ISO/IEC 17025 clause 8: make the management system work
Clause 8 provides the management system arrangements that support consistent laboratory work. It offers Option A and Option B. Neither option removes the requirements in clauses 4–7: impartiality, responsibilities, resources and technical processes still need to work. The choice concerns how the management system supports those requirements.
What clause 8 requires in practice
Clause 8 sets out the management system requirements. Its opening subclause requires the laboratory to establish, document, implement and maintain a system capable of supporting and demonstrating consistent fulfilment of the standard and assuring the quality of results. Alongside clauses 4 to 7, the laboratory then implements that system through Option A or Option B.
Option A lists the minimum subjects: management system documentation, control of documents, control of records, actions on risks and opportunities, improvement, corrective actions, internal audits and management reviews. Option B applies where the laboratory runs a management system in line with ISO 9001 that supports and demonstrates consistent fulfilment of clauses 4 to 7. Such a laboratory is treated as having met, at the very least, the purpose behind the management system requirements of clauses 8.2 to 8.9.
Annex B explains that both options aim at the same result, and that an ISO 9001 system does not by itself show technical competence.
8.1: choose between Option A and Option B
Option A addresses the management system elements set out in 8.2–8.9. Option B recognises a management system established and maintained in accordance with ISO 9001 that supports and demonstrates the consistent fulfilment of clauses 4–7. An ISO 9001 certificate alone is not a substitute for that connection or for laboratory accreditation.
A laboratory already using a suitable group quality system may find Option B practical. It still needs to examine whether corporate arrangements serve its technical requirements. For example, a general document-control system may work well, while a corporate competence process based only on job descriptions may need laboratory-specific evidence.
8.2: connect policies, objectives and the laboratory's work
Under Option A, policies and objectives need to address the laboratory's competence, impartiality and consistent operation. Management commitment and implementation must be evident. Relevant documentation, processes and records should form part of, or be connected to, the management system, with access suited to staff responsibilities.
A useful implementation question is whether the system helps staff perform actual work. A policy that everyone acknowledges but nobody can connect to a decision is unlikely to be an effective management tool.
Why the management system matters to laboratory results
The technical clauses explain how to produce a valid result once. The management system is what makes it happen the hundredth time, with different staff, new equipment and changing customers.
A working system gives owners fewer surprises: documents are current, problems are followed through, audits find weaknesses before an assessor does and management makes decisions with real information. It also reduces cost, because a laboratory that fixes causes spends less time repeating work and handling disputes. Getting the structure right early avoids rebuilding it when the scope of accreditation grows.
How to implement clause 8
Treat the choice and design of the system as a management decision with a technical purpose, rather than a documentation exercise. Sterling's teams usually start with what the laboratory already does well, since a system built on existing habits is far more likely to be used than one imposed from a template.
- Describe the laboratory's scope of activities, sites and any group quality system that already exists.
- Choose Option A or Option B deliberately, and record why, using the guidance on clause 8.1.
- Check which of the eight Option A subjects already operate well, and note the real gaps instead of rewriting everything.
- Assign an owner to each subject and link it to the technical work it supports.
- Connect the processes so that a problem raised in one place, such as a failed equipment check, reaches corrective action, audit and management review.
- Run the system for a period, then test it through an internal audit before an accreditation body looks at it.
8.3 and 8.4: control instructions and preserve evidence
Documents guide work; records show what happened. Document controls need appropriate approval, identification, review, current versions at points of use and protection against unintended use of obsolete material. The responsibility also covers relevant external documents.
Records must remain legible, protected and available, with arrangements for identification, storage, backup, retention and disposition. Retention needs to be consistent with contractual obligations, alongside any other applicable requirements. Clause 7.5 adds specific expectations for technical records. Do not invent a universal retention period for every laboratory.
8.5: act on risks and opportunities proportionately
Consider what could prevent intended results and what could improve laboratory activities. Plan actions, integrate them into the system and evaluate their effectiveness. Their extent should reflect the potential effect on result validity.
The standard does not require one formal risk-management method or a particular scoring matrix. A structured register may help, but the test is whether relevant decisions and actions are effective. If equipment failure is a concern, a risk score with no practical availability or response arrangement will not resolve it.
8.6 and 8.7: improve and prevent recurrence
Use opportunities and customer feedback to improve the system, laboratory activities and service. When a nonconformity occurs, address the issue and consequences, evaluate the causes and possible occurrence elsewhere, implement needed action and review effectiveness. Update risks or system arrangements when necessary.
Keep the required evidence of the issue, causes, actions and results. Repeating training is not automatically a suitable corrective action. If an incorrect instruction was easily mistaken for the current one, the investigation should consider document controls and working conditions as well as individual performance.
8.8: audit the system as it operates
Internal audits occur at planned intervals and provide information on conformity and effective implementation. The programme should consider the importance of activities, changes and earlier audit results. Define each audit's scope and criteria, report results to relevant management, act without undue delay and retain records.
As a practical approach, include technical workflow samples and exceptions instead of checking only whether named documents exist. Choose people with sufficient understanding for the assignment and arrangements that support objective examination. A one-size-fits-all annual checklist can miss changes in methods or workload.
8.9: turn management review into decisions
Management reviews the system at planned intervals to check its continuing suitability, adequacy and effectiveness. Required inputs span changing circumstances, objectives, policies, previous actions, audits, corrective action, external assessments, workload and activity range, feedback and complaints, improvement, resources, risks and validity-monitoring results.
Record decisions and actions about the system, laboratory improvement, resources and needed changes. Sterling recommends assigning owners and follow-up dates so decisions lead to action. That is an implementation method, not a prescribed meeting template. The standard does not require management review to occur only once each year.
Common nonconformities with clause 8
Assessors tend to find weaknesses where the management system exists on paper but is detached from the technical work.
- The chosen option is not clearly stated, or the system describes ISO 9001 processes without showing that clauses 4 to 7 are supported.
- Management system elements operate separately, so a nonconformity is logged but never reaches risk review or management review.
- Documents and records are said to be linked to the system, but the links lead to obsolete locations or to material personnel cannot reach.
- Internal audits and reviews have taken place but examine paperwork rather than laboratory activities and result validity.
Illustrative example: a recurring amended report
A laboratory repeatedly corrects reports because an old specification remains selectable in its reporting workflow. The immediate correction addresses affected reports. A stronger review investigates why the obsolete option remained available, checks other methods, changes the control and verifies that the change works.
Management then considers whether the issue indicates a wider weakness in software-change responsibility or resources. This fictional example connects record controls, corrective action, audit and management review. It shows why a closed action log is not enough unless evidence supports the conclusion that the action was effective.
IT example: a group-wide platform change
A laboratory group introduces a shared document platform. The new permissions accidentally prevent analysts at one site from accessing current method instructions. A change review should consider access at the point of use, local responsibilities and a way to detect the problem. Internal audit and management review can then examine whether the shared system supports work across sites. Successful software deployment is not the same as effective laboratory implementation.
Go deeper into this clause
Explore each numbered part
8.1 · choose Option A or Option B
Compare ISO/IEC 17025 management-system Option A and Option B without confusing either route with proof of technical competence. This guide explains the role of an existing ISO 9001 system, the continuing need to meet clauses 4–7 and practical considerations for independent laboratories, internal laboratories and groups sharing corporate processes.
8.2 · document a system people can use
Connect laboratory policies, objectives, processes and records into an accessible management system under Option A. This guide explains competence, impartiality and consistent-operation commitments, management evidence and personnel access, with examples showing why a signed policy or a detached manual cannot substitute for instructions and decisions used in daily work.
8.3 · keep laboratory documents current at use
Control internal and external documents so laboratory personnel use the right instructions and references. This guide explains approval, review, revision status, identification, distribution and obsolete versions under Option A. Examples cover published methods and calibration information, showing why a master list alone does not prevent an outdated instruction being used.
8.4 · retain and protect laboratory records
Preserve legible laboratory evidence so it remains identifiable, protected and retrievable for the required period. This guide covers storage, backup, archiving, access, retention and disposal under Option A, with examples showing why keeping files indefinitely or relying on an untested backup does not necessarily provide effective record control.
8.5 · act on laboratory risks and opportunities
Plan proportionate action on risks and opportunities that affect laboratory results and performance. This guide explains integration and effectiveness review under Option A, with examples distinguishing useful technical risk decisions from a large generic register. It also clarifies that ISO/IEC 17025 does not require one formal risk-management methodology or scoring system.
8.6 · improve laboratory work using feedback
Select useful laboratory improvements and use both positive and negative customer feedback to strengthen the system, activities and service. This guide explains Option A improvement requirements with examples showing how to distinguish an improvement opportunity from a corrective action, and how to assess value without sacrificing technical controls for speed or convenience.
8.7 · correct causes and prevent repeat problems
Move beyond fixing the immediate laboratory error to understanding and addressing its causes. This guide explains reaction, consequence management, recurrence checks, effectiveness review and retained evidence under Option A. Examples show how corrective action connects to nonconforming work and why retraining or rewriting a procedure is not automatically the right solution.
8.8 · audit laboratory practice and evidence
Plan internal audits that evaluate conformity and effective implementation across the laboratory system and activities. This guide explains programme design, scope, criteria, reporting, correction and retained evidence under Option A. Examples show how to follow a real job and a changed process rather than limit the audit to checking whether procedures exist.
8.9 · turn management review into laboratory decisions
Use management review to evaluate whether the laboratory system remains suitable, adequate and effective. This guide covers all required input categories and recorded decisions under Option A, with examples showing how technical performance, workload, customer feedback and resource needs should influence actions rather than become a presentation that produces no management response.
Frequently asked questions
Is Option B a shortcut to accreditation?
No. It can avoid unnecessarily duplicating a suitable management system, but the laboratory must demonstrate the support it provides to clauses 4–7 and meet the applicable accreditation requirements.
Must every laboratory use a complex risk register?
No. Use an approach proportionate to the activities and potential effects on valid results. Record information needed to make decisions clear and support effective follow-up.
Can software satisfy clause 8 for us?
Software can organise agreed documents, evidence and actions. People still need to make appropriate decisions, implement controls and evaluate whether they work. Product adoption alone is not conformity.
Build one system that supports technical confidence
Sterling can help connect laboratory operations with documentation, internal audit, management review and accreditation preparation. Effivity ISO & GRC automation software and relevant employee learning can support the agreed programme across sites. Request a laboratory management system consultation. For team learning, explore ISO/IEC 17025 awareness and Root Cause Analysis & CAPA. Course completion supports development; it is not laboratory accreditation.