ISO/IEC 17025 clause 5.6: give staff authority to address deviations

What clause 5.6 requires in practice

Clause 5.6 requires the laboratory to have personnel who, whatever else they do, hold the authority and resources to carry out five duties. They implement, maintain and improve the management system. They identify departures from the system or from the procedures for laboratory activities. They start actions to prevent or reduce those departures. They report to management on how the system is performing and where it needs to improve. And they make sure laboratory activities are effective.

Three features are worth noting. The clause is about real authority, not a title; resources such as time and access to records are part of it. The duties may be shared among several suitable people. And the phrase irrespective of other responsibilities means a technician or manager with another main job can still hold these duties, provided they can really perform them.

The output is a set of named responsibilities, an escalation path that produces action, and a flow of performance information to management.

Give authority a practical meaning

A person responsible for raising a deviation needs a route that can produce action. If they cannot obtain information, involve the relevant manager or initiate containment, the assignment may be ineffective. Consider the decisions they need to make and the resources they need to discharge the responsibility.

The standard does not require a particular job title or state that one person must perform every listed duty. Responsibilities can be allocated across suitable personnel. The arrangement must still work when an issue crosses departments or challenges a commercial priority.

Cover all five functions

For implementation, maintenance and improvement, identify who coordinates changes and follows up weaknesses. For detecting deviations, include departures from the management system and from laboratory procedures. For initiating action, clarify how the person can prevent or reduce the deviation rather than merely filing a report.

Management needs useful information about system performance and improvement needs. Reporting should support decisions about resources and priorities, not just count completed forms. The arrangements must also support effective laboratory activities, linking system responsibilities to the technical work that produces results.

Why authority to act on deviations matters to the business

Deviations are normal in laboratories; unhandled deviations are the problem. A coordinator who spots a drifting check or an obsolete method but cannot act, or must wait for an absent director, turns a small issue into a repeated one that eventually reaches a customer.

Real authority also protects against pressure. When a person is expected to flag problems, but is overruled by commercial priorities, impartiality and result validity both suffer. Making the duties explicit, and providing the time and tools to do them, is among the cheapest ways to reduce rework, complaints and findings.

How to implement clause 5.6

Test authority by asking what the named person could actually do on an average day when something goes wrong.

1. List the five duties and decide which suitable person or people hold each one, including deputies.
2. Write what each person may do on their own, such as flagging status, stopping a task or opening a corrective action, and what needs escalation.
3. Provide the resources they need, including time, system access and a direct route to management.
4. Define how deviations are recorded and passed into the nonconforming-work and corrective-action processes.
5. Agree the content and timing of performance reports to management so that they support decisions rather than count forms.
6. Run scenario tests covering absence, disagreement with a manager and work at a customer site, then adjust.
7. Check periodically that the people named still hold the time, access and standing to act, especially after reorganisations or changes of workload. Record any gap found and decide who will close it, so the arrangement stays dependable.

Two illustrative authority gaps

Evidence and proportionate implementation

Common nonconformities with clause 5.6

Findings linked to this clause usually concern authority that exists on paper only.

• The person assigned to monitor the system cannot access technical records at remote sites.
• Deviations are reported but nobody has authority to initiate containment.
• Reports to management consist of counts of completed forms and no discussion of improvement needs.
• All duties are assigned to an external consultant instead of laboratory personnel.
• Staff described as responsible for deviations say they must wait for permission from a commercial director.