Understanding the ISO 17025 Quality Management System, Clause by Clause
· Updated
Most explanations of ISO/IEC 17025 stop at “the standard for testing and calibration laboratories” and a list of benefits. That tells you nothing about Tuesday. If your lab is pursuing accreditation, holding it, or being told by a customer that it needs it, the useful question is narrower: what does the standard actually require us to do, and what records will the assessor ask to see?
This post answers that, clause by clause, for the current edition — ISO/IEC 17025:2017. It covers what changed from the 2005 version (a lot of advice online still uses the old numbering), how 17025 differs from ISO 9001, and where a LIMS does the record-keeping for you. We build a LIMS for in-house engineering and materials test labs, and a good share of our customers are accredited or working toward it, so where LIMSey is the example you can check the claims on our ISO 17025 software page.
What ISO/IEC 17025 is
ISO/IEC 17025 is the international standard for the competence of testing and calibration laboratories. That word matters. ISO 9001 asks whether an organization has a management system that produces consistent output; 17025 asks whether a laboratory can produce technically valid results — and then asks it to prove it, method by method, instrument by instrument, person by person.
Two consequences follow:
- It’s accreditation, not certification. A 9001 certificate says your system conforms. A 17025 accreditation, granted by a body such as A2LA, ANAB, or PJLA in the US, says your lab is competent to perform specific tests listed on a scope of accreditation. Add a test method and the scope has to be extended. (People say “17025 certified” all the time; assessors will gently correct you.)
- It stands alone. Clause 8 of 17025 includes the management-system requirements a lab needs, so you don’t need 9001 first. If you already hold 9001, the standard offers a shortcut, covered below.
Who gets it: commercial testing and calibration labs, because customers require it; and increasingly in-house labs at manufacturers, because an OEM customer, a regulator, or a product-certification scheme says the data has to come from an accredited lab. That second group is who we build for, and it’s who this post is written for.
How the 2017 edition is organized
The 2005 edition had two big buckets: management requirements (clause 4) and technical requirements (clause 5). The 2017 edition reorganized everything into a process flow, so the clause numbers moved. If a checklist you’re using talks about 4.13 records or 5.10 reporting, it’s the old edition.
The current structure:
| Clause | Title | In plain terms |
|---|---|---|
| 4 | General requirements | Impartiality and confidentiality |
| 5 | Structural requirements | Who the lab is, who’s responsible, what it does |
| 6 | Resource requirements | People, facilities, equipment, traceability, suppliers |
| 7 | Process requirements | Everything from the request to the report, plus complaints, nonconformances, and data |
| 8 | Management system requirements | Documents, records, risk, improvement, corrective action, internal audit, management review |
Clauses 1 to 3 are scope, references, and definitions. The requirements start at 4. The rest of this post walks 4 through 8 and, for each, names the records an assessor will ask for — because the assessment is, in practice, a records review with test witnessing on top.
Clause 4: impartiality and confidentiality
4.1 Impartiality. The lab has to identify risks to impartiality on an ongoing basis and show how it eliminates or minimizes them. For a commercial lab that’s about commercial pressure. For an in-house lab it’s sharper: the engineering group that designed the part is often the group requesting the test, and sometimes the group paying for the lab. Assessors will ask how a result that fails is protected from the person who wants it to pass. The honest answer is structural — who can edit a result, who signs it, and whether the record of a change survives.
4.2 Confidentiality. Customer information is protected by legally enforceable commitment, and the lab tells the customer in advance what it will disclose and to whom. In an in-house lab this is mostly about product data that isn’t public yet.
Records: an impartiality risk assessment, confidentiality commitments (contracts, policies, staff agreements).
Clause 5: structural requirements
The lab is a legal entity or a defined part of one; management is identified and has responsibility for the lab; the range of activities is defined and documented (this becomes the scope); and the organization’s structure, responsibilities, and authorities are documented, including who authorizes which activities.
For an in-house lab the structural question that trips people up is the first one: what is “the laboratory”? The standard wants a defined unit with defined management, even inside a company whose org chart doesn’t draw it that way.
Records: organization chart, defined scope of activities, documented responsibilities and authorizations.
Clause 6: resources
This is the first clause with real record volume, and it’s where a lab without a system starts to feel it.
6.2 Personnel. Competence requirements are documented for every function that affects results. For each person, the lab keeps records of the selection, training, supervision, authorization, and ongoing monitoring of competence, and it authorizes people for specific activities — developing or modifying methods, analyzing results, reporting, reviewing. The question the assessor asks in the witnessed test is “show me that this technician is authorized for this method,” and the answer has to be a record, not a shrug.
6.3 Facilities and environmental conditions. Conditions that affect results are monitored, controlled, and recorded, and incompatible activities are separated.
6.4 Equipment. The longest sub-clause, and the one most labs manage worst. Equipment that affects results is calibrated before use where calibration affects validity, labeled with its calibration status, and re-checked on a program. If an instrument is overloaded, mishandled, or gives suspect results, it comes out of service and the lab examines the effect on previous results — the retroactive question every lab dreads. The records (6.4.13) are specific: identity, manufacturer and serial, evidence of verification, location, calibration dates, results, acceptance criteria and due dates, reference-material documentation, the maintenance plan, and any damage, malfunction, modification, or repair.
6.5 Metrological traceability. Results are traceable to the SI through an unbroken chain of calibrations with stated uncertainties — in practice, calibration by an accredited provider, with the certificate on file.
6.6 Externally provided products and services. Suppliers, subcontracted tests, and purchased calibrations are evaluated, approved, and monitored, with records.
Records: training matrix and authorizations per person, environmental logs, the equipment register with calibration history and certificates, impact assessments for out-of-calibration equipment, approved supplier list.
This is where a LIMS earns its keep first. In LIMSey, calibration records carry certificates and expiration dates, an instrument that’s out of calibration is flagged automatically, and when an as-found condition fails, the system traces the jobs and results that used that instrument — the 6.4 “examine previous results” step as a query instead of an archaeology project. Training records link to each staff member, and a revision to a procedure can trigger re-training on it. If you’re starting from spreadsheets, our free training matrix and equipment reference templates cover the 6.2 and 6.4 records.
Clause 7: the process, from request to report
Clause 7 follows a test item through the lab. It’s the clause assessors spend the most time on, because it’s where the witnessed test happens.
7.1 Review of requests, tenders, and contracts. Before work starts, the lab confirms it understands the requirement, has the capability and resources, and that the method is appropriate. Differences between request and contract are resolved before the work begins. The 2017 edition adds the decision rule: when the customer wants a statement of conformity (pass/fail against a specification), the rule for how measurement uncertainty is accounted for has to be agreed up front.
7.2 Selection, verification, and validation of methods. Standard methods are verified before use; non-standard or modified methods are validated, with records of the validation and the performance characteristics obtained.
7.3 Sampling. Where the lab samples, it has a plan and method, and records what was sampled, by whom, and under what conditions.
7.4 Handling of test items. Items are identified unambiguously for their whole time in the lab, their condition on receipt is recorded, deviations are noted, and storage and handling protect them. We wrote this one up in detail in our lab sample tracking guide.
7.5 Technical records. The record of each lab activity has to contain enough information to repeat the activity under conditions as close as possible to the original: results, the report, the date, and the identity of the people who performed each activity and who checked the data. Amendments are traceable to the previous version — original observations and who changed what, and when, are retained. This is the clause that makes an audit trail a requirement rather than a nice-to-have.
7.6 Measurement uncertainty. Evaluated for every measurement, with the contributions identified.
7.7 Ensuring the validity of results. Internal quality control (control charts, replicates, check standards) and external comparison (proficiency testing or interlaboratory comparison), with the data analyzed and acted on.
7.8 Reporting of results. The report contents are enumerated: a title, the lab’s identity, a unique identifier, the customer, the method, the item and when it was received and tested, the results, who authorized the report, and any statements of conformity with the decision rule stated. Amended reports are identified as such and reference the original.
7.9 Complaints. A documented process, with the complainant told the outcome.
7.10 Nonconforming work. When work or results don’t conform, the lab records it, evaluates significance, decides on acceptability, and recalls results if needed.
7.11 Control of data and information management. The lab’s information systems — the standard names laboratory information management systems explicitly — have to be validated for functionality before use, including after software changes; protected from unauthorized access; safeguarded against tampering and loss; maintained; and have failures recorded. Calculations and data transfers are checked. If the system is run off-site by an external provider, the lab still has to ensure the provider complies.
Records: contract reviews per job, method verification and validation files, sample receipt and chain-of-custody records, the technical record for every job with its audit trail, uncertainty budgets, QC and PT data, issued reports, complaint and nonconforming-work logs, software validation and change records.
Here the LIMS stops being a convenience and becomes part of the evidence. In LIMSey, the requester review and lab manager review that 7.1 and 7.8 imply exist as explicit tasks in every job template, so the review happened or the job doesn’t close. Every record change is logged with who, when, and the value before and after (7.5), and since the 41.0 release a mistyped result label on a signed task can be corrected without removing the approvals — with a reason, a signing password where the account requires one, and a permanent record on the job. Reports come out of the recorded results, not a retyped copy. And for 7.11, our security page lists what we do about access, backups, and hosting; the data-security post explains what the clause expects from your data management in more depth.
Clause 8: the management system
8.1 Options. The lab can implement the management-system requirements directly (Option A, clauses 8.2 to 8.9) or, if it already maintains a management system in accordance with ISO 9001 that supports clauses 4 to 7, rely on that (Option B). Most standalone labs take A. An in-house lab inside a 9001-certified manufacturer often takes B and then discovers the corporate system doesn’t actually reach the lab’s records — so read Option B as “your 9001 system has to demonstrably do these things for the lab,” not as an exemption.
8.2 Documentation. Policies and objectives for competence, impartiality, and consistent operation, documented and understood. Note what’s not here: the 2017 edition dropped the requirement for a quality manual. Many labs keep one anyway because it’s a convenient top-level document, which is fine; it just isn’t mandatory.
8.3 Control of documents. Documents are approved before issue, reviewed and updated, identified by revision, available where needed, and obsolete versions prevented from unintended use.
8.4 Control of records. Legible, identifiable, retrievable records, retained for a defined period, protected from loss and alteration.
8.5 Risks and opportunities. New in 2017. The lab considers what could go wrong with its activities and plans actions proportionate to the impact. There’s no mandated method — a register reviewed at management review is a common, acceptable approach.
8.6 Improvement. Opportunities for improvement are identified and acted on; customer feedback is sought and used.
8.7 Corrective actions. When a nonconformity occurs: react, evaluate the cause, decide whether action is needed to prevent recurrence, implement, review effectiveness, update risks, and change the system if necessary — with records of each step. (The 2005 edition’s separate “preventive action” clause is gone, absorbed into 8.5.)
8.8 Internal audits. On a planned program, covering the whole management system over a cycle, by auditors independent of the activity where possible, with results reported and corrections made. Our free ISO 17025 internal audit checklist walks clauses 4 through 8 with plain-language prompts.
8.9 Management reviews. At planned intervals, with a specified list of inputs (audit results, corrective actions, customer feedback, risk results, PT results, resource adequacy, and more) and recorded outputs.
Records: the document register with revision history, the records retention schedule, the risk register, corrective action records through effectiveness review, the internal audit program and reports, management review minutes.
LIMSey handles the record-heavy ones: document control with revisions and classifications, and corrective actions as a staged workflow — problem, impact, containment, root cause, corrective action, effectiveness review — with tasks and approvals at each stage and a printable record for the assessor. The free document library and SOP template are the spreadsheet-era versions.
What changed from ISO/IEC 17025:2005
If your procedures or your consultant’s checklist predate 2018, these are the differences that matter:
- Reorganized by process. Management and technical requirements were interleaved into the clause 4 to 8 structure above. Every clause number changed.
- Risk-based thinking replaced preventive action (8.5), and impartiality got its own risk requirement (4.1).
- Decision rules for statements of conformity have to be defined and agreed with the customer (7.1.3, 7.8.6).
- The quality manual is no longer required (8.2). Documented policies and objectives are.
- Option A / Option B was introduced for labs that already run a 9001 management system (8.1).
- Information systems got explicit requirements, including validation before use (7.11).
- “Laboratory” now includes sampling as an activity that can be accredited on its own.
- Fewer prescriptive details, more “the laboratory shall have a process for” — which puts more weight on the lab’s own judgment and on being able to show how that judgment was exercised.
The 2017 edition was published in November 2017, and accreditation bodies completed the transition in 2021. Everything is assessed against 2017 now.
ISO 17025 vs ISO 9001
A question we get from manufacturers whose corporate quality group already holds 9001:
| ISO 9001 | ISO/IEC 17025 | |
|---|---|---|
| What it covers | Any organization’s quality management system | Testing and calibration laboratories specifically |
| What it demonstrates | A system that produces consistent, conforming output | Technical competence to produce valid results for specific methods |
| Outcome | Certification | Accreditation, with a scope listing the tests covered |
| Who assesses | A certification body | An accreditation body (in the US: A2LA, ANAB, PJLA, and others), with technical assessors who know your methods |
| Technical content | None — it doesn’t care what you make | Calibration, traceability, uncertainty, method validation, PT, report contents |
| Relationship | — | Includes its own management-system clause (8); a 9001 system can satisfy it under Option B |
The short version: 9001 says the organization is run well; 17025 says this lab’s numbers can be trusted for these tests. A customer who asks for “accredited test data” means 17025.
Where a LIMS fits, and where it doesn’t
A LIMS doesn’t make a lab competent, and no assessor will accept “we have software” as evidence of anything. What it does is turn the record-keeping clauses — 6.2, 6.4, 7.1, 7.4, 7.5, 7.8, 7.10, 8.3, 8.7 — into side effects of running the lab, so that the records exist because the work happened, not because someone remembered to write them down afterward. For an in-house test lab with no quality staff, that’s the difference between an audit week spent demonstrating tests and one spent hunting through shared drives.
What it still won’t do: evaluate your measurement uncertainty, validate your methods, run your proficiency testing, or define your decision rules. Those are the lab’s own competence, which is the whole point of the standard.
If you want to see the clause-to-feature mapping in one place, the ISO 17025 software page has it as a table. If you’re preparing for your first assessment, our audit tips post is the practical companion to this one.
ISO 17025 FAQ
What is ISO/IEC 17025?
ISO/IEC 17025 is the international standard that specifies the general requirements for the competence, impartiality, and consistent operation of testing and calibration laboratories. Labs are accredited to it by national accreditation bodies for a defined scope of tests. The current edition is ISO/IEC 17025:2017.
Is ISO 17025 a certification or an accreditation?
Accreditation. A certification body certifies a management system (as with ISO 9001); an accreditation body assesses a lab’s technical competence and grants accreditation for a specific scope of tests or calibrations. “ISO 17025 certified” is common shorthand, but the correct term is accredited.
What are the main requirements of ISO 17025:2017?
Five requirement clauses: general (impartiality and confidentiality), structural (the lab’s organization and responsibilities), resource (personnel, facilities, equipment, traceability, suppliers), process (contract review through reporting, plus complaints, nonconforming work, and data control), and management system (documents, records, risk, improvement, corrective action, internal audit, management review).
What is the difference between ISO 17025 and ISO 9001?
ISO 9001 covers any organization’s quality management system and demonstrates consistent output. ISO 17025 is specific to laboratories and demonstrates technical competence to produce valid results for named methods. 17025 contains its own management-system requirements, so a lab doesn’t need 9001, though an existing 9001 system can satisfy clause 8 under Option B.
Does ISO 17025 require a LIMS?
No. The standard requires records and controls; it doesn’t prescribe how they’re kept. Clause 7.11 does set requirements for any information system a lab uses — validation before use, protection from unauthorized access and tampering, backups, and recorded failures — so if you use a LIMS, it has to meet those.
Does an in-house test lab need ISO 17025?
Only if a customer, regulator, or certification scheme requires accredited data — which is increasingly common for OEM suppliers and product-certification testing. Many in-house labs run to the standard without seeking accreditation, because the record discipline is worth having on its own and keeps the option open.
How long does ISO 17025 accreditation take?
Typically six to eighteen months from a standing start, most of it spent building records: method validation, uncertainty budgets, calibration history, training records, and at least one internal audit and management review before the accreditation body’s assessment. Labs that already keep those records in a system move faster.
See the records before your assessor does
If your lab is working toward 17025 or getting ready for a reassessment, book a demo and bring your scope. We’ll walk the clause table with your methods and show you what each record looks like when the system keeps it for you.