A thorough internal audit against ISO/IEC 17025 is the single most reliable way to find gaps before an accreditation body assessor does. This checklist organizes the key checkpoints by section so your team can work through them systematically — and walk into your assessment with confidence.
Quick start: Download our free ISO/IEC 17025 checklist for a printable, field-ready version you can mark up during your internal audit.
Why Internal Audits Matter
Accreditation assessors don’t just review paperwork. They observe work in progress, interview staff, and trace evidence chains from a raw measurement all the way to the final report. An internal audit run the same way — with real evidence, not self-certification — surfaces the gaps that matter most.
Labs that skip or rush internal audits tend to receive the most nonconformities during their assessment. The corrective action cycle that follows can add months to the accreditation timeline and, in some cases, require a second on-site visit. Investing time in a rigorous internal audit now is far cheaper than either of those outcomes.
Section 1: Impartiality and Confidentiality
- Has the lab documented its analysis of impartiality risks, including pressures from parent organizations, affiliated businesses, or client relationships?
- Is there a process for identifying new impartiality risks as the lab’s scope or structure changes?
- Do client agreements include confidentiality provisions, and are staff aware of what information can and cannot be disclosed?
- Are external communications (reports, marketing, client portals) reviewed to ensure they don’t imply accreditation for activities outside the approved scope?
Section 2: Structure
- Is the lab a legally identifiable entity with documented authority to conduct laboratory activities?
- Is the accreditation scope clearly defined in writing and communicated to all relevant personnel?
- Are roles and responsibilities documented, including who is authorized to issue reports and certificates?
- Is there a documented mechanism for the lab to operate free from undue commercial, financial, or other pressures on its technical decisions?
Section 3: Resources
Personnel Competency
- Are competency criteria defined for every role that touches laboratory activities (sampling, testing, calibration, validation, reporting)?
- Does each staff member have a training and competency record that is current?
- Are personnel formally authorized — in writing — for the specific activities they perform?
- Is there a process for monitoring ongoing competence (not just initial qualification)?
- Are contract and temporary staff held to the same competency standards as permanent employees?
Facilities and Environmental Conditions
- Are environmental monitoring records current for all parameters that affect result validity (temperature, humidity, cleanliness, vibration, electromagnetic compatibility)?
- Is there a defined response procedure when environmental conditions fall outside acceptable limits?
- Are areas that could affect result quality physically separated or access-controlled?
Equipment
- Does every item of equipment have a unique identifier and a calibration or verification record?
- Are current calibration certificates on file for all reference standards and measuring instruments?
- Is metrological traceability documented for each calibration chain, including stated uncertainties?
- Is out-of-service equipment labeled and physically segregated?
- Are equipment maintenance records up to date?
Externally Provided Products and Services
- Is there a procedure for evaluating and selecting external service providers (calibration labs, subcontractors, reagent suppliers)?
- Are incoming materials (reagents, consumables, reference standards) verified before use?
- Are subcontracted testing activities disclosed to clients, and is the subcontractor’s accreditation verified?
Section 4: Processes
Methods and Validation
- Is there a documented process for selecting methods appropriate to the client’s needs?
- For standard methods: is there on-file evidence that the lab verified it can achieve the published performance characteristics in its own environment?
- For non-standard or in-house methods: is a full validation report on file covering accuracy, precision, linearity, detection limits, and measurement range?
- Are method deviations (amendments, modifications) documented and authorized before use?
- Are methods reviewed and updated when new versions are published?
Technical Records
- Are observations and raw data recorded at the time they are made — not reconstructed after the fact?
- Do records include the identity of the person performing the work and the date?
- Are electronic records protected against unauthorized alteration, with audit trails enabled?
- Is there a defined retention period for all record types?
Measurement Uncertainty
- Is there a documented procedure for estimating measurement uncertainty?
- Has measurement uncertainty been calculated for every method within the accreditation scope?
- Is uncertainty reported on test reports and calibration certificates, or is there a documented reason for omission?
Quality Control and Validity of Results
- Is there a quality control plan that specifies which QC checks apply to which methods (blanks, duplicates, spikes, reference materials)?
- Is the lab enrolled in relevant proficiency testing (PT) programs?
- Are PT results reviewed, and are action plans documented when performance is unsatisfactory?
- Is there a process for detecting trends in QC data and initiating action before results fall out of control?
Reporting
- Do all reports and certificates include the required elements: date, method reference, results with units, measurement uncertainty, and identity of the issuing lab?
- Is there a procedure for issuing corrected or amended reports, including how clients are notified?
- Are reports reviewed and authorized before release?
Section 5: Management System
- Is there a current quality policy signed by top management?
- Are all procedures required by the standard documented, controlled, and accessible to staff?
- Is there a document control procedure that tracks current versions and prevents use of obsolete documents?
- Is the internal audit program on schedule, with records of audits conducted, findings raised, and corrective actions closed?
- Is management review performed at planned intervals, with records showing inputs reviewed and decisions made?
- Is there a corrective action procedure that addresses root cause — not just the symptom?
Common Findings to Watch For
These are the nonconformity categories that accreditation bodies cite most frequently:
- Measurement uncertainty not estimated or not reported — Often overlooked for routine methods or dismissed as “too complex.” It is a hard requirement.
- Personnel authorization records missing or out of date — Competency records that stop at onboarding don’t satisfy the ongoing monitoring requirement.
- Calibration traceability gaps — A calibration certificate that doesn’t show an unbroken chain to SI units or state the uncertainty of the calibration will trigger a finding.
- Method verification evidence absent — Many labs adopt a published standard method but never document that they verified it in their own facility.
- Internal audit findings left open — Auditors will check whether previous audit nonconformities were actually closed with evidence, not just marked complete.
Preparing Your Evidence Package
For each item in this checklist, gather the actual document or record — not a description of what you intend to do. Assessors will ask to see:
- Calibration certificates with stated uncertainties
- Signed personnel authorization forms
- Completed method verification or validation reports
- Proficiency testing results and any corrective actions
- Internal audit reports with finding closure evidence
If gaps remain after your internal audit, the ISO/IEC 17025 template kit provides ready-to-adapt procedures, forms, and a quality manual framework designed around the current version of the standard.
Note: Documentation templates and checklists support your preparation — they do not by themselves grant accreditation. Your accreditation body conducts the formal assessment and makes the accreditation decision.
Frequently Asked Questions
How often should a lab conduct internal audits? The standard requires audits at planned intervals — which in practice means at least annually for the full scope. High-risk areas or methods with recent changes may warrant more frequent partial audits. The audit schedule itself should be documented and approved by management.
Who can perform the internal audit? Auditors must be trained in internal auditing and must not audit their own work. In small labs, this often means cross-training staff so they can audit each other’s areas, or engaging an external consultant for the audit.
Can I use a checklist as the only internal audit record? No. A completed checklist is useful as a working tool, but the audit record must include the audit scope, criteria, evidence reviewed, findings raised, and a summary conclusion. Findings must then flow into the corrective action system.
What is the difference between a finding and an observation? A nonconformity (finding) is a failure to meet a specific requirement of the standard. An observation or opportunity for improvement is a suggestion — it doesn’t require corrective action but should be considered during management review.
Does passing an internal audit mean we will pass the accreditation assessment? Not automatically. The internal audit is only as reliable as the rigor applied. Assessors may look at areas the internal audit missed, interview staff not involved in the audit, or request evidence the internal auditors didn’t ask for. Use the internal audit as preparation, not a guarantee.