ISO Compliance Insights & Best Practices
CART
ISO Compliance Insights & Best Practices
In most laboratories, the customer and the subject of the work are the same party. In a medical laboratory they are not. The clinician requests the examination and receives the report; the patient supplies the sample, carries the risk, and never sees either. ISO 15189 is the standard that takes that split seriously, and it is the single biggest thing separating a medical laboratory from a testing one.
This guide covers what ISO 15189:2022 actually requires, what the fourth edition changed, and the four areas where medical laboratories most often lose findings.
ISO 15189:2022 specifies requirements for quality and competence in medical laboratories. It is the standard clinical laboratories are assessed against — chemistry, haematology, transfusion, microbiology, immunology, molecular, histopathology and cytology — and it now covers point-of-care testing as well.
Laboratories are accredited against it, not certified. An accreditation body assesses technical competence and grants accreditation for a schedule of named examinations, on named sample types, by named methods, at named locations. An examination outside that schedule is not accredited work, however well it is performed. That distinction works the same way in ISO 17025, and it catches laboratories out for the same reason: the certificate people imagine does not exist.
ISO 15189:2022 is the fourth edition, published in December 2022. It replaced ISO 15189:2012 and it also withdrew ISO 22870:2016, the separate point-of-care testing standard. ISO’s own summary names three changes:
| Change | What it means in practice |
|---|---|
| Alignment with ISO/IEC 17025:2017 | The management system requirements moved to the end of the document, so the clause order now follows the work rather than the paperwork |
| Point-of-care testing incorporated | ISO 22870 no longer exists. POCT performed under laboratory oversight is inside ISO 15189’s scope |
| Increased emphasis on risk management | Risk sits at clause 5.6, among the governance clauses, not inside the management system |
The third one is a signal about ownership. Risk to patients is a laboratory director’s responsibility in this standard, not a quality manager’s file.
Clause 4.3 has no equivalent in ISO/IEC 17025, and it is the clearest statement of what ISO 15189 is for. It places obligations on the laboratory that run to the patient directly: information about what the examination involves, consent proportionate to it, access to the service including reasonable adjustments, dignity during collection, and the right to complain without it affecting their care.
Two of those are routinely under-documented.
Consent. A routine venous sample for a full blood count does not need the process a genetic examination needs. Treating them identically produces either a bureaucratic collection service or an inadequately consented genetic one. Assign each category of examination to a consent level — implied, express, or informed and documented — and record the assignment rather than deciding at the bedside.
Withdrawal. Patients can withdraw consent, and the laboratory should say at the outset what withdrawal can and cannot undo. It stops future use; it cannot recall a result already issued or un-inform a clinician who has acted on it. Saying so at the time is much easier than explaining it afterwards.
Clause 5.2 requires a laboratory director with defined competence, authority and responsibility. This is a real appointment, not a title on a chart, and the evidence behind it is examined: qualifications appropriate to the disciplines in scope, professional registration where the jurisdiction requires it, and current continuing development.
Three things follow that laboratories often leave implicit:
Assessors do not usually find that a control is missing. They pick a patient and follow the sample, and they find that the evidence a control operated cannot be produced. Four areas account for a disproportionate share.
The published error literature has put the majority of laboratory errors in the pre-examination phase for decades, consistently and across countries. The reason is structural: most of those steps are performed by people the laboratory does not employ, in places it does not control, leaving records it does not hold.
The laboratory’s influence runs through four things — published requirements, training and authorisation for collectors, acceptance criteria applied consistently, and feedback to the locations generating the failures. That last one is the one most often skipped, and it is the cheapest. A laboratory-wide sample rejection rate is a statistic. The same rate by requesting ward is a conversation with the person who can fix it.
Two specifics worth writing down precisely:
Clause 7.4.1.6 requires results in a critical interval to be notified immediately. A critical result sitting in a computer system is not a communicated result, and neither is a message left with a ward clerk or a voicemail — the person receiving it has to be able to act on it.
Three parts of this are commonly missing from procedures:
| Element | Why it matters |
|---|---|
| Read-back | Critical results have been transposed and misheard in the seconds between speaking and writing. The read-back is the control that catches it |
| Escalation when nobody answers | This is the situation that produces harm, and it is the part most procedures leave blank. Define who is called after the ward, and after that |
| Community and outpatient results | The requesting practice may be closed and the patient may be at home. Agreeing the out-of-hours route in advance is the only way it works at 9 p.m. on a Friday |
One more thing that fails quietly: a critical value list that is too long. Where every abnormal result is critical, notification becomes routine and the genuinely urgent one is lost in it.
Because ISO 22870 was withdrawn into this edition, testing performed on wards, in clinics and in theatres under the laboratory’s oversight is now squarely the laboratory’s responsibility — including where the devices were bought by someone else.
The test of whether oversight is real is whether the laboratory can withdraw a device or an operator. A programme that monitors quality control but has no route to stop a site using a device is a reporting function, not oversight.
What assessors find at point-of-care sites is consistent: expired strips in a drawer, quality control performed but never reviewed, operators whose authorisation lapsed and whose devices did not enforce it, and results that never reached the patient’s record because the device is not connected. All four are found by visiting the site, and none of them are visible from the laboratory.
An out-of-control internal quality control result is investigated before it is repeated. Repeating a failed control and carrying on when it passes converts a detected error into an undetected one, and it is visible in the records as repeated controls with no recorded reason.
The same logic applies to external quality assessment. An unsatisfactory result requires the laboratory to assess the patient results produced in the same period by the same method — the step that makes EQA a control rather than an examination, and the one most often skipped. Our guide to proficiency testing covers that obligation in full; EQA is the clinical term for the same control.
And a questionable result is not a pass. Four consecutive satisfactory scores drifting in the same direction are a bias you have now been told about four times.
Clause 7.3.4 requires measurement uncertainty to be evaluated for measured quantity values. Medical laboratories generally evaluate it top-down — from long-term internal quality control precision, the uncertainty of the calibrator’s assigned value, and the uncertainty of the bias estimate from EQA — because the measurement is performed by a closed commercial system whose internal steps are not accessible.
The common failure is to report the internal quality control CV and stop. On a typical serum creatinine budget, precision contributes about two-thirds of the variance and the calibrator most of the rest, so an IQC-only figure can understate the result by a fifth. Where that matters is at a clinical decision limit, and in judging whether a change between two of a patient’s results is real. The principles are the same as in measurement uncertainty generally; the sources differ.
Clause 8 can be met two ways. Either the laboratory implements the management system requirements set out in ISO 15189 itself, or it meets them through a system already operating in accordance with ISO 9001. Choosing late means writing documents twice.
Three things are routinely misread, and they are the same three that catch ISO 17025 laboratories:
There is a fourth, specific to medical laboratories. Clause 8.9.2 requires management review inputs that an ISO 9001 review does not have: external quality assessment performance, turnaround time monitoring, continuing education, the outcome of risk management, impartiality assessment, and feedback from patients as well as users. A laboratory taking the existing-system route has to add them explicitly.
Twelve to twenty-four months from a standing start is typical. The documents are rarely the constraint. The long poles are external quality assessment, which runs to the scheme provider’s distribution calendar rather than yours; metrological traceability, which has to be established and which does not exist at all for some measurands; competence, which has to be demonstrated over time; and point-of-care sites, which are consistently the largest underestimate in the programme.
Plan for the management system to run for at least three months before assessment, and preferably six. Assessors examine records, and a system approved last week has none.
One more thing to build in: your accreditation body adds requirements on top of the standard — participation frequency, symbol use, notification obligations, director qualifications, sector schemes. These differ by body and change without notice, so keep them in one document rather than editing them into forty.
Three decisions come before anything else is written. Decide the examinations, sample types and locations you are claiming. Appoint the laboratory director and record the competence basis. Determine how clause 8 will be met. Everything else is scoped by those three.
Three of the areas above have guides of their own: pre-analytical errors and how to measure them by requesting location, critical value reporting including the escalation route for when nobody answers, and point-of-care testing governance after the withdrawal of ISO 22870.
Our ISO 15189 Toolkit covers that sequence with 82 editable templates across sixteen sections — patients and consent, the laboratory director, risk to patients, the full pre-examination pathway, method verification, measurement uncertainty, internal quality control and EQA, reporting and critical value notification, point-of-care governance, and the management system. It includes the clause compliance matrix, audit checklist and assessment evidence pack an assessor will ask for, plus a crosswalk for laboratories holding ISO/IEC 17025 as well.
No. Medical laboratories are accredited, not certified, and accreditation is granted for a defined scope of examinations rather than for the standard as a whole. A supplier presenting an “ISO 15189 certificate” is describing something their assessment body did not issue in the form they are implying.
ISO 15189:2022, the fourth edition, published in December 2022. It replaced ISO 15189:2012 and withdrew ISO 22870:2016, the point-of-care testing standard, whose requirements it absorbed.
ISO 15189 applies to medical laboratories, ISO/IEC 17025 to testing and calibration laboratories generally. Clause 8 and most resource requirements are close cousins. The differences are substantial: ISO 15189 adds obligations to patients, a named laboratory director, risk management among the governance clauses, biological reference intervals, critical result notification, and a pre-examination, examination and post-examination structure that ISO/IEC 17025 does not use.
Yes. ISO 22870 was withdrawn when the 2022 edition was published and its requirements were incorporated. If your laboratory oversees testing performed on wards, in clinics or in the community, that testing is in scope — whether or not it appears on your accreditation schedule.
No. If you hold an ISO 9001 system you can meet clause 8 through it, provided its scope covers the laboratory and you add the management review inputs ISO 15189 requires. If you do not, ISO 15189 sets out the requirements itself.
Accreditation body fees are usually the smaller part. The larger costs are external quality assessment subscriptions across the whole examination schedule, reference materials and traceable calibration, the staff time to demonstrate competence, and — where point-of-care testing is in scope — the training and monitoring of operators who do not work for the laboratory.
August 13, 2026
August 13, 2026
