Mandatory Records For ISO 17025-2017-Ishan-Shashi
Mandatory Records For ISO 17025-2017-Ishan-Shashi
Some of the changes to the older 2005 version, such as the new structure and the
less prescriptive nature of the 2017 standard, are in keeping with changes to other
ISO standards, and with the objective to closer align it to the ISO 9001:2015
standard. In this article, you’ll find a brief ISO/IEC 17025:2017 vs. ISO/IEC
17025:2005 comparison.
Change in the structure
The revised structure split the previous two main clauses 4 and 5 (Management and
Technical Requirements) into a more logical flow of requirements, across five
clauses (4 to 8). These emphasize the process approach encouraged by ISO. Two
Annexes are available, one on Metrological Traceability and the other providing an
explanation on the options to integrate an ISO 9001 management system.
Clause 4 deals with General Requirements, especially with regard to impartiality and
confidentiality.
Clause 5 deals with Structural Requirements, i.e., the organizational structure of the
laboratory.
Clause 8 deals with Management System Requirements, i.e., quality procedures.
Clauses 6 and 7 in the 2017 standard contain most of the Technical Requirements of
the older standard, with a few Management Requirements thrown in. These technical
clauses are arranged to flow naturally with the process of testing or calibration within
a laboratory.
Clause 6 deals with Resource Requirements, the inputs to the testing or calibration
process that impact the laboratory’s ability to consistently and competently provide its
services.
Clause 7 contains the Process Requirements, flowing from the receipt of the request
for sampling, testing, or calibration to the issue of the report and any complaints and
nonconforming work arising.
The ISO/IEC 17025:2017 standard gives laboratories the flexibility to develop their
management system as they see fit, as long as they are able to provide evidence
that they have met the requirements and can consistently apply and follow their
chosen process. Overall, the 2017 version of the standard is more risk-based and
less procedure-based. For example, the 2005 standard required a Quality Manual
and procedures for document control and internal audits, whereas the newer version
does not strictly call for them.
The definition of a laboratory has also been broadened in the new version of the
standard. Previously, the standard was applicable to testing and calibration
laboratories, but the newer version allows for organizations that conduct sampling for
subsequent testing (at their own facilities or others) to also obtain accreditation for
this activity.
A lot has changed in terms of information technology since 2005. The newer version
of the standard acknowledges these changes and recognizes that processes,
reports, and records may now be electronic-based.
Risk-based approach
Similar to ISO 9001 and other Quality Management Standards, the new version of
the ISO/IEC 17025 standard takes a risk-based approach. Previously, there was a
section on preventive action, which required the laboratory to consider possible risks
before a nonconformity occurred. The term “preventive action” has now been
removed, but laboratories are required to consider both risks and opportunities
associated with their activities and take appropriate action. Risks to impartiality must
also be considered.
Decision rule
The final new addition to the standard to be discussed is the application of the
decision rule to statements of conformity. The laboratory must document and state
its decision rule and apply it when determining if test results conform to a
specification or standard. The decision rule must consider the level of risk of falsely
accepting or rejecting a result, as well as the measurement uncertainty of the result,
before reporting whether or not it conforms to the specification.
Although most people are not fond of change, the modifications to the ISO/IEC
17025 standard should not be too difficult for laboratories to implement and are
actually meant to introduce greater flexibility. Additionally, due to the recognition that
important decisions are made based on test results, there is a greater focus in this
revision on ensuring that laboratories can produce valid and reliable results.
Six key benefits of ISO 17025 implementation
Testing is used in many industries, but offering testing as a professional service
requires that any type of measurement, sampling or calibration laboratory pass
through the process of accreditation. When it comes to the accreditation, the
company is obligated to show conformity to the ISO 17025 standard. Compliance
with the ISO 17025 standard assures that required competence and quality are
added to the company’s profile. Managing the testing laboratory is an internal
company process that should rely on a solid foundation. In this article you will find
the main benefits of ISO 17025 implementation.
Implementing ISO 17025 will enable a hierarchical order and clear job
responsibilities for all the employees. Procedures and policies that the laboratory
establishes will determine which actions are required from the personnel. They will
follow established procedures, policies and work rules, and will fulfil the company’s
expectations. As a result, internal company management will become more
achievable and it will improve the chances for the systematic reduction of errors
through risk management. Laboratory employees will also perform their jobs more
responsibly, opening the path to successful personal development. These efforts for
the promotion of a professional approach will significantly increase the chances of
the company becoming more competitive and promoting their services as valid and
reliable.
An ISO 17025 laboratory will assist customers by attending to any questions related
to the test process and their expectations of the results. Laboratory management
must be confident that customer relations are managed and that there is space for
building trust through customer feedback. The client has a trusted business
relationship when the laboratory is committed to confidentiality and does not share
information about results with the public, except when there is an agreement from
the customer for the laboratory to do so. Also, there is an option for the customer to
express concerns about the laboratory’s work. Of course, the laboratory will confirm
that it has received such concerns; it will investigate it and will inform the customer
regarding progress and final decisions.
3) Competence demonstration
Competency assessment ensures that only trained, skilled and authorized staff can
perform laboratory tasks. To present its competence, the laboratory has to
successfully execute the technical test procedures. The personnel must prove they
know how to follow procedures and handle any problems that may arise during the
activities. Demonstration of competence provides assurance that the laboratory test
will be valid. If all the processes inside the laboratory are managed and validated
then the reputation of the laboratory will be sustainable.
4) An iterative process of management
The ISO 17025 standard provides options for iterative management of the processes
in the laboratory. The process is repeatable driving improvement and reducing
complexity. Quality management of the processes can be used as a method for
improvement in the laboratory work, employee work attitude and their improvement
of skills. It also promotes the relevance of the final report and detection/avoidance of
calculation or system errors.
An accredited laboratory submits final reports to customers, where the results are
used as the basis for a decision, or to verify conformity to a specification. As there is
natural variation in results due to the nature of testing, controls are in put in place to
reduce this range of variation in an ISO 17025 laboratory. Evaluation of this
measurement uncertainty is done to support the validity of the assertion. The final
report must provide the necessary information and be accurate, showing that the
laboratory has a proven reputation that it stands behind.
Accredited ISO 17025 laboratories follow changes to ISO 17025 and, if there is
need, improvements are initiated, and corrective actions are taken. Skilled laboratory
personnel might promote new testing methods or improve existing ones. In this way,
the laboratory is able to upgrade or introduce new services through a planned
approach that involves personnel working on building laboratory expertise.
Mandatory records for ISO 17025:2017
Records are generated to demonstrate compliance with the standard and related
internal procedures and serve as evidence during audits. Here are all the required
records according to ISO 17025:2017:
The documents listed below are must-haves according to ISO 17025:2017. Keep in
mind that if you exclude some of the clauses from the scope of your implementation,
then documents for those clauses will not be required for your lab.
Document and Record Control Procedure (Clauses 8.2.1, 8.3 & 8.4)
Quality Policy (Clauses 8.2.1 & 8.2.2)
Competence, Training and Awareness Procedure (Clause 6.2.5)
Externally Provided Products and Services Procedure (Clause 6.6.2)
Facilities and Environment Procedure (Clause 6.3)
Equipment and Calibration Procedure (Clauses 6.4.3 & 6.5)
Customer Service Procedure (Clauses 7.1.1 & 8.6)
Test and Calibration Method Procedure (Clauses 7.2.1 & 7.2.2)
Quality Assurance Procedure (Clauses 7.7.1 – 7.7.3)
Sampling Procedure (Clauses 7.3, 7.5 & 7.8.5, applicable only to laboratories
that do sampling)
Handling of Laboratory Test or Calibration Items Procedure (Clause 7.4)
Complaint, Nonconformity and Corrective Action Procedure (Clauses 7.9 –
7.10 & 8.7)
Testing Report Procedure (Clauses 7.8.2 & 7.8.3, applicable to testing
laboratories that write test reports)
Management in laboratories according to ISO 17025:2017
Option A or Option B?
The ISO 17025:2017 standard now provides two possible options for managing the
quality management requirements in the laboratory: Option A and Option B, as per
clause 8.
The decision to implement in accordance with Option A or B must be based on the
current structure of the company’s laboratory in its overall business management
systems. It may be advisable to integrate the laboratory documentation with the likes
of ISO 9001:2015 documentation if the company has already transitioned to meet
the principles and requirements of the latest ISO 9001, ISO 14001, and/or ISO
45001 standard. This reason for offering the options is due to the similarity of
documents required by the above standards. When Option A is chosen, all eight
sections of the ISO 17025:2017 standard should be implemented as a stand-alone
system.
This integration means that the company will be implementing in accordance with
Option B of ISO 17025:2017 and will align their Quality Management System for the
laboratory with their current business management process documentation. For
example, both ISO 9001:2015 and ISO 17025:2017 require document control,
control of records (called “documented information” in the latest versions of the
standards), improvements, internal audit, and management review as per the
requirements of the ISO 9001 standard and its high-level structure. Then, aligning
the company’s document control system to one integrated document control system
just makes sense. Of course, this decision will mean some extra work and planning,
because achieving one set of documentation for the company can be challenging.
Even so, it is advisable to do this, as the above will help with the maintenance and
improvement of the laboratory’s documentation and the overall system. As per
Annex B of the ISO 17025:2017, however, companies should remember that
conformance to the ISO 9001 requirements does not mean that the laboratory is
producing technically valid data and results – only that the company is adhering to
the overall management system requirements of ISO 9001. Technically valid data
needs to be achieved by adhering to sections 4 through 7 of the ISO 17025:2017
standard and objective evidence must be provided to show the competency of the
laboratory to be impartial and operate consistently.
There are also several new requirements to be addressed – for example, what
actions are being taken to address risks and opportunities? How do you control data
and information management? There is a need to show risk-based thinking and the
use of a process approach to drive improvement. A tall order? The question is how
do you implement, show objective evidence of compliance, maintain and improve
these processes?
When asked by management how we would maintain these systems (ISO 9001, ISO
14001, and ISO 17025), my answer was simple. Firstly, we would ensure that our
quality objectives and scope of activities were defined. Secondly, we would make
sure that responsibilities and authorities were assigned to the personnel responsible
for the different laboratory activities. They would be accountable for monitoring and
evaluating these measurable objectives. Take, for example, the number of tests
conducted in a month, or reducing the number of nonconforming events or
complaints for the month. The laboratory management would evaluate the
monitoring trends and provide feedback to top management and personnel at the
end of each month. This way, we would ensure that the system is maintained by the
process owners, rather than falling into the lap of one individual.
To get the best value out of your ISO 17025 system, you need to know the
requirements and current shortfalls (gaps), appoint the correct personnel in the
correct positions, and ensure that all objectives and targets are measurable and
known by the process owners. As implementing ISO 17025:2017 takes effort and
resources, make sure the objectives and risks are clear for all participants and
constantly monitor the progress. If the above is followed, ISO 17025:2017
implementation will be smooth sailing!
The laboratory risk management process
Risk can be defined as uncertainty of the laboratory to meet its objectives, such as
customer satisfaction. Nevertheless, uncertainty can be negative (risk) or positive
(opportunity). Learn about the five steps in the laboratory risk management process
below.
The ISO/IEC 17025 risk management process should be considered a team effort,
comprising management, quality personnel and technical staff. In this step, all the
potential problems and opportunities that can arise from laboratory activities must be
listed. The following methods are useful at this stage and can be used individually or
in combination:
Process approach: It considers both internal and external influences. Sources are
considered by reviewing the inputs and outputs to the process/activity, including
management, methods, manpower, materials, machinery and the environment.
At this stage, all parties should agree on which ranking of risks is the best, to
determine which is to be addressed first, then second, and so on. Rankings may be
based not only on the calculated or assigned risk value but also availability of
resources and the costs to address the risk.
The team will have to recommend and decide on the actions to be taken to address
the risks and opportunities identified. Actions can range from taking measures to
reduce or eliminate the risks to doing nothing because the chance of the risk
happening is so low. Not all risk analysis needs to result in risk-reduction actions.
The team may choose to tackle the easier issues first in order to cross them off the
list, but issues which may result in critical risk to the laboratory should not be placed
on the back burner.
The purpose of including the impartiality clause is not only to safeguard the validity of
test results or calibration results. The objective is to avoid conflicts of interest and
ensure that the management structure, the use of resources, and the execution of
processes are implemented and maintained in a way to avoid any compromising
situations or actions.
Compromising situations are any situations that could result in a conflict of interest,
prejudice, favouritism, one-sidedness, favour, or bias, and that could result in the
laboratory not functioning optimally. The impact could be that policies and objectives
are made vulnerable, where they would either be damaged (for example, reputation)
or weakened (requirements likely to not be met).
Use engaging team role playing or case studies to illustrate the impact on the
laboratory and personnel themselves.
Asking personnel to sign a declaration or code of conduct is one action, but not the
only action to take. Commitment does not guarantee compliance. Risks to
impartiality must be identified on an ongoing basis during routine laboratory
activities. This is important as there are ongoing changes to operations, for example
taking on new customers, external providers, and personnel, which may result in a
new or changed level of risk.
Add the following question to your internal audit criteria for each audit: “What
controls are implemented to safeguard impartiality of this activity?” Look for
evidence that controls are effective, e.g., review nonconforming events and
corrective actions, as well as handling of complaints.
Interview personnel to see if the level of awareness is acceptable.
Review the risk register regularly and update it based on current operations.
Ensure that impartiality is given sufficient consideration during management
review.
Checklist of ISO 17025 implementation steps
If your organization is seeking to adopt ISO 17025 in your laboratory environment, the
looming question(s) are likely some of the following: How do we get there? What do
we need to do? Are we prepared? What steps should be taken? How much money
will this cost us? How long will the process take? While the answer to each of those
questions is likely an article within itself, we will provide you with a few steps to help
guide your implementation of ISO 17025. See the ISO 17025 implementation
checklist further in text.
Let’s consider a total of 11 critical steps that can be populated into a checklist format
to help guide your thoughts as you prepare for implementation of ISO 17025.
Establishing effective communication channels with stakeholders is critical before
initiation of any of the steps listed.
2) Determine the context of the Organization. What will be the extent of your daily
operations as it relates to ISO 17025? What testing methods will be within the scope
of accreditation? Who will be your customer? Spend some time identifying what will
be applicable to the ISO 17025 accreditation.
4) Address Risks and opportunities. Risks and opportunities are areas that could
potentially directly harm the organization, its reputation, customer engagement, or
staff members. Once risks are identified, you want to take the time to identify
mitigation steps needed (e.g. how to lessen the chance of this risk becoming a
reality). The areas that you can improve become opportunities. Evaluate current
activities and determine what more could be done to lessen any identified risks.
Decide how you will manage risks that cannot be mitigated.
7) Perform Training and Awareness programs. All staff should be educated about
ISO 17025, but they should also be educated on what is expected of them. When
change is on the horizon a need for an information exchange is inevitable. Be sure to
highlight the changes that will be applied to daily activities. Awareness programs can
come in the form of committees or small groups that will help spread coming
expectations.
9) Operate the LMS. The Laboratory Management System as defined by the quality
objectives and procedures is the core of all operations surrounding daily activities.
Once the LMS is established you will want to keep staff educated on the
requirements and review associated records to ensure the system is working as
intended.
10) Conduct Internal audits. Internal audits should be used to evaluate the quality
management system against the requirements of the standard and against the
standard operating procedures that have been generated. Staff should be aware of
the intent of internal auditing practices and their established frequency.
11) Management review. The frequency of these reviews is defined by your
organization. The content within the management review should effectively address
resources, risks and opportunities, non-conformance and all aspects of the
management system functionality.
If your organization has implemented all 11 preceding steps, you are ready to
prepare for the accreditation assessment – the opportunity to demonstrate the
competence of your laboratory in providing quality testing or calibration services. In
preparation, perform a final review of day-to-day operations, ensure records are
effectively documented, communicate with staff and help them understand that the
audit is simply a part of the process. All elements of a quality management system
are likely to be evaluated during this time. Open lines of communication, scheduling,
and rallying stakeholders will be adequate preparation for a successful audit.
TUR Calculation Example
Using a real-life example, let's walk through the formula.
Example: Our customer sends us a 10,000 lbf load cell with an accuracy specification of ±
0.05 % of full scale. We use a Morehouse Universal Calibrating Machine to perform the
calibration. When 10,000 lbf is applied, the unit reads 10,001 lbf. The display reads by 1 lbf.
The device is a 10,000 lbf load cell with an accuracy specification of ± 0.05 %
CMC
CMC is the uncertainty at the calibrated force. We used a Morehouse Universal Calibrating
Machine, which achieved an uncertainty of 0.02 % at 10,000.
The CMC is 10,000 * 0.0002 = 2 lbf
By dividing the CMC by 2, we reduce to standard uncertainty. In most cases, the CMC
uncertainty component is reported at 95 %, and a coverage factor close to 2 is used.
Resolution UUT
Resolution UUT for force instruments is calculated by dividing the force applied by the output
at capacity and then multiplying this by the instrument's readability.
The 1 lbf resolution is often divided by the square root of 12, two times the square root of 3.
Reducing the resolution to a standard uncertainty typically is done via a rectangular
distribution (square root of 3) or two times two times the square root of 3. Most distributions
are rectangular, and since the resolution on a digital indicator has an equal probability of
being between -0.5 lbf and +0.5 lbf, we have no way of knowing what the underlying value is
and must assume the value is within ± 0.5 lbf. Thus, we will have an uncertainty of ± half the
change represented by what our display reads. To get the standard uncertainty in this
scenario, we can either take half the resolution 0.5 and divide by the square root of 3 or
divide 1 by the square root of 12.
Repeatability
Here is where things get a little tricky. How well does the unit repeat in the test scenario?
You can remove the repeatability contribution to CMC in the formula and substitute the
repeatability of what is being calibrating, but only if the device is similar to devices used for
repeatability used to calculate the CMC. You can decide not to take repeated measurements
on the instrument submitted for calibration. For our example, we will take five replicate
readings and not recalculate our CMC.
To obtain repeatability, we apply 10,000 lbf to the Unit Under Test (UUT) five times and
take the standard deviation of that number.
The Excel formula is STDEV (10,000, 10,001, 10,000, 10,001, 10,001) = 0.54772
The divisor for taking a series of repeated measurements is often considered a normal
distribution with a divisor of 1.
We now take our specification of 10 lbf and divide it by the 2 * k at 95 % Calibration Process
Uncertainty, which we are using 2 for
TUR = 2.1256