ISO 15189 Internal Quality Control: The Essential 2026 Guide to IQC and EQA

ISO 15189 internal quality control is how a medical laboratory shows, run after run, that its examination results are valid before they reach a patient’s record. The 2022 edition of ISO 15189 expects the laboratory to monitor the validity of results through internal quality control, to compare its performance with others through external quality assessment, and to decide the frequency and design of both by looking at the risk to patients. Assessors spend real time on this area because failures here can put wrong results into clinical decisions.

This guide explains what the standard expects for internal quality control and external quality assessment, how to set a risk-based IQC plan, how to react when a control fails, what to do when no suitable scheme exists, and what evidence assessors ask to see. Clause numbers differ between sources and editions, so check the numbering in your licensed copy of ISO 15189:2022.

What ISO 15189 internal quality control requires

ISO 15189:2022 is the international standard for quality and competence in medical laboratories. Its section on examination processes includes requirements for ensuring the validity of results. Guidance from accreditation bodies and training material describe the core expectations for internal quality control in these terms.

• Frequency is risk-based. The laboratory decides how often to run controls based on the stability and robustness of the method and the risk of harm to the patient.
• Control materials are fit for purpose. They should behave like patient samples, and ideally cover clinical decision limits and the measuring range.
• Acceptance criteria are defined. Results are reviewed against criteria set in advance, and results are not released when a control fails.
• Trends are monitored. The laboratory monitors control data over the longer term to assess method performance.
• Review is recorded. Records show that the control results were looked at by a competent person.

Accreditation bodies may add discipline-specific expectations. For example, the Australian accreditation body NATA publishes an application document for the 2022 edition that gives minimum control frequencies for some disciplines and requires records showing that control results have been reviewed. You can read it in the NATA ISO 15189:2022 application document. Check the rules of your own accreditation body, since they may differ.

Element	Question to answer	Typical evidence
Frequency	Why this many controls, this often?	Risk assessment, method stability data
Materials	Do controls mimic patient samples and cover key levels?	Control specification, lot records
Acceptance rules	What triggers rejection or investigation?	QC rules, limits, approvals
Response	What happens when a control fails?	Corrective action and re-examination records
Review	Who looks at trends, and when?	Signed reviews, monthly summaries

Building a risk-based ISO 15189 internal quality control plan

A plan that simply copies the manufacturer’s suggestion is rarely enough. Start with the examination and ask what a wrong result would do. A potassium result that is falsely low in an emergency department could delay treatment, while a stable, low-stakes test may tolerate fewer controls. Combine that with what you know about the method: how often calibration drifts, how many patient results are produced between controls, and how quickly an error would be noticed.

1. List examinations and rank clinical risk. Consider the medical use, the reference ranges and the time-criticality of the result.
2. Assess method performance. Use verification data, past QC performance and manufacturer information.
3. Select control materials and levels. Choose levels near decision limits and across the range.
4. Set frequency. Balance risk with the number of patient results between controls, and document the reasoning.
5. Define rules. State which statistical or rule-based criteria trigger action, and who decides.
6. Define the response. Say what to stop, what to investigate and what to re-test, including patient samples run since the last good control.
7. Review and revise. Look at QC trends and update the plan when performance changes.

This ties into how the laboratory evaluates its methods. See our guides to measurement uncertainty and laboratory quality indicators for related measures that can inform the plan.

When ISO 15189 internal quality control fails

The response to failure is where records are tested. The laboratory should stop reporting affected results, investigate the cause, correct it and confirm control before resuming. Sample re-examination is also needed: where results were released since the last acceptable control, the laboratory must decide whether any need to be re-run or reported as corrected. Recording the decision matters as much as the fix.

The following is a hypothetical illustration. A hospital laboratory runs two levels of a control for a glucose assay at the start of each shift and after a reagent change. On a Tuesday morning, the high control falls outside its acceptance limits. The technologist stops reporting, checks the reagent, recalibrates and reruns the controls, which now pass. The supervisor identifies 34 patient samples run since the last acceptable control at the previous shift, has those with results near clinical decision points re-run, and finds two that changed enough to need corrected reports. The clinicians are told, the corrected results are issued, and the event goes into the QC log with the cause and the actions taken.

External quality assessment under ISO 15189

Internal control shows consistency inside your laboratory. External quality assessment shows how your results compare with other laboratories. The standard expects the laboratory to participate in programs suitable for its examinations, with samples handled like patient samples and with the staff who normally do the work taking part. Training material on the standard notes that schemes should follow ISO/IEC 17043, the standard for proficiency testing providers.

When there is no scheme

Some examinations have no available or suitable external scheme. Guidance describes the alternative: the laboratory justifies why no scheme is suitable and uses another way to check performance, such as exchanging samples with another laboratory, comparing results with another method, or using retained materials. Document the justification and the alternative, and review it at defined intervals, since a scheme may become available later.

Acting on EQA results

Each EQA report should be reviewed by a named person against defined criteria. Unsatisfactory results need a documented investigation: a look at the sample handling, the method, the calibration and the transcription of results, followed by corrective action and a check that it worked. Repeated marginal results are worth investigating, even if none is formally unacceptable.

Point-of-care and multi-site testing

Point-of-care testing brings its own challenges: many operators, varied environments and frequent turnover. Controls and EQA still apply, and some accreditation bodies allow identical analyzers at one site to be grouped under one scheme enrollment when they share the same manufacturer, principle, reagents and calibrators. Where the laboratory uses several methods or sites for the same examination, it also needs a way to show the results are comparable. Our guide to point-of-care testing describes the extra controls needed.

What assessors ask to see for ISO 15189 internal quality control

• The risk-based rationale for control frequency and levels.
• Records of control results with evidence of timely review.
• Examples of failures, the investigation and the follow-up on patient results.
• EQA enrollment for each examination, with results and reviews.
• Justification and alternatives for anything without a scheme.
• Training and competency records for the staff who run controls.
• Evidence that the plan is reviewed and changed when performance changes.

For the wider context of the standard, see our overview of ISO 15189 and the summary of changes in the 2022 edition.

Common ISO 15189 internal quality control and EQA mistakes

• Copying manufacturer defaults. Using the supplier’s suggested frequency without any local risk reasoning.
• Controls that do not match the sample. Materials with a different matrix from patient specimens.
• Review that never happens. Results logged but not signed as reviewed.
• Ignoring the patient impact. Correcting the assay but not assessing results already released.
• EQA treated as a special test. Running samples in extra replicates or with the best technologist.
• No follow-up on marginal results. Waiting for a formal failure before investigating.

Templates for ISO 15189 internal quality control documentation

You will need an IQC procedure, a risk assessment template, a QC review form, a failure response record, an EQA register and a nonconformity form. The ISO 15189 Toolkit provides medical laboratory templates you can adapt to your methods and accreditation body. Costs and timelines for accreditation are covered in our note on ISO 15189 accreditation cost.

ISO 15189 internal quality control FAQ

How often must internal quality control be run?

The standard does not set one number. The frequency depends on the stability of the method and the risk of harm to the patient, and accreditation bodies may set minimums for some disciplines.

Can we release results when a control fails?

No. Results should not be released while a control is outside its acceptance criteria. Investigate, correct and confirm control before resuming.

Do we need external quality assessment for every test?

Where a suitable scheme exists you should participate. Where none exists, justify it and use an alternative method to check performance.

What is ISO/IEC 17043?

It is the international standard for the competence of proficiency testing providers, and EQA schemes are expected to operate to it.

Do point-of-care devices need quality control?

Yes. Controls and external assessment apply, following the manufacturer’s recommendations and your accreditation body’s rules.