ISO 17025 Audit: How to Prepare for Your Accreditation Assessment

An ISO/IEC 17025 audit is likely not something anyone looks forward to. It disrupts the normal workflow of the lab and everyone feels as though they’re under a microscope. Whether it’s your first time or you’re a veteran, an assessment can make anyone feel a bit nervous. Luckily, you can draw on the experiences of others to help navigate you through to a successful accreditation. What follows are tips from labs with assessment experience, organized the way the assessment itself runs: what happens before anyone arrives, what to have ready, what the days on site look like, and what to do with the report afterward.

A note on words. Everyone calls it an audit, and that’s the term people search for, so it’s in the title. Accreditation bodies call it an assessment, the people who run it assessors, and the findings deficiencies (A2LA) or nonconformities (ANAB and most others). Using their vocabulary in the room costs nothing and signals that you’ve done this before. Clause numbers below are from the current edition, ISO/IEC 17025:2017; if your checklist still says 4.x and 5.x, it’s the 2005 edition, and our clause-by-clause guide to 17025:2017 maps the two.

How the assessment runs, start to finish

Knowing the shape of the process takes most of the dread out of it. The details vary by accreditation body, but the sequence is the same almost everywhere.

Application and scope. You tell the accreditation body which tests you want accredited — the scope of accreditation — with the methods, ranges, and the people and equipment behind them. Everything downstream is assessed against this list, so write it to match what the lab actually does well, not everything it has ever done.
Document review. Before anyone visits, an assessor reviews your management system documentation remotely against the standard. Gaps found here come back as a list to fix before the on-site visit. Treat this round seriously; a clean document review makes the on-site assessment shorter and friendlier.
Pre-assessment (optional). Some bodies offer a shorter advisory visit first. For a first accreditation it’s usually worth the cost: it finds the things you can’t see from inside.
On-site assessment. Typically one to three days, scaled to your scope, with a lead assessor who covers the management system and one or more technical assessors who know your test methods. It opens with a meeting that confirms the plan and closes with a meeting where you’re handed the findings.
Deficiency report and your response. For each finding you submit a correction, a root cause, a corrective action, and evidence. The clock is short — A2LA, for example, gives 30 days for the first response — so start the day of the closing meeting.
Accreditation decision. Granted once your responses are accepted. Your certificate and scope go on the body’s public directory.
Surveillance and renewal. Accreditation runs on a cycle, commonly two years, with a shorter surveillance visit at the midpoint. The records you built for the initial assessment have to stay alive between visits — which is the real reason to keep them in a system rather than a binder.

What has to exist before the first assessment

Labs occasionally book an initial assessment before these are in place, and the visit turns into an expensive gap analysis. Have all of them done, with records, before you apply:

At least one full internal audit of the management system (8.8), with findings closed or in progress. Our free internal audit checklist walks clauses 4 through 8 and exports a findings summary.
At least one management review (8.9), with the inputs the standard lists and recorded decisions.
Proficiency testing or interlaboratory comparison (7.7) for the methods on your scope, where a scheme exists. Most bodies require participation before the initial visit, not just a plan to participate.
Measurement uncertainty budgets (7.6) for each method, and decision rules (7.1.3) for any test that reports pass/fail against a specification.
An impartiality risk assessment (4.1). New in 2017 and routinely missing. For an in-house lab inside a manufacturer it’s the most interesting document you’ll write, because the people requesting the tests often work for the people who want them to pass.
Authorization records per technician per method (6.2.6). Not just training records: the record that says this person is authorized to run, review, or report this test. The free training matrix is a starting point.
Validation of your information system (7.11.2), if you use a LIMS or any software that handles results. The standard names LIMS explicitly, and the assessor will ask how you validated it before use. Our data security post covers what 7.11 expects.

Organized documentation

The most important advice for preparing for an assessment is to have organized documentation. Without having your documentation organized, it’s difficult, time consuming, and sometimes impossible to respond to questions from the assessors. The quicker and easier you can answer questions, the happier your assessors will be and the more professional your lab will seem. What will the assessor’s questions be? Thankfully, it’s not a secret. It may be obvious, but the ISO/IEC 17025 document is the perfect guidebook for what the assessors will be looking for and asking. There are two general methods of organizing your documentation.

Method 1 — Have a spreadsheet or other document act as a cross-reference between your documentation and the requirements in the standard. For each requirement, the cross-reference specifies exactly where in your documentation it’s satisfied and includes notes about examples, if applicable. This method works, but it usually requires a lot of jumping around between documents, and in practice the cross-reference is seldom version controlled and tends to go out of date.
Method 2 — The better method is for your top-level management system document to exactly mirror the standard. For example, the equipment-records requirement in clause 6.4.13 matches to section 6.4.13 of your document, which defines how your lab satisfies it. The 2017 edition doesn’t require a quality manual, but a top-level document that mirrors the standard is the easiest thing to be assessed against: the assessor reads down the standard, you read down your document, and nobody has to translate. Having your documentation organized like this makes assessments very straightforward for you and for the assessors.

Whichever method you use, the document control behind it has to hold up (8.3): every procedure in use is the current approved revision, superseded revisions are marked and out of circulation, and the master list says which revision is current. Obsolete documents in use is one of the most-cited deficiencies in any discipline, and it’s found by the simplest test there is — the assessor picks up the procedure on the bench and compares it to the master list. Version-controlled documents in a system make that test boring.

Important documentation

Every assessor and assessment can be a bit different, but it’s prudent to prepare and review the often-asked-for documentation beforehand. Have everything available on screen in seconds: the document review happens remotely, and an assessor on site will happily look at a shared display. Print only what the assessor asks to hold; paper is easier to look over together, electronic is easier to find and keep. The following documents will almost certainly be requested.

Management system documentation — policies, objectives, and the quality manual if you keep one (8.2)
Master List of Documents, with current revisions (8.3)
Approved external providers: suppliers and subcontracted labs (6.6)
Impartiality risk assessment (4.1) and the risk and opportunity register (8.5)
Internal audit program and the latest audit report (8.8)
Management review records (8.9)
Measurement uncertainty budgets and decision rules (7.6, 7.1.3)

In addition to the documents above, you should also expect to provide example records. Before the assessment, it’s very important that you pick “perfect” example records that you have thoroughly reviewed to be accurate and conforming to the standard and to the requirements of your own documentation. Such example records would include the following.

In-house test reports, including one with a statement of conformity and its decision rule (7.8)
Subcontracted test reports (7.8, 6.6)
Calibration and equipment records, with certificates and intermediate checks (6.4.13)
Technical records for a complete job: who did what, when, and any amendments with the original values retained (7.5)
Corrective actions, through to the effectiveness review (8.7)
Actions to address risks and opportunities — what replaced preventive actions in 2017 (8.5)
Customer feedback (8.6) and complaints (7.9)
Nonconforming work records (7.10)
Training and authorization records for all lab personnel (6.2)
Proficiency testing results and the action taken on them (7.7)

Have these records ready when the assessor asks for them, and give the assessor what they asked for. Volunteering a stack of extra records isn’t helpful to anyone: it extends the day, and every extra page is another chance for something to be found. Your job is to answer the question, not to curate a tour. Do it in the spirit of being efficient rather than defensive; an assessor who senses the second will dig.

Demonstrating tests

So much of the preparation effort is spent on documentation and the management system, it can be easy to forget that a large part of the assessment is performing tests. The technical assessor will select methods from your scope to witness — often the ones with the highest risk or the newest on the list — and the assessment plan usually tells you which ones in advance. It’s important to prepare lab technicians for spending a lot of time performing and explaining tests to assessors during the visit. It can also be helpful to have test samples on hand for the technicians to use for test demonstrations. For short tests that can be completed in a single day, assessors will likely request to witness the test from start to finish. For longer multi-day tests, assessors will probably only want to witness different stages of the test process, with the technician explaining the stages the assessor was unable to witness.

During all of the test witnessing, the assessor will ask for the calibration record of every single piece of calibrated equipment the technician uses — the gauge, the fixture, the thermometer in the chamber, the load cell nobody thinks of as an instrument — so be sure those records are reviewed before the technician uses the equipment. They’ll also ask the technician, not the quality manager, where the procedure is, which revision it is, and whether they’re authorized to run it. A technician who can pull up the equipment’s calibration status and their own authorization on the spot ends the line of questioning; one who says “the quality manager has that” opens it.

Three things the technical assessor is checking that aren’t about the test itself: that the test item was identified and its condition recorded on receipt (7.4; see our sample tracking guide), that environmental conditions were recorded where the method requires it (6.3), and that the technical record shows who performed and who checked the work (7.5).

Running the room

Some practical rules for the days on site.

Assign a scribe. One person writes down every potential finding as the assessor raises it, in the assessor’s words. At the closing meeting your list should match theirs. Surprises at the closing meeting are almost always something that was said on day one and not written down.
Answer the question, then show the record, then stop. The 2017 edition is a “show me” standard more than a “do you” standard. A clear “yes” followed by the record is the complete answer. Explaining the history of why the procedure is the way it is, is not.
If you spot a problem the assessor hasn’t, don’t hide it and don’t make a show of it. Note it and record it in your own nonconforming-work or corrective-action log the way you would on any other day (7.10, 8.7). You don’t need to interrupt a witnessed test to announce it, but if the assessor gets there, a record showing you caught it first is the difference between a finding and evidence that your system works. What you never do is conceal it; the fastest way to lose an accreditation is to be caught doing that.
Don’t argue, but do push back with evidence. If you believe the assessor has misread a requirement, say so politely, point to the clause and your record, and let them respond. If they hold their position, move on and take it up in your written response, where you can make the case carefully. Assessors are technical people and most of them respect a well-made argument; none of them respect being argued with.
Keep the right people available. The lab manager and quality lead for the whole visit, the technicians running witnessed tests when scheduled, and a decision-maker reachable for the closing meeting. Nothing stalls a visit like the one person who knows where the calibration certificates are being out that day.

The deficiencies assessors find most

Every accreditation body publishes its most-cited findings, and the lists are remarkably stable across disciplines. If you’re short on preparation time, spend it here.

Finding	Clause	What it usually looks like
Calibration and intermediate checks	6.4	Expired calibration in use; no intermediate checks between calibrations; certificate on file but the correction factors never applied
Metrological traceability	6.5	A reference standard calibrated by a non-accredited provider, or a certificate with no uncertainty stated
Obsolete documents in use	8.3	The procedure on the bench is a revision behind the master list
Training without authorization	6.2	Attendance records exist; the record authorizing the person for the specific method doesn’t
Technical records	7.5	Results without the identity of who performed and who checked them, or amendments that overwrote the original value
Measurement uncertainty	7.6	No budget for a method, or one copied from a textbook that doesn’t match the lab’s equipment
Decision rules	7.1.3, 7.8.6	Pass/fail reported without stating how uncertainty was accounted for
Method verification	7.2	A standard method adopted without records showing the lab verified it can achieve the required performance
Internal audit coverage	8.8	The audit program doesn’t cover every clause over the cycle, or findings have no corrective action
Management review inputs	8.9	A meeting happened; the minutes don’t show the inputs the standard lists

Notice how many of these are record failures rather than competence failures: the lab did the work and can’t prove it. That’s the case for keeping the records in a system that creates them as a side effect of doing the work — audit trails, calibration status on every job, training linked to each person — instead of a binder that someone has to remember to update.

After the closing meeting: responding to the report

The deficiency report is normal; a first assessment with zero findings is rare. What the accreditation body is assessing next is how you respond. For each finding:

Correction — what you did about the specific instance (re-calibrated the gauge, withdrew the obsolete revision).
Root cause — why it happened. “Technician error” is almost never accepted as a root cause; “the calibration-due reminder went to a mailbox nobody checks” is.
Corrective action — what changed so it doesn’t recur, with the revised procedure or system change attached.
Evidence — the records showing the change is in place and working.

Watch the deadline from the day of the closing meeting, not the day the written report arrives. A staged corrective action record — problem, impact, containment, root cause, action, effectiveness review — gives the assessor exactly the structure they’re looking for, and the effectiveness review is the step labs most often skip.

Final thoughts

Being well prepared with thoroughly reviewed and organized documentation is the best step you can take for an upcoming assessment. It not only saves you time and money during the visit, it makes your assessors’ job easier and gives them less time to find a deficiency. Your assessors want you to do well, so you’ll do your lab a favor if you make the assessment easy for them. While your lab’s goal may be zero deficiencies, remember that the assessment is an opportunity to improve your quality system, and that a well-handled finding is worth more to your next assessment than a lucky miss.

One thing you can’t do, however much you liked your assessor: hire them. Accreditation bodies prohibit assessors from consulting for the labs they assess, typically with a two-year separation either side, and a lab that engages its own assessor puts its accreditation at risk. Maintain the relationship, ask questions during the visit, and find your consultant elsewhere.

ISO 17025 audit FAQ

How long does an ISO 17025 assessment take?

The on-site portion typically runs one to three days, scaled to the size of your scope and the number of methods to witness. Add the remote document review beforehand and the corrective action cycle afterward, and the whole process from application to accreditation commonly takes three to six months for a lab that is ready, longer for one that isn’t.

Can you fail an ISO 17025 audit?

Findings are normal and don’t mean failure. Accreditation is withheld only if your corrective action responses aren’t accepted by the deadline, or if the assessment finds the lab fundamentally can’t demonstrate competence for the scope. Falsified records or a deliberately hidden problem will end an accreditation faster than any technical gap.

What happens after an ISO 17025 audit?

You receive a deficiency report at or shortly after the closing meeting, submit corrections, root causes, corrective actions, and evidence for each finding within the body’s deadline (A2LA, for example, allows 30 days for the first response), and once those are accepted the accreditation is granted or renewed.

How often is an ISO 17025 accredited lab assessed?

Accreditation runs on a cycle, commonly two years, with a surveillance assessment at roughly the midpoint and a full renewal assessment at the end. Changes to your scope can trigger an extra visit.

Who performs an ISO 17025 audit?

An assessment team from your accreditation body (in the US, bodies such as A2LA, ANAB, and PJLA): a lead assessor for the management system and one or more technical assessors with expertise in your test methods. Assessors are independent of the lab and may not have consulted for it.

How hands-on should an ISO 17025 assessor be?

Expect them to witness tests from start to finish, handle your procedures and records, question technicians directly, and ask for the calibration record of every instrument used. A document-only assessment is the exception, not the rule — the standard is about competence, and competence is demonstrated at the bench.

What is the difference between an internal audit and the accreditation assessment?

The internal audit (clause 8.8) is yours: your own people, or a contractor, auditing your system against the standard on a planned program. The accreditation assessment is the body’s, and it will ask to see your internal audit records. Running the internal audit as a dress rehearsal — same clauses, same records, a witnessed test — is the single best preparation for the real thing.

Make the next one boring

If the records above live in spreadsheets and shared drives, the weeks before an assessment are spent reconstructing them. If they live in a LIMS, they already exist. See how accredited labs use LIMSey to keep calibration, training, document control, corrective actions, and audit trails current between visits, or book a demo and bring your scope.

ISO 17025 Accreditation Audit Tips: How to Prepare for Your Assessment