ISO/IEC 17025 clause 8.8: audit laboratory practice and evidence

What clause 8.8 requires in practice

Clause 8.8 applies under Option A. The laboratory carries out internal audits at planned intervals to find out whether the management system conforms to the laboratory's own requirements, including its laboratory activities, and to the standard, and whether it is effectively implemented and maintained.

The laboratory plans, establishes, implements and maintains an audit programme. The programme covers frequency, methods, responsibilities, planning needs and reporting, and takes account of the importance of the activities, changes affecting the laboratory and earlier audit results. Each audit has defined criteria and scope. Results are reported to relevant management, appropriate correction and corrective action follow without undue delay, and records evidence both the programme and its results.

A note points to ISO 19011 for guidance on internal audits. That document is guidance; it is not added requirement text for this clause.

Build a programme suited to the laboratory

Plan and maintain the programme, including frequency, methods, responsibilities, planning and reporting. Consider the importance of the activities, changes affecting the laboratory and previous audit results. The standard does not prescribe one universal annual visit as sufficient for every laboratory.

Select an approach that covers the relevant requirements and actual workflow over the programme. Technical competence and objective judgement are important to a useful audit. ISO 19011 provides guidance, but its guidance should not be misrepresented as additional wording contained in clause 8.8 itself.

Define each audit clearly

Set the criteria and scope for the particular audit. Identify what will be evaluated and against which requirements. Follow evidence through interviews, observation and records as appropriate. Sampling evidence is necessary in most audits, but choose it to answer meaningful questions rather than selecting only the easiest completed files.

A job-based audit can connect contract review, method capability, equipment, observations, uncertainty and reporting. A process-focused audit can examine a shared weakness such as software changes or external-provider control. Both can contribute when the programme is designed coherently.

Report findings and act without undue delay

Report results to relevant management. Implement appropriate correction and corrective action without undue delay. Distinguish an evidence-supported nonconformity from a suggestion about a preferred working method. Audit findings should identify the requirement and evidence rather than merely express the auditor's taste in documents.

Retain records demonstrating implementation of the audit programme and audit results. Connect follow-up with the relevant corrective-action process so closure depends on appropriate evidence. A scheduled audit that repeatedly slips without evaluation may leave the programme ineffective.

Why internal audits matter to the business

An internal audit is the laboratory's chance to find its own weaknesses privately, on its own timetable. Findings made internally cost far less than the same findings made by a customer, a regulator or an accreditation body.

A good audit looks at how laboratory work is actually done, which gives managers a truthful picture rather than a comfortable one. It also prepares staff for assessment, because they become used to explaining what they do and showing evidence. A programme that responds to change and past results keeps attention on the areas where the laboratory is most exposed.

How to implement clause 8.8

Design the programme so that, across its cycle, it covers both the paperwork and the benchwork. The programme should look at the work as much as at the files. Mix approaches across the cycle so every requirement and every important activity is examined in due course. Auditors should be able to explain their findings in plain business language.

1. List the processes, requirements and sites to be covered, and rank them by importance and recent change.
2. Build a programme that sets how often each area is examined, who audits and how findings are reported.
3. Choose auditors with enough technical understanding and enough independence from the work they examine.
4. Define the scope and criteria of each audit, and plan job-based trails as well as process-based checks.
5. Gather evidence by observation, interview and records, choosing samples that test real questions rather than the easiest files.
6. Report to management, record correction and corrective action, and check progress before the next audit.

Two illustrative audits

Common mistakes and useful evidence