← labkitpro.com Academy

Academy › Practical guides › Laboratory accreditation

How to pass an ISO/IEC 17025 on-site assessment: what the assessor actually traces

Assessors do not read your manual from cover to cover. They pick one issued report and walk the evidence chain backwards and forwards.

Updated 13 November 2026 · 9 min read · Written for working labs and quality teams

Six things that must already be true before the visit

1. One complete self-check cycle is closed. An internal audit covering the full clause set (8.8) and a management review (8.9) with defined inputs and evidence behind each input — not minutes that just list topics.
2. The scope is frozen and honest. Every method/matrix/measurand on the accredited scope has validation or verification evidence behind it (7.2), and the scope on the application matches what the lab actually reports.
3. Methods are confirmed for your lab. A published standard method still needs verification that your people, your instruments and your matrix can achieve its performance (7.2.1.3). Non-standard, modified or lab-developed methods need validation with parameters appropriate to the intended use (7.2.2).
4. Uncertainty budgets exist per measurand, and the decision rule is documented. Clause 7.6 requires evaluation of measurement uncertainty; 7.8.6 requires a documented decision rule whenever a statement of conformity is reported, agreed with the customer at contract review (7.1.3).
5. The traceability chain is actually checked. It is not enough to hold an accredited supplier's calibration certificate (6.4 / 6.5). Someone must verify the chain to SI, the stated CMC, and that the certificate's validity covers the measurement date.
6. Competence is authorised at scope level, and PT outliers are acted on. The signatory on a report must be authorised for that exact method and matrix (6.2), with ongoing monitoring. An unsatisfactory proficiency-testing or interlaboratory-comparison result with no documented investigation is one of the most frequent findings under 7.7.

What actually happens on the day

Practical note. The witness test is where a polished document set collapses. If the technician reaches for a sticky note with the "real" procedure on it, the documented method is not the method — that is a finding regardless of how good the file looks.

The vertical trace, step by step

Ask one of your own people to do this drill before the assessment. Hand them a report issued last month and have them produce, within ten minutes:

1. The request / contract review that agreed the method and any decision rule with the customer (7.1).
2. Sample receipt, condition and identification records (7.3 / 7.4).
3. The exact method version in force on that date, plus its verification/validation file (7.2).
4. The technical record with original observations, corrections and the person who made them (7.5).
5. Calibration status and traceability evidence for every instrument used (6.4 / 6.5).
6. The uncertainty budget that produced the reported uncertainty (7.6) — including where each component came from.
7. The documented decision rule if a conformity statement appears (7.8.6).
8. The authorisation record of the person who released the report, for that method and matrix (6.2).
9. The QC / PT evidence showing the result was valid on that day (7.7).

Practical note. If any link takes twenty minutes to find, the assessor will notice. The usual failures are not missing documents — they are documents that do not connect: a signatory authorised before a method revision, an uncertainty budget that does not match the report template, a calibration certificate that was never confirmed on receipt.

Which clause numbers generate the most findings

Two housekeeping facts worth keeping straight: the current standard is ISO/IEC 17025:2017 — there is no 2025 edition, whatever a reseller's headline says. And on 1 January 2026 Global ACI replaced IAF and ILAC as the single international accreditation organisation; legacy documents are being republished under Global ACI numbering. Check the current document list of your own accreditation body rather than quoting an old ILAC-Gx reference from memory.

• 6.2 / 6.4 / 6.5 — competence and authorisation at scope level; equipment fitness; an unexamined calibration chain.
• 7.2 — a validation file that proves the technique works, but not for the matrix and concentration range the lab reports against.
• 7.6 / 7.8.6 — an uncertainty budget copied from the calibration certificate; a pass/fail statement with no documented decision rule; a report showing "±" without stating k or the coverage level.
• 7.7 / 8.8 / 8.9 — a single unsatisfactory PT result with no investigation; internal audits scheduled by calendar rather than risk; management review inputs without evidence.
• 8.5 / 8.7 — a static risk register that is never re-evaluated after a corrective action, and corrective actions closed with "staff retrained" and no effectiveness check.

After the closing meeting

Findings are raised against a clause with objective evidence. For each one: contain the immediate effect, establish the root cause (including whether other reports or scopes are affected), correct the specific case, then verify effectiveness — with a defined review date. Your accreditation body sets the response window, often 30–90 days depending on severity. "We fixed the typo" closes a typo, not a system weakness; an assessor will re-open a finding whose root cause would let the same error happen again on a different report.

Where this goes wrong in practice

Rewriting the quality manual the week before the visit. The manual is not what gets assessed; the evidence chain is.

Treating "we use a standard method" as an exemption from verification. 7.2.1.3 still asks you to confirm you can achieve the method's performance in your own lab.

Letting the authorisation matrix be current at role level but stale at scope level — a signatory authorised before a method revision, or whose ongoing monitoring has lapsed.

Quoting the calibration certificate's expanded uncertainty U as if it were the whole uncertainty budget, or using it as a standard uncertainty without dividing by the stated k.

Filing an unsatisfactory PT result with a one-line "investigated, no impact" note and no root-cause or trend analysis.

Frequently asked

Is a quality manual required for ISO/IEC 17025:2017?
No. The 2017 edition sets out requirements for the management system under option A (or option B if you operate a management system per ISO 9001), but it does not mandate a document called a quality manual. Many labs keep one because customers or legacy contracts ask for it.

What is a decision rule and when do I need one?
A decision rule describes how measurement uncertainty is taken into account when stating conformity to a specification (clause 7.8.6, defined in 3.7). If your report says pass/fail, in-tolerance, or compliant, the rule must be documented, agreed with the customer (7.1.3) and communicated. If you only report a value and its uncertainty, no conformity statement is being made.

How long does an on-site assessment take?
It depends on the scope, number of methods, sites and technical assessors — from a day for a narrow scope to a week or more for a multi-discipline lab. What matters is that each method on the scope can be witnessed or traced; ask your accreditation body for the assessment plan in advance.

Can remote or hybrid assessment be used?
Many accreditation bodies permit some document review or interview activity off-site under their own rules and the current Global ACI transition documents, but witnessing technical activities normally requires an on-site presence. Confirm the arrangement in writing with your accreditation body.

LabKitPro guides are written from published standards and accreditation-body documents — references, clause numbers and paraphrased intent only, never verbatim standard text. They are for preparation and study, not a certification or accreditation decision, and not legal advice. ISO standards are trademarks of ISO; IATF 16949 is published by the International Automotive Task Force and is not an ISO standard. The current laboratory standard is ISO/IEC 17025:2017; there is no 2025 edition. Global ACI replaced IAF and ILAC on 1 January 2026.

Academy by standard · All practical guides · Free browser tools