ISO 17025 nonconformities: how assessment findings are raised, answered and closed under ISO/IEC 17025

What counts as a nonconformity in an ISO/IEC 17025 assessment?

During the on-site assessment, the lead assessor examines the management system while technical assessors watch your staff perform tests or calibrations and trace the records behind the numbers. Whenever they find something that falls short of a requirement, they raise a finding. The requirement can come from three places: ISO/IEC 17025:2017 itself, the accreditation body's own accreditation rules (ANAB, for instance, requires laboratories to take part in proficiency testing every year), or the procedures your laboratory wrote and said it follows.

Findings are tied to the methods on your application, so preparation has to reach every method in scope, not just the quality manual. The ISO/IEC 17025 assessment guide explains how document review, the on-site visit and witnessing produce these findings; this guide starts where they are handed to you.

How accreditation bodies set grades and deadlines

Certification audits of management systems use a common major and minor grading. Laboratory accreditation has no equivalent published in one place: each body writes its own procedure, names its own categories and fixes its own response period. Read it before the assessment. Four examples:

Whatever the body, the decision-maker considers accreditation only after your response has been reviewed, so a late or thin response moves the decision date and any tender waiting on it.

Reading a finding: requirement, evidence and statement

A well-written finding names the requirement, shows the objective evidence and states the gap. Taking an example from a calibration bench:

• Requirement: ISO/IEC 17025 sub-clause 6.5, Metrological traceability, for results reported under the pressure calibration method in scope.
• Evidence: the reference gauge used for two of the three calibrations witnessed was last calibrated by a provider whose certificate showed no traceability statement and no measurement uncertainty.
• Statement: the laboratory could not demonstrate traceability of the reference standard used for the pressure calibrations in scope.

Check each part before you acknowledge the finding. If the traceable certificate exists but sat in someone's inbox, produce it while the team is still on site. If the finding is accurate, spend your energy on the cause; the solution is yours to find.

Correction, root cause and corrective action in a laboratory

ISO/IEC 17025 separates two ideas that responses often merge. Sub-clause 7.10, Nonconforming work, deals with work or results that did not meet your procedures or the customer's agreed requirements. Sub-clause 8.7, Corrective actions, under Option A, deals with removing causes so the problem does not come back. A laboratory on Option B handles corrective action through its ISO 9001 system, but the assessor still expects the same logic. A strong response to the traceability finding above runs in four steps.

1. Correction

Send the reference gauge to a calibration provider that can show traceability, and suspend the method or use another traceable standard meanwhile.

2. Impact on results already issued

This is the step laboratories forget. List every certificate issued with that gauge since its last valid traceable calibration, judge whether the results could be affected, and treat affected work under your nonconforming work procedure. Where a report must change, follow your arrangements for amendments to reports (sub-clause 7.8.8) and tell the customer.

3. Root cause

Ask why the gauge went to that provider. In this example, purchasing chose on price and nobody checked calibration suppliers against criteria for externally provided services (sub-clause 6.6). The cause is a process gap, not the technician who booked the job. Check whether other equipment was calibrated the same way.

4. Corrective action and effectiveness

Set criteria for calibration providers, re-evaluate the current ones, and add a traceability check to the review of every incoming calibration certificate. Then confirm, over the next calibration cycle, that each certificate received was checked and recorded.

What evidence closes an ISO/IEC 17025 finding?

Accreditation bodies close findings on proof that change has happened, not on a promise that it will. Evidence that usually persuades a reviewer:

• new records dated after the assessment, such as the traceable calibration certificate with its uncertainty;
• the revised procedure or form with its approval and new revision, plus the first completed records under it;
• the impact review of results already reported, with the decision taken for each affected report;
• for technical findings, the repeated work itself: a completed validation file, a revised uncertainty budget, or fresh quality control data;
• a cause analysis a reviewer who was not on site can follow.

Some fixes cannot finish inside the deadline: proficiency testing rounds run on the provider's calendar, and quality control data takes time to build. Say so in the response, show the interim evidence, give the date the rest will follow, and agree the approach with the body rather than letting the deadline pass in silence.

Eight typical ISO/IEC 17025 findings and how laboratories fix them

These are composites of common laboratory situations, not extracts from any report; how each is categorised depends on the body and on whether reported results were affected.

How to keep assessment findings few and small

Most first-assessment findings can be seen coming. Run your internal audit across the technical clauses, with methods witnessed, not just paperwork read. Close its findings through the corrective action process the assessor will test. Take a pre-assessment where your body offers one. The common mistakes guide lists the ten that most often fail assessments, and the surveillance and reassessment guide covers findings raised later in the accreditation cycle.

ISO/IEC 17025 nonconformities: questions buyers ask