ISO 17025 Internal Audit Checklist: The Essential 2026 Guide for Testing and Calibration Labs

An ISO 17025 internal audit checklist is a set of questions and evidence prompts that an internal auditor uses to check whether a laboratory meets ISO/IEC 17025:2017 and its own procedures. It supports the internal audit required by clause 8.8, and it is often the most effective preparation for an accreditation assessment.

ISO/IEC 17025:2017 is the current edition of the general requirements for the competence of testing and calibration laboratories. ISO lists it as confirmed in a 2023 review, so it remains the reference for accreditation. The standard has clauses 4 to 8, which the checklist follows.

The questions below are a starting point. Tailor them to your scope, methods and accreditation body rules, and always read the standard itself.

Why use an ISO 17025 internal audit checklist

Laboratories often fail assessments not because the work is poor but because the records do not show the work was done as described. An internal audit finds those gaps first. A checklist makes the audit repeatable, so different auditors cover the same ground and results can be compared year to year.

The standard requires internal audits at planned intervals to check that the management system conforms to your own requirements and to ISO/IEC 17025, and is effectively implemented and maintained. It also expects you to define audit criteria and scope, to report results to relevant management, to correct issues without undue delay and to keep records.

A good checklist is not a list of yes-no questions. It prompts the auditor to sample real records, watch real work and talk to real staff, which is how technical competence is tested. The scope must include both the management system and the technical activities.

Clause 4 and 5 audit questions

Clause 4 covers impartiality and confidentiality. Ask how the laboratory identifies threats to impartiality, such as commercial pressure, shared ownership with customers or staff doing consulting on the same work. Check that the risk assessment is current and that mitigation is recorded. The guidance on laboratory impartiality gives examples.

Confirm that confidentiality obligations are in place, that staff and contractors are bound and that information released to third parties follows the rules. Clause 5 asks whether the laboratory is a legal entity, whether management is identified, whether the scope of laboratory activities is defined and whether the quality policy and structure are documented.

Sample evidence: the impartiality register, signed confidentiality commitments, the scope statement on the website and on reports, and the organization chart showing reporting lines.

Clause	Audit focus	Evidence to sample
4 General	Impartiality, confidentiality	Impartiality risk assessments, agreements
5 Structural	Legal entity, management, scope of activities	Organization chart, scope statement
6 Resource	Personnel, facilities, equipment, traceability, suppliers	Competence records, calibration certificates
7 Process	Requests, methods, sampling, records, uncertainty, results, reporting	Technical records, reports, validation files
8 Management system	Documents, risk, improvement, audits, review	Audit reports, management review minutes

Clause 6 resource questions for your checklist

Personnel: is there a competence requirement for each function, evidence of qualification and training, authorization to perform specific tasks and monitoring of performance? Check that authorization dates match the work performed. Facilities and environmental conditions: are conditions required by methods monitored, recorded and controlled, and is access to sensitive areas managed?

Equipment: is every item listed, calibrated or verified before use and labelled with its status? Are intermediate checks performed and records kept? Is there a procedure for equipment that has been overloaded or shows suspect results? Metrological traceability: can each result be traced to the SI or another suitable reference through an unbroken chain? See ISO 17025 metrological traceability.

Externally provided products and services: are suppliers of calibration, reagents and subcontracted tests evaluated, and are requirements communicated? Sample calibration certificates and check that they cover the range and uncertainty you rely on.

Clause 7 process questions for an ISO 17025 internal audit checklist

Clause 7 is where most technical findings arise. Review of requests, tenders and contracts: does the laboratory confirm it can meet the customer’s needs, and are differences resolved? Selection and verification of methods: is the method fit for purpose, and is it validated or verified as required? See method validation.

Technical records: can another person reconstruct the test from the records alone, including identity of the operator, date, equipment, conditions and raw data? Evaluation of measurement uncertainty: is uncertainty estimated for calibrations, and for tests where relevant? See measurement uncertainty.

Ensuring validity of results: are quality control measures, proficiency testing or interlaboratory comparisons used, and are results evaluated? See proficiency testing. Reporting: do reports contain the required information, and are statements of conformity based on defined decision rules?

Clause 8 management system questions

The laboratory chooses Option A, with specific management system requirements, or Option B, where it already holds an ISO 9001 system that meets the intent. Check the chosen option is documented and followed. The relationship is described in ISO 17025 vs ISO 9001.

Audit the core elements: control of documents and records, actions to address risks and opportunities, improvement, corrective actions, internal audits and management review. The approach to risk is discussed in ISO 17025 risks and opportunities.

Ask for the last management review minutes. Do they cover inputs such as audit results, customer feedback, complaints, proficiency testing outcomes and resources, and do they record decisions and actions?

How to run the audit itself

Plan the audit programme so every clause and every technical area is covered within the cycle, with more frequent checks on high-risk or changed areas. Use independent auditors who do not audit their own work, and brief them on both the standard and the methods in scope.

Combine two views. The system audit tests procedures and records against the standard. The technical audit, often called a vertical audit, follows a single job from enquiry to report to confirm that every step matches the procedure and that the result is reliable. Include witnessing of live tests where possible.

Record findings clearly: the requirement, the evidence and the gap. Classify them, agree corrective actions with owners and dates, and verify that actions were effective, not just completed. The standard itself, available through ISO/IEC 17025:2017, is the final authority.

A short ISO 17025 internal audit checklist example

Suppose an auditor follows a chloride test in a water lab. They read the customer request, check the method validation, view the analyst’s authorization, inspect the balance and titrator calibration status, trace the reference material certificate and review the raw data and calculation. The result appears on the report with the uncertainty statement.

The auditor finds that the reference material was used one week after expiry and that the analyst’s authorization lacked the latest method revision. Both are raised as nonconformities. The root cause is the lack of an expiry check in the receiving process. The corrective action adds a label check and updates the authorization form. The example is invented, but it shows how a vertical audit using an ISO 17025 internal audit checklist surfaces practical gaps.

The laboratory then reviews similar materials to confirm no other results were affected.

Corrective action and continuous improvement

Each nonconformity should lead to correction, root cause analysis and corrective action where needed. Check whether similar nonconformities exist elsewhere. Verify effectiveness after a set period, and record the decision.

Feed the audit results into management review and risk assessment. Repeated findings in one area signal a systemic problem, such as a lack of time, unclear responsibilities or weak training. Report trends, for example the number of findings by clause and time to close.

Use the audit to recognize good practice too. Positive observations help people see that the audit exists to improve the lab, not to punish individuals.

Keeping your ISO 17025 internal audit checklist current

Review the checklist every year and after any change to the standard, your scope, your methods or your accreditation body rules. Add questions for every finding from assessments and customer complaints, so past problems are checked again. Retire questions that no longer match your procedures. Store each completed checklist with the audit report, and keep a change log so assessors can see how the ISO 17025 internal audit checklist has evolved and that it reflects the way the laboratory actually works.

Using a ready-made ISO 17025 internal audit checklist

You can build the checklist and the audit programme yourself, but making it complete, consistent and linked to your documents takes time. A prepared set of templates saves effort.

The ISO 17025 Toolkit provides 70 laboratory templates covering impartiality, competence, equipment and traceability, method validation, uncertainty, proficiency testing, reporting and decision rules, and the management system, so your audit checklist can reference your own procedures. For planning the accreditation journey, see ISO 17025 accreditation cost, and for background read ISO 17025.

Whichever route you use, train your auditors. An ISO 17025 internal audit checklist is only as good as the person using it.

ISO 17025 internal audit checklist FAQ

How often should a laboratory do internal audits?

At planned intervals, commonly covering all clauses and technical areas at least once a year or across a defined cycle, with more attention to high-risk areas.

Who can be an internal auditor?

A competent person who is independent of the activity being audited and who understands both ISO/IEC 17025 and the laboratory methods in scope.

What is a vertical audit?

It follows a single sample or job from request to report to confirm every step follows procedure and supports the result.

Is the standard current?

ISO/IEC 17025:2017 is the current edition and was confirmed in a 2023 review.

What should an audit report include?

The scope, criteria, findings with evidence, conclusions, agreed actions and follow-up dates, reported to relevant management.