ISO/IEC 17025 clause 6.6: control laboratory suppliers and services

What clause 6.6 requires in practice

Clause 6.6 asks the laboratory to make sure that anything it obtains from outside, and that touches its work, is fit for that purpose. The scope is wider than subcontracted testing. It covers items built into the laboratory's own activities, such as reference materials, consumables or measuring equipment; services passed on to the customer more or less as received; and services that simply keep the laboratory running, for example maintenance or proficiency testing schemes.

Three outputs follow. First, a procedure with retained records covering how needs are set and approved, how providers are chosen, watched and re-evaluated, how deliveries are checked before use, and what is done when evaluation shows a problem. Second, a clear statement to each provider of what is wanted, the acceptance criteria and any competence expected of its people. Third, where work will be done at the provider's site, a stated understanding of what the laboratory or its customer intends to do there.

Define what is needed before selecting a provider

Specify the product or service, acceptance criteria and relevant competence requirements. For calibration, that may include range, uncertainty and traceability needs. For a reference material, consider the properties, intended use and relevant evidence. For outsourced testing, establish the required method and service conditions.

Clause 6.6.3 also requires communication of activities that the laboratory or its customer intends to perform at the provider's premises. Avoid leaving important expectations in an internal specification that the provider never receives. The contract or purchase order should reflect the actual requirements being evaluated.

Establish a working provider-control process

Clause 6.6.2 requires a procedure and retained records for defining, reviewing and approving requirements; setting evaluation, selection, performance-monitoring and re-evaluation criteria; ensuring conformity before use or direct provision to the customer; and taking action arising from the evaluations.

Choose criteria appropriate to the supplied activity. Accreditation may be important evidence for a relevant laboratory service, but confirm the actual scope rather than relying on a logo. A supplier's general reputation, corporate ISO 9001 certification or sales brochure does not establish suitability for every technical requirement.

Accept the delivered product or service

Approval of a supplier is not automatic acceptance of every delivery. Check the received item or result against the laboratory's established requirements before use or direct provision. Review a calibration certificate for the actual service performed, for example, rather than filing it solely because the supplier is already on the list.

Define what happens when the delivery is unsuitable. A rejection, clarification, restricted use or another action may be appropriate depending on the circumstances. Assess any effect on laboratory work if an unsuitable product or service has already been used.

Monitor performance and control interfaces

Use relevant evidence from deliveries, technical reviews, delays and problems to re-evaluate providers. The standard does not prescribe a universal annual scorecard or weighting formula. The process should identify whether the provider continues to meet the requirements that matter to the laboratory.

Where external laboratory work is used, connect supplier controls with customer advice and approval under clause 7.1, scope boundaries under clause 5.3 and reporting requirements. A technically suitable supplier does not remove the need to explain the arrangement accurately to the customer.

Why clause 6.6 matters to the laboratory

External products and services carry the laboratory's name once they enter a report. A calibration done to the wrong range, a reference material with unsuitable properties or an outsourced test using a different method can all produce a result that looks sound and is not. Because these failures arrive through purchasing rather than through the bench, they are easy to miss. Controlling them protects customers from hidden weaknesses, protects the laboratory from disputes about who was responsible, and gives assessors a clear thread from need to acceptance. It also avoids the quiet drift where a convenient supplier stays approved long after its service stopped matching what the laboratory needs.

How to implement clause 6.6

Build the control around the technical need, with purchasing as a supporting step. Keep the effort proportionate: heavy scrutiny belongs on suppliers whose failure would change a reported result, and a light touch on the rest.

1. Inventory what is obtained from outside and sort it by how much it can affect results, from critical (calibration, reference materials, outsourced tests) to minor.
2. For each critical item, write a short requirement: what is wanted, how it will be judged acceptable and what competence is expected.
3. Set selection and re-evaluation criteria that fit each category, and name who applies them.
4. Send the requirements to the provider in the order or contract itself, including any work planned at the provider's premises.
5. Define the acceptance check on delivery and who carries it out, then record the outcome each time.
6. Agree what happens when something is unsuitable: reject, seek clarification, restrict use, or review work already done.
7. Review the provider list from the recorded outcomes and update it, rather than carrying approvals forward unchanged.

Two illustrative purchasing decisions

Common mistakes and evidence