ISO 17025 management review: what laboratory management must review, decide and record under ISO/IEC 17025

What ISO/IEC 17025 requires of management review

Management review is the moment when the people accountable for the laboratory stop running it for an hour and look at whether it is working. ISO/IEC 17025:2017 places it in clause 8, Management system requirements, as sub-clause 8.9, Management reviews. It belongs to Option A, the set of eight management system elements a laboratory must address at minimum, alongside documentation, document and record control, risks and opportunities, improvement, corrective action and internal audits.

Option B changes where the requirement lives, not whether it applies. A laboratory whose management system already meets ISO 9001 can rely on that system for the intent of 8.2 to 8.9, provided it supports and demonstrates consistent fulfilment of clauses 4 to 7. In practice that means the ISO 9001 review agenda has to carry the laboratory's technical performance too; a corporate quality review that never mentions proficiency testing or measurement uncertainty will not satisfy an assessor.

If the review never asks whether results are still sound, it has missed the point of the standard. The requirements guide covers the rest of clause 8.

What goes into a laboratory's review

The inputs worth bringing are the ones that show whether clauses 4 to 7 are holding up in daily work. Sterling's recommended input set follows the standard's own structure, so nothing technical is left out.

From the general and structural requirements

The impartiality risk assessment and any new pressures on it: a change of ownership, a large customer, a commercial target that touches results. Changes to the range of laboratory activities, new sites, or changes in the organisation chart and authorities.

From resources

Competence and authorisation status by method, staff turnover and training gaps; environmental monitoring excursions; equipment out of calibration, overdue intermediate checks and breaks in the traceability chain; the performance of calibration providers, reference material suppliers and proficiency testing providers.

From the process requirements

Contract review issues, including any dispute over a decision rule; methods awaiting verification or validation; uncertainty budgets that need revisiting; quality control trends and proficiency testing results with the actions taken on unsatisfactory scores; report amendments; complaints; nonconforming work; and the state of data and information systems.

From the management system

Actions from the previous review, internal audit results, corrective actions and whether they worked, the risk and opportunity register, improvement projects, and findings from the accreditation body's last assessment or surveillance visit.

Proficiency testing and the internal audit of the technical clauses have their own guides in this cluster; the review needs their conclusions, not their working.

What the review must decide

The output of a laboratory review should answer three questions: is the management system and the way the laboratory works still effective, what will be improved, and what resources are needed to keep results valid. Each answer becomes a recorded decision.

• Changes to the system: a revised procedure, a new control on impartiality, an amended decision rule policy, a change to the internal audit programme.
• Improvement: a method to be validated for a wider range, a control chart to be introduced where drift was noticed late, a reporting template to be corrected after amendments.
• Resources: a second authorised analyst for a single-person method, recalibration funding, a replacement balance, environmental control for a room that keeps drifting, time released for validation work.
• Scope: whether to apply for an extension, withdraw a test that is rarely requested, or hold a planned extension until proficiency testing evidence exists.

Every decision needs an owner and a due date, and the next review opens by checking them. That loop is what an assessor looks for.

How often, and who should attend

Set the interval in your own management system and keep to it; an assessor will judge the laboratory against the plan it wrote. Sterling recommends a short review every quarter that covers the fast-moving inputs, with one full annual review that takes every input and the year's trends together.

Attendance follows clause 5. The people who hold authority over resources must be there, because resource decisions are half the output. So must the people with technical responsibility and management system responsibility shown on the organisation chart. In an in-house laboratory that usually means the budget holder, the laboratory manager, each technical lead and the quality manager.

Running it in one meeting a quarter

The agenda below is Sterling's recommended quarterly format for a laboratory with two or three disciplines in scope. It takes about 90 minutes when inputs are circulated a week ahead and presenters bring one page each.

The record an assessor asks for

Keep minutes, not slides. The review record should let an assessor, or a new laboratory manager, see four things without asking anyone: who attended, which inputs were covered and what they showed, what was decided, and who owns each action by when.

A practical test, and one assessors often apply, is to follow a single thread. They pick an unsatisfactory proficiency testing result or a complaint from the technical records, then look for it in the review minutes, the decision taken and the corrective action that closed it. A thread that breaks at the review tells them management was not told, or was told and did nothing.

What a weak laboratory review looks like

Weak reviews look tidy until the record is read against the rest of the laboratory.

• Quality only: the minutes discuss document control and training attendance but never mention proficiency testing, quality control or uncertainty.
• Noted, not decided: every input is marked "discussed" and no decision follows, even for a failed proficiency testing round.
• The same actions every quarter: open actions carry forward with new dates and no evidence.
• Resources never mentioned: a single authorised analyst for a critical method is noted as a risk year after year, with no decision.
• Held for the assessor: one review, dated the week before the application, and none since.

Each of these is a common route to a finding. The nonconformities guide explains how findings are raised and closed; the surveillance and reassessment guide covers how reviews continue to be examined after accreditation.

How Effivity holds the review

Effivity's management review module lets you define the agenda or start from a suggested one, notifies attendees by e-mail, records minutes against each agenda point and turns decisions into action plans with owners and dates. The laboratory's technical records, such as control charts, uncertainty budgets and proficiency testing reports, stay in the systems where they are produced and are linked or attached as evidence.

ISO 17025 management review: questions buyers ask