ISO 17025 internal audit and management review: how do findings become decisions?

What is a laboratory internal audit?

A laboratory internal audit is a planned examination of how requirements and processes are implemented within a defined scope. Its purpose is to provide useful information about operation and matters needing attention. Before arranging dates, decide what you need to learn: whether processes are followed, a change has been implemented or previous actions have improved practice. ISO 19011 provides general guidance on auditing and audit programmes. Laboratory work also needs to account for ISO/IEC 17025 and the relevant technical activities. Clear objectives make it easier to select evidence and interpret findings in the right context.

How should the audit scope be defined?

The scope identifies the activities, locations, processes or methods to be examined. An audit may cover a broad system or a particular subject, but its place in the overall programme should be understood. For practical planning, collect information on changes, previous findings, complaints and areas requiring closer attention. Use this to set priorities and identify the people to involve. Record the boundaries as well, so readers do not assume that the report covers activities that were not examined. A clear scope helps establish expectations and allow sufficient time for interviews, observations and review of the relevant records.

Who can conduct a laboratory internal audit?

An auditor needs appropriate competence for the work and the ability to evaluate it objectively. An organisation can use suitable employees or external support, depending on its resources and circumstances. Previous involvement in developing or operating a process should be considered when assessing objectivity. This is particularly relevant in smaller laboratories. General quality audit experience may need to be supplemented by knowledge of the technical activities being examined. Ask how the proposed auditor's experience relates to your methods and scope. UKAS offers laboratory internal audit training, illustrating the importance of competence suited to the laboratory context.

Which documents and records should be prepared?

The required material depends on the scope and can include procedures, work instructions, personnel records, equipment information, quality control data and test reports. Select evidence from routine work and make sure it can be located. Records should reflect activities that actually took place; missing information is itself relevant to understanding the system. A useful preparation exercise is to ask process owners which records they maintain and where those records are stored. This also tests the laboratory's ability to retrieve information without depending on a single person who knows the location of every file or the history of every decision.

How can an audit follow laboratory work from start to finish?

Select completed testing or calibration work and follow its route through the system: the customer's request, review of requirements, receipt of the item, method selection, personnel, equipment, controls and the issued result. This helps reveal interfaces between processes. In an illustrative example, the work instruction may be current while the calculation spreadsheet used by the operator still reflects an earlier arrangement. Reviewing each document in isolation may miss that connection. Record why the sample was selected and what conclusions it supports. The evidence should remain understandable to someone who was not present during the audit interviews.

What should a nonconformity finding contain?

A useful finding makes the applicable requirement, examined evidence and observed issue clear. A broad statement such as “documentation is inadequate” may leave the organisation uncertain about what to address. Identifying the record, activity and relevant requirement supports a more focused response. Distinguish a nonconformity from an improvement suggestion and avoid presenting the auditor's personal preference as a requirement. When discussing the finding, confirm that the factual basis is understood. Agreement about the facts does not replace professional judgement, but it reduces later confusion about what was examined and why the auditor reached a particular conclusion.

How should the laboratory respond to a finding?

The response should match the issue and its potential consequences. Consider correction of the observed problem, the reasons it occurred and whether action is needed to reduce recurrence. A laboratory may also need to examine implications for other work or results. As an illustrative example, completing a missing signature in one record does not explain why the review was missed. Assigning an owner and deadline helps organise the work, but the expected result also needs definition. Closing an item in a tracking system should be supported by relevant evidence, rather than simply an assurance that the assigned task was completed.

What is root cause analysis in this context?

Root cause analysis examines how an issue arose and which conditions contributed to it. Instead of stopping at “the operator overlooked it”, consider the instruction, training, workload, availability of information and review arrangements. The depth of the investigation should reflect the significance and risk of the finding. One practical approach is to identify several plausible explanations and assess them against evidence. When an action is selected, explain how it addresses the supported cause. That connection provides a basis for later evaluation and helps determine whether further changes are needed elsewhere in the laboratory's processes or management arrangements.

How can corrective action effectiveness be checked?

Effectiveness review considers whether the action achieved its intended change. After a procedure update, examine whether the revised arrangement is being used. After a control change, review subsequent records and outcomes. The timing should allow suitable evidence to become available while taking the significance of the issue into account. It is helpful to define the review when the action is agreed. A simple tracking record can identify what will be checked, who will assess it and what evidence will inform closure. This turns follow up into a practical activity that can also be explained during a later assessment.

Can an internal audit be conducted remotely?

Some evidence, including documents and records, can be examined remotely under suitable conditions. Observation of practical work, equipment or environmental conditions may require attendance. The decision should follow the audit objectives, evidence needs and ability to obtain reliable information. ISO guidance on remote auditing methods addresses possibilities and limitations. For a mixed approach, agree who will present information, how documents will be identified and how access will be maintained. The selected method should support the audit purpose. Any resulting limitation on the scope or evidence needs to be understood and reflected in the audit record.

What should an ISO 17025 laboratory management review address?

A management review should connect technical and organizational information with decisions on resources, changes, and improvement. Examine findings, feedback, process performance, and earlier actions against the system's applicable requirements. A proficiency testing result may justify revised control arrangements or additional training time. The guide to proficiency testing and interlaboratory comparisons explains how this information can be interpreted in context. Useful minutes identify the decision, responsible person, and review point. Communicate actions to the people expected to perform them and report incomplete work back to management. This gives the review a practical consequence rather than leaving it as a signed record without operational follow-up.

How can internal auditing support reaccreditation or a scope extension?

Adapt the sample to changes since the previous assessment and activities proposed for future inclusion. A new method may require examination of staff, equipment, technical records, and resulting data. The article on ISO 17025 scope extension describes how to organize the relevant evidence. Where measurement conditions have changed, also examine the measurement uncertainty budget and its suitability for current use. Management review can then address readiness and the resources needed to close gaps. Internal auditing provides evidence about the laboratory's position, while the accreditation body retains responsibility for its decision. Clearly distinguish completed actions, actions awaiting effectiveness review, and external approvals that have not yet been issued.

How should your laboratory plan ISO 17025 audit preparation?

Bring together the intended scope, previous findings, recent changes and actions still open. This information supports a focused audit and helps connect it with management review and accreditation preparation. The safety consultant provides laboratory internal audit support and assistance with findings, within an agreed scope and with consideration of objectivity. Work can also be coordinated with outsourced quality management. Contact the safety consultant with your laboratory's circumstances and audit objective to identify the work to be examined, the people to involve and the outputs that will help your team continue improving its system.