ISO Compliance Insights & Best Practices
CART
ISO Compliance Insights & Best Practices
ISO 15189 risk management is the process by which a medical laboratory identifies what could go wrong in its work, judges how seriously it could harm patients and puts controls in place. The 2022 edition of ISO 15189 puts risk and patient safety much closer to the center of the standard than the 2012 edition did.
ISO 15189:2022 is the fourth edition, published in December 2022. It replaced ISO 15189:2012 and also absorbed the requirements for point-of-care testing that used to sit in ISO 22870. Accreditation bodies expect laboratories to show how they manage risk in practice, not just to have a document.
This guide explains the approach in plain steps and gives a worked example. The scales and scores are illustrative, so adapt them to your laboratory and your accreditation body’s requirements.
Free gap assessment
Are you ready for the 2026 edition of ISO 9001?
Score yourself against the new edition, free, including the risk and opportunity split and the clause 10 renumbering that breaks converted checklists.
Run the free ISO 9001 gap assessment → or View premium report sample
The standard asks the laboratory to identify risks and opportunities related to its activities, to plan actions to address them and to evaluate how effective the actions are. The laboratory must consider the impact on patient care, and the approach should be proportionate to the risk.
It is not a demand for a particular method. The laboratory chooses how to rate risk, but the choice must be documented, used consistently and applied across the whole examination pathway. The international guidance on applying risk management to medical laboratories, ISO 22367, is a useful companion if you want a structured approach.
Risk management also connects to other requirements: quality indicators, incident handling, internal audit and management review all supply information about risk. The official standard page at ISO 15189:2022 gives the details of the current edition.
Start with a process map for the whole journey of a sample and a result: request, patient preparation, collection, transport, receipt, preparation, examination, review, reporting and storage. A sketch on one page is enough. Each step has inputs, outputs, people, equipment and information systems.
Include point-of-care testing, which ISO 15189:2022 now covers. Testing done on wards and clinics by non-laboratory staff needs the same risk thinking, especially around training and quality control. See point-of-care testing for what to include.
Note the interfaces. Many failures occur at handovers between departments, between the ward and the laboratory, or between instruments and the information system.
| Phase | Typical risks | Example control |
|---|---|---|
| Pre-examination | Wrong patient identification, poor sample collection, delayed transport | Two identifiers, collection training, transport time limits |
| Examination | Reagent failure, calibration drift, interference | Internal quality control, lot verification, calibration checks |
| Post-examination | Wrong report, missed critical result, delayed reporting | Result review, critical value protocol, LIS alerts |
| Support | Staffing gaps, IT downtime, equipment failure | Cross-training, downtime procedure, maintenance plan |
The pre-examination phase is where many laboratory errors begin. Typical risks include patient misidentification, wrong tube or additive, insufficient volume, hemolysis, delayed transport and incorrect labelling. Most are outside the laboratory walls, so you must work with clinicians and collection staff.
Use data: rejection logs, complaints and incident reports. Our note on pre-analytical errors explains common patterns. A high rejection rate for one ward, for example, is a signal worth exploring.
For each risk, note how the harm could reach the patient: a delayed diagnosis, a wrong treatment, an unnecessary repeat draw. Describing the patient impact keeps the assessment focused on what matters.
In the examination phase, consider reagent and calibrator quality, instrument malfunction, contamination, interference and method limitations. Internal quality control and external quality assessment provide evidence about how well risks are controlled. See ISO 15189 internal quality control and method verification and validation.
In post-examination, consider result review errors, transcription, delayed reporting, missed critical values and incorrect reference intervals. Critical value communication is a high-risk step, and critical value reporting explains how to make it reliable.
Do not forget support processes: staff competence, equipment maintenance, information system changes, power and supply chain. A lab information system update can affect every report.
Use a simple scale. Rate severity of harm to the patient, from minor inconvenience to serious harm, and rate the probability of occurrence, from rare to frequent. Add detectability if you want an FMEA-style score: how likely you are to catch the failure before it reaches the patient.
Multiply or map the ratings to a risk level, and set what level needs action. Record the existing controls and the residual risk. Keep the method short enough to apply to real processes without a consultant.
Discuss scores in a group that includes bench staff, a supervisor and, where possible, a clinician. The conversation reveals differences in understanding, which often matter more than the final number.
Choose controls that reduce the cause or make the failure easier to detect: barcode scanning, automated checks, delta checks on results, training, competency assessments, standard operating procedures and preventive maintenance. Design controls to work even when the operator is busy or new.
Monitor using indicators. Quality indicators such as sample rejection rate, turnaround time and corrected reports tell you whether controls work. See laboratory quality indicators for examples and targets.
Review the risk register at planned intervals and after incidents, method changes, new equipment, changes in the information system and changes in scope. Record what you changed and why.
Consider a hospital laboratory where critical potassium results are sometimes phoned late. Step: post-examination critical value notification. Severity: serious, because delayed treatment could harm the patient. Probability: occasional. Existing control: the technologist phones the ward, with no read-back or time check. Risk rating: high.
Actions: add a read-back requirement, add an automatic alert when a critical result is not acknowledged within a set time and report time-to-notification monthly. After three months, the median notification time falls and no result exceeds the limit. Residual risk moves to medium and stays under review. The example is invented, but it shows how ISO 15189 risk management leads from a risk to a measured improvement.
Record the evidence: the procedure change, the training record, the indicator data and the review date.
Assessors look for a documented approach, evidence that it is applied and proof that it influences decisions. They may ask you to show a recent risk assessment for a change, such as a new analyzer, and how you verified that the controls worked.
Connect the risk register to your internal audit and management review. The difference between this standard and the general laboratory standard is explained in ISO 15189 vs ISO 17025, and the changes introduced in the latest edition are covered in ISO 15189:2022 changes.
For budgeting, see ISO 15189 accreditation cost, which outlines typical cost drivers.
The first mistake is producing a risk register once for accreditation and leaving it untouched. A register that does not change after incidents, new equipment or new methods is not management, it is paperwork. The second mistake is rating risk from the laboratory’s point of view, such as workload or inconvenience, instead of the patient’s point of view. The third is ignoring the pre-examination phase because it is partly outside the laboratory, even though many errors start there.
A fourth mistake is setting controls that rely on people remembering. Training alone rarely holds for long, so add barcodes, alerts and forced checks where possible. A fifth is failing to measure. If no indicator shows whether a control works, you cannot claim the risk is reduced. Finally, keep the language practical. ISO 15189 risk management should be something bench staff recognize in their daily work, not a separate project that belongs to the quality manager.
The laboratory director carries overall responsibility and approves the approach. The quality manager maintains the method and the register. Section heads and senior technologists lead the risk reviews for their areas. Clinical colleagues help rate patient impact, and IT specialists join when the information system is involved. Staff at the bench report near misses, which are the best early warning you have.
Setting up the risk register, the scales, the procedures and the review records from scratch takes time. A prepared set of templates gives a structure to adapt.
The ISO 15189 Toolkit provides 82 medical laboratory templates covering every clause of ISO 15189:2022, including risk management, the pre-examination, examination and post-examination pathway, critical result notification and point-of-care testing. Adapt the wording to match your own processes.
Start by mapping one pathway, such as emergency testing, to test the method before rolling it out to the whole laboratory. For background on the standard, read ISO 15189.
Yes. ISO 15189:2022 expects laboratories to identify risks and opportunities, plan actions, and consider the impact on patient care.
No. The standard does not prescribe a method. FMEA is a common choice, but any documented, consistently applied method is acceptable.
Yes. The 2022 edition incorporates the point-of-care requirements that were previously in ISO 22870.
At planned intervals and after incidents, changes in methods, equipment, information systems or scope.
A documented method, a risk register, records of actions and proof that actions were effective and reviewed.
October 11, 2026
October 11, 2026
October 11, 2026
October 11, 2026
October 11, 2026