ISO/IEC 17025:2017 for Chemical Testing Labs: Accreditation, Done Properly

Clauses 4.1 (Impartiality) and 4.2 (Confidentiality) require the lab to identify and manage risks to impartiality on an ongoing basis, with documented evidence of the analysis and the controls. Clause 8.5 (Actions to address risks and opportunities) extends the risk-based thinking into operational planning. The recurring finding in 2024–2026 assessments is a "risk register" that exists as a one-time document, never reviewed, with no link to actual operational decisions. The standard expects the analysis to be alive, not historical.

Clause 7.2 requires the lab to use appropriate methods and to validate non-standard, lab-developed and modified methods; standard methods are verified for fit-for-purpose in the lab's scope. Validation parameters — specificity, linearity, accuracy, precision (repeatability and intermediate precision), detection and quantitation limits, robustness — must be appropriate to the analytical purpose. The recurring finding is a method validation file that demonstrates a technique works but does not demonstrate it works for the actual matrix and concentration range the lab reports against.

Clause 7.6 requires evaluation of measurement uncertainty for each test method; clause 7.8.6 requires application of a decision rule (e.g. guard-band conformity assessment per ILAC G8) when a statement of conformity is reported. The 2017 revision's addition of decision rules has caught many labs short — reports that previously said "pass" against a specification without considering uncertainty no longer survive assessment, and customers (particularly in pharma, food and regulated environmental work) are now contractually requiring an explicit decision rule.

Clause 6.4 (Equipment) and clause 6.5 (Metrological traceability) require equipment fit for purpose with calibration traceable to SI units through an unbroken chain of comparisons, each with a stated measurement uncertainty. The recurring finding is a calibration certificate from an accredited supplier whose own traceability chain is not actually checked — the lab assumes the upstream accreditation covers it, the assessor demonstrates the chain is broken at a step nobody examined.

Clause 6.2 requires the lab to define competence requirements for each function, authorise personnel against those requirements, and maintain evidence — qualifications, training, experience, demonstrated performance, ongoing monitoring. The technical signatory who releases reports must be authorised against the specific scope of methods and matrices they sign for. The recurring 2024–2026 finding is an authorisation matrix that is current at the role level but stale at the scope level — a signatory whose authorisation predates a method revision, or whose ongoing performance monitoring (proficiency testing or internal blind samples) has lapsed. Assessors test this by picking a recently issued report and tracing the signatory's authorisation against the exact method and matrix on the report.

Clause 7.7 requires the lab to monitor the validity of its results through internal QC (control charts, replicate testing, blind samples, retesting of retained items) and through participation in proficiency testing or interlaboratory comparisons where available. The lab must define the frequency and method of monitoring proportionate to risk, and act on outliers — a single unsatisfactory PT result that does not trigger a documented investigation is one of the most common findings, and a pattern of marginal results that have never been trended is treated as a systemic failure. The 2017 revision also expects the lab to plan and review the monitoring activity as a programme, not as a calendar of individual events.

Clauses 7.9 (Complaints), 7.10 (Nonconforming work) and 8.9 (Management review) close the loop. Complaints must be acknowledged, investigated, responded to in writing where requested, and trended; nonconforming work must be evaluated for significance (does it require recall of issued reports?), corrected, and the underlying cause addressed. Management review must take defined inputs — changes in internal and external issues, fulfilment of objectives, suitability of policies and procedures, status of actions from prior reviews, results of internal and external audits, customer feedback, complaints, results of risk identification, results of PT, monitoring of QC, changes in workload, resource adequacy, opportunities for improvement — and produce defined outputs. A management review minute that lists topics without evidence behind each input is the most common 2026 finding in this cluster.

Days 1–10: impartiality and confidentiality risk register refresh with linkage to operational decisions; close the "alive vs historical" gap. Days 11–25: method validation/verification review across the scope; align validated scope to actual reporting scope. Days 26–40: measurement uncertainty and decision-rule review across the report templates; engage customers on decision rules where contracts are silent. Days 41–55: equipment traceability chain audit; close broken-chain findings. Days 56–60: internal audit covering the full clause set; management review with KPI evidence; freeze the baseline for the accreditation assessment.