ISO Compliance Insights & Best Practices
CART
ISO Compliance Insights & Best Practices
Ask most people whether their laboratory is “ISO 17025 certified” and you will get a yes. It is the wrong word, and the difference is not pedantry. Laboratories are accredited, not certified, and they are accredited for a defined scope rather than for the standard as a whole. Getting that wrong leads laboratories to claim work their schedule does not cover — which is the fastest route to a suspension. This guide covers what ISO 17025 actually requires, and where laboratories most often lose findings.
The distinction matters more here than in most standards, and it is worth being precise about. If you are weighing assurance routes more broadly, our guide to choosing a certification body covers the equivalent decision on the certification side. ISO 9001 is a management system standard. It states requirements an organisation must meet, and a certification body audits against them and issues a certificate. ISO/IEC 17025:2017 works differently. An accreditation body — UKAS, A2LA, ANAB, DAkkS, NABL, SANAS — assesses the laboratory’s technical competence and grants accreditation for a schedule of named activities.
| Certification (ISO 9001) | Accreditation (ISO 17025) | |
|---|---|---|
| Assessed by | Certification body | Accreditation body |
| Assesses | The management system | Technical competence, method by method |
| Granted for | A scope of business activity | A schedule of named methods, measurands, ranges and uncertainties |
| Result | A certificate | An accreditation schedule |
| Work outside it | Still covered by the system | Not accredited work |
That last row is the one that catches laboratories out. Your accreditation covers lead in potable water from 1 to 50 µg/L, by a named method, with a stated uncertainty. Run the same method on waste water and the result is real, defensible and useful — but it is not accredited, and it must not carry the accreditation symbol.
Everything else follows from the schedule. Competence requirements, calibration programmes, uncertainty budgets and proficiency testing plans are all scoped by what you claim to do.
Two practical consequences. First, claim narrowly at first: a granted narrow scope extended later beats a delayed broad one, and extension is a routine process once you are accredited. Second, a schedule entry you can no longer support — competence lost, instrument gone, method withdrawn — should be removed rather than left standing.
Clause 8 of the standard can be met two ways, and choosing late means writing documents twice.
Option A implements the management system requirements set out in ISO/IEC 17025 itself — document control, records, risks and opportunities, improvement, corrective action, internal audit and management review.
Option B lets a laboratory already operating a system in accordance with ISO 9001 satisfy clause 8 through it. Three things are routinely misread:
Option B reduces what you document. It does not reduce what you must achieve, and it leaves clauses 4 to 7 entirely untouched.
Assessors do not usually find that a control is missing. They find that the evidence it operated cannot be produced. Four areas account for a disproportionate share.
A calibration certificate reading “as found: out of tolerance, as left: in tolerance” is not a clean certificate. It is notification that the instrument was wrong for an unknown part of the previous interval. The question that follows is not about the instrument — it is what happened to every result produced since the last time it was known good.
That exposure period is set by your intermediate checks. Check weekly and a failure puts a week of results in scope. Check only at calibration and it puts a year in scope. This is the practical argument for frequent checks, and most laboratories underrate it.
Repeatability is the easiest contribution to measure and often the smallest. A budget for a mass determination might carry calibration uncertainty, readability, drift since calibration, repeatability and an uncorrected buoyancy term — and repeatability can contribute under a tenth of the total. A budget built from replicates alone can understate the result several-fold.
Where the laboratory also samples, sampling usually dominates everything else, particularly in heterogeneous material. A budget that omits it can be out by an order of magnitude — which matters most when the result sits near a specification limit.
Clause 7.8.6 requires a decision rule when you state conformity, and clause 7.1.3 requires it agreed at contract review. Consider a maximum of 10.0 with an expanded uncertainty of 0.4:
| Measured | Simple acceptance | Guarded acceptance (limit 9.6) | Guarded rejection (limit 10.4) |
|---|---|---|---|
| 9.4 | Pass | Pass | Pass |
| 9.8 | Pass | Fail | Pass |
| 10.1 | Fail | Fail | Pass |
| 10.6 | Fail | Fail | Fail |
Three of the four values are decided differently depending on the rule. Under simple acceptance, a value just inside the limit has roughly a 50% chance of the true value being outside it — a point most customers have never had put to them. Agreeing the rule after seeing a borderline result is choosing the outcome.
PT items must be handled as routine samples: same method, same people, same equipment. No extra replicates, no best analyst, no repeating until the number looks right. The purpose is to measure what the laboratory actually does.
Two further points. A questionable result is not a pass — two in the same direction are a bias you have now been told about twice. And an unsatisfactory result requires you to assess customer results produced in the same period by the same method. That step is what makes PT a control rather than an examination, and it is the one most often skipped.
Nine to eighteen months from a standing start is typical for ISO 17025 accreditation. The documents are rarely the constraint. The long poles are traceable calibration, which has to be arranged; competence, which has to be demonstrated rather than asserted; and proficiency testing, which runs to the scheme provider’s calendar rather than yours. Book PT rounds early — a missed round can delay accreditation by a year.
One more thing to plan for: your accreditation body adds requirements on top of the standard. Participation frequency, symbol use, notification obligations, sector schemes and flexible scope conditions all vary by body and change without notice. Assign someone to watch for changes.
An ISO 17025 implementation has three decisions before anything else is written. Decide the scope you are claiming, determine Option A or Option B, and define which activities are laboratory activities and where they are performed. Those three come before anything else is written.
Our ISO 17025 Toolkit covers that sequence with 70 editable templates across fourteen sections — impartiality and confidentiality, competence and authorisation, equipment and metrological traceability, method validation, measurement uncertainty with a worked budget, proficiency testing, reporting and decision rules, and the management system under either option. It includes the clause compliance matrix, audit checklist and assessment evidence pack an assessor will ask for.
No. Laboratories are accredited, not certified, and accreditation is granted for a defined scope of activities rather than for the standard as a whole. There is no ISO 17025 certificate equivalent to an ISO 9001 one.
ISO/IEC 17025:2017, the third edition. ISO has confirmed it as current with no revision in progress, so unlike some standards there is no edition change pending.
No, and it is not an alternative to it. ISO 17025 addresses technical competence to produce valid results, which ISO 9001 does not. A laboratory inside a larger organisation often holds both, using Option B so the ISO 9001 system carries clause 8.
ISO 15189 is the equivalent standard for medical laboratories, sitting alongside ISO 13485 in the medical device and diagnostics space, and carries additional requirements specific to clinical work. ISO 17025 covers testing and calibration laboratories generally.
ISO 17025 accreditation body fees are usually the smaller part. The larger costs are traceable calibration, proficiency testing subscriptions, reference materials, and the staff time to demonstrate competence and run the internal audit and management review cycle before assessment.
August 12, 2026
August 12, 2026
