ISO/IEC 17025 internal audit: programme, checklist and report

The clause itself is only a few lines long. It does not prescribe how often you audit, who audits or which form you use. What it does require is that these decisions are made deliberately, written down and followed:

• Internal audits take place at planned intervals — not only when an external assessment is coming up.
• They answer two questions: does the management system conform to the laboratory's own requirements and to ISO/IEC 17025, and is it effectively implemented and maintained?
• An audit programme exists that defines frequency, methods, responsibilities, planning requirements and reporting — and takes into account the importance of the activities concerned, changes affecting the laboratory, and the results of previous audits.
• Audit criteria and scope are defined for each audit.
• Results are reported to relevant management.
• Correction and corrective actions are implemented without undue delay.
• Records are retained as evidence of the programme and the audit results.

ISO 19011 (guidelines for auditing management systems) is the usual reference for audit methodology. It is not mandatory for ISO/IEC 17025, but auditors trained on it rarely run into questions about method from assessors.

The audit programme is the document assessors ask for first. A simple matrix works well: clauses and test areas as rows, months as columns, with the planned auditor in each cell. Weight it by risk rather than spreading audits evenly.

1. 1

   List everything in scope

   All clauses 4 to 8 of the standard plus every accredited test method or test area, each site and each shift pattern if they differ.

2. 2

   Assess importance and risk

   New methods, new staff, new equipment, complaints, nonconformities and findings from the last external assessment move an area up the list and shorten its interval.

3. 3

   Choose the audit type per area

   Horizontal audits for management-system clauses, vertical audits for test methods, witness audits wherever competence of personnel is the main risk.

4. 4

   Assign auditors

   Auditors should be trained and should not audit their own work. In small laboratories, cross-auditing between teams or an external auditor for the quality manager's own area is a common solution.

5. 5

   Schedule and review

   Spread audits over the cycle so that findings can still be closed before the management review. Update the programme whenever something significant changes.

Vertical audits find the most. Reconstructing a single report often reveals gaps that a document review never would: an instrument used a few days after its calibration expired, a method revision that was not yet released, or raw data that can no longer be found.

Use the questions as a starting point and adapt them to your own procedures — the audit criteria are the standard and your own documented system.

• Impartiality: is the risk register current, and have new risks (new customers, new ownership, bonus schemes) been assessed?
• Personnel: for every person who performed or released a test in the audited period, is there a current authorisation and evidence of competence?
• Equipment: was every instrument used within its calibration interval, and are intermediate checks recorded where the procedure requires them?
• Metrological traceability: do calibration certificates come from accredited or otherwise demonstrably traceable providers?
• Methods: is the version used the currently released one, and is there validation or verification evidence for it?
• Items under test: can receipt, identification, storage and disposal be traced for the sampled items?
• Technical records: can the raw data behind a reported result be retrieved, and do changes to records show who changed what and when?
• Measurement uncertainty: is it evaluated for the method and reported where required?
• Validity of results: are quality control measures and proficiency tests planned and evaluated?
• Reports: do sampled reports contain all information required under clause 7.8, and were amendments issued correctly?
• Complaints and nonconforming work: were they recorded, evaluated and closed with a root cause?
• Previous findings: were corrective actions from the last internal and external audits implemented and verified as effective?

A finding needs three parts to be useful: the requirement (clause or procedure), the objective evidence (which job, which record, which date) and the gap between the two. Findings without evidence are opinions and are hard to act on.

1. 1

   Correction

   Deal with the immediate problem: recall or amend the affected report, quarantine the instrument, re-train the person.

2. 2

   Root cause

   Ask why the system allowed it. "Operator error" is rarely accepted by assessors as a root cause on its own.

3. 3

   Corrective action (clause 8.7)

   Change the system so that the cause is removed, and check whether the same problem can occur elsewhere.

4. 4

   Effectiveness check

   After a defined period, verify that the action worked — for example with a follow-up vertical audit on a new job.

5. 5

   Management review (clause 8.9)

   Summarise audit results, open actions and trends as an input to the management review.

• The programme exists but audits were postponed and not all clauses or accredited methods were covered within the cycle.
• Only document reviews were done — no vertical or witness audits of actual test work.
• Auditors audited their own area without justification.
• Findings were recorded, but corrective actions are still open months later or were closed without an effectiveness check.
• Audit results were never reported to management or did not appear in the management review.

Most of these have the same cause: the evidence needed for a vertical audit is spread across spreadsheets, e-mails and file shares, so each audit takes days. When the job, item, instrument, calibration status, raw data and report are linked in one system, a vertical audit shrinks to a few minutes per job — and far more jobs can be sampled.