a result

• Why: raw data is spread across notebooks, instrument software, personal spreadsheets and e-mail.
• In the assessment: the assessor takes an issued report and asks for the item, analyst, equipment, conditions, raw data and calculation behind it. An unchecked spreadsheet formula is a finding under data and information management.
• Fix: records designed so any result can be reconstructed, and spreadsheets and software validated before anyone relies on them.

9. An internal audit that never leaves the office

• Why: someone who knows the procedures but not the methods runs it as a management system exercise.
• In the assessment: the programme covers clause 8 well and clauses 6 and 7 barely, and management review records no decisions on resources, methods or proficiency results.
• Fix: audits that witness work and trace reports to raw data, and reviews whose outputs have owners and dates. See the internal audit guide.

Mistake 10: applying before the laboratory has a history

A contract, tender or regulator wants accredited results by a date, so the procedures are written, the application goes in and the records are expected to follow. They cannot. Method files, budgets and control charts mean something only once operating data sits behind them, and proficiency testing rounds follow the provider's calendar.

Technical assessors need completed work to sample: issued reports for each method, quality control data built up over time, an internal audit covering the technical clauses and a management review. With a few weeks of records the findings pile up and the decision moves further away than a later application would have. Set the date from the evidence plan; the timeline guide shows why six to twelve months is typical.

The shortcuts that cost more than they save

• A "17025 certificate" instead of accreditation. Accreditation comes from an accreditation body that itself works to ISO/IEC 17011, never from a certification body or a consultant. Anything else is missing from every accreditation register, and a customer who checks will reject it.
• A template pack as the management system. It describes another laboratory's methods and equipment, and assessors compare it with the bench within the first hour. The documentation guide sets out what is actually required.
• Borrowed technical evidence. A budget or validation copied from a published method or another laboratory says nothing about your staff, equipment and conditions.

ISO 17025 common mistakes: questions buyers ask