ISO/IEC 17025 clause 7.8.1: review and authorise results before release
Clause 7.8.1 requires results to be reviewed and authorised before release and communicated accurately, clearly, objectively and without ambiguity. Reports must contain the agreed information, what is necessary to interpret the results and what the method requires. Issued reports must be retained as technical records.
What clause 7.8.1 requires in practice
Clause 7.8.1 sets the baseline for releasing any result. Results are reviewed and authorised before they go out. They are provided accurately, clearly, unambiguously and objectively, normally in a report such as a test report, calibration certificate or sampling report. That report contains everything agreed with the customer, everything needed to interpret the results and everything the method itself asks for.
Issued reports are retained as technical records, whether produced on paper or electronically, as long as the requirements are met. The clause also allows results to be reported in a simplified way when the customer agrees, so long as the information that is left out of the report, but listed in the later reporting clauses, can be obtained without difficulty. The practical outputs are an authorisation step, retained copies of what was sent and any written agreement on simplified reporting.
Define what happens before release
Identify who may review and authorise results under the personnel requirements. Establish a review appropriate to the activity, including relevant technical evidence and reporting conditions. The standard does not prescribe one universal checklist, but a release process that only checks spelling may leave important technical issues unresolved.
Distinguish a draft result from an authorised issue. A portal that exposes results automatically can bypass the intended review if its configuration is not controlled. Electronic delivery is permitted, provided the requirements are met; the medium does not reduce the laboratory's responsibility.
Make the communication usable
Consider the customer's intended use, the method and the specific reporting clauses. Explain relevant units, limitations and scope clearly. Avoid a technically correct number presented in a way that invites an unsupported conclusion about a product, batch or wider activity.
The name of the document alone does not determine whether it meets the requirements. A test report, calibration certificate or sampling report must provide the appropriate information for the service. A calibration certificate is a laboratory output, not a claim that the customer's entire organisation has received management-system certification.
Simplify only through an agreed arrangement
Clause 7.8.1.3 permits simplified reporting when agreed with the customer. Information from clauses 7.8.2 to 7.8.7 omitted from that report must remain readily available. Simplification does not remove review, authorisation, accuracy or the need to avoid misunderstanding.
Document the agreed arrangement and ensure personnel and systems apply it consistently. A regular customer relationship does not itself prove that every omission is accepted or appropriate. Revisit the arrangement if the result will be used for a new purpose.
Why clause 7.8.1 matters to the laboratory
Release is the last point at which the laboratory can stop a mistake. After it, the error belongs to the customer's decisions, and correction means recalls, amendments and difficult phone calls. A clear review and authorisation step costs little compared with those consequences, and it creates a visible line of responsibility: a named, competent person stood behind each result. For laboratories delivering through portals or automated exports, a controlled release is also what prevents draft or unreviewed data from reaching customers by accident. Customers gain confidence when they see that reports are consistently reviewed, while regulators and assessors see evidence that the system works under normal pressure.
How to implement clause 7.8.1
Define release as a distinct event, with a person, a standard and a record. Make the process light enough to work during busy periods, since a release step that is bypassed under pressure protects nobody.
- Identify the roles allowed to authorise each type of report and tie that to the competence and authorisation records.
- Write a short review standard, covering technical evidence, completeness against the agreed content and a check that the conclusion matches the data.
- Separate draft status from issued status in whatever system or folder structure is used, and restrict who can move a report between them.
- Configure portals or automated sends so nothing is published before authorisation is recorded.
- Retain each issued report with the record of who authorised it and when.
- For simplified reports, keep the customer's written agreement and a pointer to where the omitted information is held.
- Audit a sample of releases occasionally, including urgent ones, to confirm the process held under pressure.
Two illustrative release decisions
A testing laboratory provides results through a customer portal. It configures the release route so review and authorisation occur before the customer can access the issued result. A draft upload for internal checking is not silently treated as a final issue.
A manufacturer's internal laboratory agrees a simplified routine report with production. The omitted supporting information remains readily available, and unusual results or changed requirements receive appropriate attention. A short format is used deliberately rather than as a reason to discard technical evidence.
Evidence and common mistakes
Retain issued reports, authorisation evidence and the technical records supporting the result. For simplified reports, preserve the agreement and access to omitted required information. Avoid releasing preliminary results without a clear controlled basis, relying on unauthorised staff to approve reports or assuming that an automated system has checked technical validity.
Frequently asked questions
Can results be sent electronically?
Yes. Electronic reporting is acceptable when the applicable requirements, including review, authorisation, clarity, retention and information protection, are met.
Can we send only a result number to a regular customer?
Simplified reporting can be agreed, but omitted required information must remain readily available and the communication must not mislead. Other release and validity requirements still apply.
Must the person authorising a report have a specific job title?
No prescribed title applies. The person must have the relevant competence and authorisation for the activity, and the laboratory must identify the authorisation appropriately.
Turn this requirement into reliable laboratory practice
Sterling can help review the point where technical work becomes a customer result. Bring a report and its release workflow to a free consultation to identify gaps in review, authorisation or simplified-report arrangements.
Build the team's understanding through ISO/IEC 17025 Awareness. Discuss the relevant scope, employee learning and agreed access to Effivity ISO & GRC automation software with Sterling; laboratory technical decisions remain with competent, authorised personnel.
ISO/IEC 17025 requirements hub · Reporting overview · Personnel authorisation · Common report information