ISO/IEC 17025:2017 requirements checklist for Indian labs

What is the purpose of ISO 17025?

The purpose of ISO 17025 is to let a laboratory show that it works competently and produces valid results. ISO describes it as enabling laboratories "to demonstrate that they operate competently and generate valid results", so that reports are trusted at home and abroad without retesting.

The 2017 edition is the third edition and is still current: ISO's catalogue page says it was last reviewed and confirmed in 2023. Compared with the 2005 edition, it brings in risk-based thinking and covers information technology and electronic records more directly.

Who is ISO 17025 for?

ISO 17025 is for any laboratory that does testing, calibration or sampling linked to testing. That includes private commercial labs, in-house industry labs, government labs and university labs. In India, a water, food, environmental or construction materials lab seeking NABL accreditation implements ISO/IEC 17025:2017; NABL 100B confirms it as the standard for testing and calibration labs.

If you are at the start, read our guide on how to get NABL accreditation alongside this checklist.

What does clause 4 (general requirements) ask for?

Clause 4 asks the lab to stay impartial and to keep customer information confidential.

• 4.1 Impartiality. Management must be committed to impartiality, must not allow commercial or financial pressure to affect results, and must identify risks to impartiality on an ongoing basis and show how it removes or reduces them.
• 4.2 Confidentiality. The lab is responsible, through legally enforceable commitments, for all information obtained or created during its work. Staff and contractors must keep it confidential.

Typical evidence: an impartiality policy, a risk register for impartiality, signed confidentiality and conflict-of-interest declarations for staff, and customer agreements.

What does clause 5 (structural requirements) ask for?

Clause 5 asks the lab to be a legal entity, or a defined part of one, with management that is clearly responsible.

• 5.1 Legal entity, legally responsible for its activities.
• 5.2 to 5.4 Identified management; a documented range of activities for which the lab claims conformity.
• 5.5 Organisation structure, responsibilities and documented procedures.
• 5.6 People with authority to run the management system and to report on its performance.
• 5.7 Management communicates about the system and keeps it intact during changes.

Typical evidence: registration certificate, organisation chart, job descriptions, and nomination of the quality manager and technical manager.

What does clause 6 (resource requirements) ask for?

Clause 6 asks for competent people, suitable facilities, fit equipment, traceable measurements and controlled purchasing.

6.2 Personnel

The lab documents competence requirements for each role and keeps records of selection, training, supervision, authorisation and monitoring of competence. Clause 6.2.6 requires personnel to be authorised for specific activities, including method validation, statements of conformity and the review, reporting and authorisation of results.

6.3 Facilities and environmental conditions

Facilities must not affect the validity of results. The lab documents the conditions it needs, then monitors, controls and records them where they matter, for example incubator and room temperature in a microbiology section.

6.4 Equipment

The lab has a programme for calibration and maintenance, labels equipment so users can see its calibration status, takes faulty equipment out of service, and keeps records. Clause 6.4.13 lists what equipment records include, such as identity, location, calibration dates and results, the next due date, and maintenance and repairs.

6.5 Metrological traceability

Results must be traceable to SI units through calibration by a competent lab, certified reference materials from a competent producer, or direct realisation. NABL 142 sets NABL's policy for how that traceability is shown.

6.6 Externally provided products and services

The lab defines and approves what it buys that affects results (reagents, CRMs, calibration services, subcontracted tests), evaluates suppliers, and checks items before use.

What does clause 7 (process requirements) ask for?

Clause 7 covers the work itself, from enquiry to report. It is the clause assessors spend most time on, because they witness tests and trace sample records.

Two points in clause 7 often surprise new labs. First, clause 7.5.2 requires amendments to technical records to be tracked back to previous versions or original observations, with both kept. Second, clause 7.11.2 covers both computerised and non-computerised systems, so a register or an Excel sheet is a "laboratory information management system" under the standard and needs the same controls. Our guide to the hidden cost of Excel in labs looks at that in more detail.

Reporting under clause 7.8 has its own guide: NABL test report format.

What does clause 8 (management system requirements) ask for?

Clause 8 asks for a management system that supports everything above. Clause 8.1 gives two options: Option A lists the elements below; Option B lets a lab with an ISO 9001 system use it, provided it also meets clauses 4 to 7.

1. 8.2 Management system documentation: policies and objectives covering competence, impartiality and consistent operation.
2. 8.3 Control of documents: approved, reviewed, identified versions at the point of use; obsolete versions prevented from use.
3. 8.4 Control of records: identification, storage, protection, back-up, archive, retention and disposal.
4. 8.5 Risks and opportunities: planned actions, in proportion to the effect on the validity of results.
5. 8.6 Improvement: including feedback from customers.
6. 8.7 Corrective actions: react, find the root cause, act and check that the action worked.
7. 8.8 Internal audits: at planned intervals, covering the system and lab activities.
8. 8.9 Management reviews: at planned intervals, with recorded inputs and outputs.

NABL publishes NABL 160A as a guide to writing the quality manual and NABL 161 as a guide to internal audit and management review.

ISO 17025 list of documents: what a lab usually keeps

ISO 17025 does not give a single list of mandatory documents, which is why an ISO 17025 requirements checklist is useful. Each clause says where a "procedure", "documented" information or "records" are needed. In practice, an Indian testing lab preparing for NABL usually has:

• a quality manual (management system document) and quality policy;
• procedures for impartiality, confidentiality, personnel, equipment, purchasing, contract review, method validation, sampling, sample handling, uncertainty, quality control, reporting, complaints, nonconforming work, data control, document and record control, risk, corrective action, internal audit and management review;
• method SOPs or the standard methods themselves, kept current;
• records: training and authorisation, environmental monitoring, equipment and calibration, supplier evaluation, contract review, sampling, sample receipt, worksheets and raw data, uncertainty, QC and PT, reports, complaints, nonconforming work, corrective action, internal audit and management review minutes.

A worked example: one chloride result through the clauses

Take one drinking water sample tested for chloride by titration against IS 10500. A NABL assessor tracing that single result may ask for:

1. the test request and contract review (7.1);
2. the inward entry, sample code and condition on receipt (7.4);
3. the method verification file for the titration method (7.2);
4. the analyst's authorisation for this test (6.2);
5. the burette and balance calibration status and certificates (6.4, 6.5);
6. the standardisation of the silver nitrate, the blank and the raw titres (7.5);
7. the duplicate or QC check for that batch (7.7);
8. the uncertainty estimate for the method (7.6);
9. the decision rule used for "complies" (7.1.3, 7.8.6);
10. the reviewed, authorised and issued report (7.8).

If any link in that chain lives only in someone's memory or in an overwritten Excel cell, it becomes a finding.