ISO Compliance Insights & Best Practices
CART
ISO Compliance Insights & Best Practices
A customer sends you a sample with a maximum limit of 10.0. You measure 9.8, with an expanded uncertainty of 0.4. Does it pass?
The honest answer is that it depends on a rule the two of you should have agreed before the sample arrived. That rule has a name — a decision rule — and ISO/IEC 17025 requires it. This guide covers what the rule does, the common options, and how to state it on a report.
Two clauses of ISO 17025 work together. Clause 7.1.3 requires that when a customer asks for a statement of conformity, the specification, the decision rule and the acceptance criteria are clearly defined and agreed with the customer — unless the decision rule is inherent in the specification requested. Clause 7.8.6 then requires the report to identify which results the statement applies to, which specification is met or not met, and the decision rule applied.
Note where the first of those sits: at contract review, before any measurement. This is deliberate. A rule chosen after a borderline result is not a rule, it is a preference.
A measured value of 9.8 against a maximum of 10.0 looks comfortably inside. But 9.8 is the centre of a distribution, and the expanded uncertainty of 0.4 says the true value plausibly lies anywhere from about 9.4 to 10.2. Part of that range is over the limit.
How much of it matters depends on who carries the risk. A decision rule is how you allocate that risk — between you and the customer, or between the customer and whoever relies on the result downstream.
| Rule | Acceptance limit | Effect |
|---|---|---|
| Simple acceptance (shared risk) | The specification limit itself | Uncertainty is not applied. Up to ~50% risk of a wrong call at the limit |
| Guarded acceptance | Limit reduced by a guard band | Reduces the risk of falsely accepting a nonconforming item |
| Guarded rejection | Limit increased by a guard band | Reduces the risk of falsely rejecting a conforming item |
The guard band is usually set equal to the expanded uncertainty, written w = U, though other values are used where the consequences justify them.
Maximum 10.0, expanded uncertainty U = 0.4 at k = 2. Guarded acceptance therefore compares against 9.6; guarded rejection against 10.4.
| Measured | Simple acceptance | Guarded acceptance | Guarded rejection |
|---|---|---|---|
| 9.4 | Pass | Pass | Pass |
| 9.8 | Pass | Fail | Pass |
| 10.1 | Fail | Fail | Pass |
| 10.6 | Fail | Fail | Fail |
Three of the four values are decided differently depending on which rule is in force. Only the clear pass at 9.4 and the clear fail at 10.6 are unambiguous — and those are the cases nobody argues about.
Simple acceptance is the default in a great many industries, and it is a legitimate choice. But it is worth being clear with customers about what it implies: a value sitting exactly on the limit has roughly a 50% probability that the true value is outside it. A value just inside carries a substantial risk of being a false accept.
Most customers have never had this put to them. Raising it at contract review takes two minutes and prevents the conversation that otherwise happens after a failure in service.
Work backwards from consequence when selecting a decision rule.
Record the decision with the reasoning. “Customer requested simple acceptance, advised of the implication, confirmed by email dated…” is the record that ends an argument later.
The report must identify which results the statement of conformity applies to, which specification or part of it is met or not met, and the decision rule applied unless it is inherent in the specification requested.
State the rule in language a customer can act on. “Conformity assessed using simple acceptance; measurement uncertainty has not been taken into account in the statement of conformity” is understood by a procurement manager. A formula is not.
Where uncertainty was used in the decision, report the uncertainty as well — otherwise the reader cannot reconstruct how you arrived at the verdict.
A result lands in the guard band and fails. Repeating the test and reporting only the second result is not permitted — both results are technical records, and both belong in the file. If there is a technical reason to reject the first, record it.
Where a customer asks for a statement of conformity and no rule was agreed, go back and ask before reporting. If that is impossible, report the measured value with its uncertainty and decline the conformity statement, explaining why. A result without a verdict is more useful than a verdict the customer did not define.
Some specifications do. Many say only “maximum 10.0” and are silent on uncertainty, which means the rule is yours and the customer’s to agree. Read before assuming.
Decision rules sit on top of measurement uncertainty: you cannot apply a guard band without a defensible figure to build it from. Both are examined at accreditation assessment, and clause 7.8.6 has produced findings in laboratories that had been reporting conformity for years without ever stating a rule.
Our ISO 17025 Toolkit includes a decision rules and statements of conformity procedure with worked examples, alongside the contract review record that captures the agreement and the reporting standard that governs how it appears on the certificate.
It is mandatory whenever you provide a statement of conformity. If you only report measured values with their uncertainty and make no pass or fail statement, clause 7.8.6 does not apply — though many customers will read a verdict into a result whether you gave one or not.
A margin applied to the specification limit to control the risk of a wrong decision. It is usually set equal to the expanded uncertainty, so an item passes only when the measured value plus its uncertainty is still inside the limit.
It is agreed between you, at contract review. Where the customer has no view, offer your default and record their acceptance. Applying a default silently is what clause 7.1.3 exists to prevent.
No. The measured value and its uncertainty are what they are. The rule only governs how those numbers are turned into a pass or a fail.
August 12, 2026
August 12, 2026
