ISO 17025 internal audit: how a laboratory audits the technical clauses, with vertical and witnessing audits

What does ISO/IEC 17025 require of an internal audit?

ISO 17025 internal audit is the laboratory checking itself, on a planned basis, against the standard, its own procedures and the scope it holds or is applying for. Under ISO/IEC 17025:2017, the laboratory chooses how to run its management system. Option A lists the minimum elements in clause 8, and one of them is 8.8 Internal audits. Option B lets a laboratory with a management system meeting ISO 9001 rely on it, provided that system supports and demonstrates consistent fulfilment of clauses 4 to 7.

That last condition is the one most laboratories miss. An audit that looks only at document control, records and corrective action has audited the paperwork around the laboratory, not the laboratory. The requirements that decide whether a result can be trusted sit in clause 6 (resources) and clause 7 (process), and that is where the programme should spend most of its time.

ISO 19011:2026 gives general guidance on audit principles, programmes, conduct and auditor competence; the laboratory adds the technical layer itself. The full list of clauses is in the ISO/IEC 17025 requirements guide.

The technical clauses: what to audit and what to sample

A useful audit asks one question of every technical requirement: could we prove this for a result picked at random today?

Clauses 4 and 5 need a visit too: the impartiality risk assessment should reflect the laboratory as it is now. The detail of equipment, uncertainty and methods is covered in the measurement uncertainty and method verification and validation guides.

Horizontal, vertical and witnessing audits

Horizontal audits

A horizontal audit takes one requirement and follows it across every section: equipment calibration status in all rooms, for example, or authorisations for every analyst. It spots systemic lapses quickly but never shows whether the pieces connect.

Vertical audits

A vertical audit starts from a single issued report or calibration certificate and works backwards. Take last month's certificate for a digital thermometer. The auditor confirms the decision rule was agreed at contract review, the item was identified on receipt, the procedure was the current verified version and the technician was authorised on that date. The reference standard should have been in calibration with a traceable certificate, the environmental record in limits, the raw readings should reproduce the reported values, and the stated uncertainty should match the budget. One missing link and the result cannot be defended, however good the procedures look.

Vertical audits are the type most often skipped because they take longer. Plan at least one per discipline in scope.

Witnessing audits

A witnessing audit watches an analyst or technician perform a test or calibration from start to finish, with the method open beside the auditor. It catches what records cannot: a step done from memory, a shortened warm-up, a skipped check standard. Accreditation bodies witness work during assessment, so witness yourself first, covering each authorised person over the programme.

Building the internal audit programme

The programme is the plan that decides what is audited, when, how and by whom across a defined period. Build it from the scope, not the clause list: every method group, authorised signatory, site and clause should appear in the cycle, with methods that had a complaint, a poor proficiency testing result or a new analyst coming round sooner.

Sterling's recommended pattern for a single-site laboratory preparing for first accreditation is shown below. The standard does not prescribe a frequency; the laboratory sets its own and must be able to justify it.

Before you apply, the whole programme should have run once, with findings closed. This sequence appears in the ISO/IEC 17025 implementation plan.

Who audits: competence and independence in a laboratory

Laboratory auditing needs audit technique and technical knowledge of the method, enough to know that a missing blank or an out-of-date correction factor matters. Most laboratories pair the quality manager with a technical peer from a different section, so that each audit has both.

Auditors should not audit their own work. Cross-auditing between sections works well; where one person runs a whole discipline, bring in a sister laboratory or an external auditor for those methods. The competence of each auditor should be defined and recorded like any other laboratory role, which is covered in the ISO/IEC 17025 training guide.

Findings, corrective action and the audit record

Write every finding in three parts: the requirement, the evidence seen, and the gap between them. "Uncertainty not adequate" helps no one. "The budget for the conductivity method still lists the meter replaced in March, so the reported uncertainty on reports since then is not supported" can be investigated and closed.

If the audit shows a reported result may have been affected (an unauthorised analyst, an expired reference standard, a calculation error), treat it under 7.10 Nonconforming work as well: evaluate the impact on results already issued and decide whether customers need to be told. The root cause then goes through 8.7 Corrective actions, and closure is verified against new evidence, not a statement that it was fixed.

The record is short: the programme, each audit plan, notes naming the reports, instruments and people sampled, the findings, corrective actions with evidence of closure, and the summary for management. That summary is one of the inputs to the ISO/IEC 17025 management review.

The body's assessors decide on accreditation; your auditors improve the laboratory. What happens during the body's visit is set out in The ISO/IEC 17025 assessment, and how its findings are closed in ISO/IEC 17025 nonconformities.

ISO 17025 internal audit: questions buyers ask