An ISO/IEC 17025 internal audit is not a box-ticking exercise — it is the primary mechanism a laboratory uses to verify that its own management system is working as intended and continues to meet the requirements of the standard. Done well, it surfaces problems before an accreditation body assessor does. Done poorly, it gives leadership false confidence and leaves real gaps open.
This step-by-step guide covers everything a lab quality manager needs to plan, conduct, document, and close an internal audit cycle under ISO/IEC 17025.
What the Standard Requires
ISO/IEC 17025 requires laboratories to conduct internal audits at planned intervals to verify that the management system — including both management and technical activities — conforms to the standard’s requirements and the lab’s own documented procedures. The standard also requires that audit findings be used as input to management review, and that any identified nonconformities trigger corrective action.
There is no prescription on how frequently audits must occur or how many auditors must be involved. What matters is that the audit program is systematic, covers the full scope of the management system over a defined cycle, and generates records that demonstrate what was checked, what was found, and what was done about it.
Step 1: Build an Audit Program
An audit program is the plan that ensures all areas of the quality system are audited over a defined period — typically one year. It answers three questions: what will be audited, by whom, and when.
Define the audit scope and elements
Map your audit program to the structure of ISO/IEC 17025. Common audit elements include:
- Document and records control
- Personnel competence and training
- Accommodation and environmental conditions
- Equipment calibration and maintenance
- Metrological traceability
- Externally provided products and services (suppliers and subcontractors)
- Method selection and validation
- Measurement uncertainty
- Sampling
- Technical records and result reporting
- Proficiency testing and interlaboratory comparisons
- Complaints and feedback handling
- Internal audit and corrective action
- Management review
- Risk and opportunity management
Not every element needs a separate audit session. Group related topics logically, but make sure every element in scope gets coverage within the audit cycle.
Select and assign auditors
ISO/IEC 17025 requires that auditors be objective and impartial — meaning personnel should not audit their own work. In small labs where the same people perform many functions, this can be challenging. Common solutions include:
- Cross-training staff from different departments to audit each other’s areas.
- Using a shared-pool arrangement with another lab or parent organization.
- Engaging a qualified external consultant for audit support (though the audit itself remains internal).
Set the schedule
Publish the audit schedule in advance so departments can prepare. Allow enough time between the audit and the management review meeting for findings to be processed and corrective actions to be initiated.
Step 2: Prepare Audit Checklists
A checklist is not a substitute for auditor judgment, but it is an essential tool for ensuring coverage and consistency. Build checklists that trace each question back to a specific clause of ISO/IEC 17025 or a specific internal procedure.
Good checklist questions are evidence-seeking: “Show me the calibration certificate for the analytical balance and explain how you verified it was acceptable before putting the balance back into service.” Weak questions are yes/no compliance surveys: “Is the balance calibrated?”
Effective checklists also include prompts to:
- Review a sample of records (not just the most recent one)
- Verify that personnel performing the activity are authorized and have documented competency assessments
- Confirm that the procedure observed matches what the SOP actually says
- Check that any previous audit findings in this area have been effectively closed
Download our free accreditation readiness checklist for a starting framework that maps key ISO/IEC 17025 requirements to observable evidence.
Step 3: Conduct the Audit
Opening meeting
Start each audit session with a brief opening meeting. Confirm the scope, explain the audit process to the auditee, and invite them to ask questions. This reduces defensiveness and sets a collaborative tone.
Evidence gathering
Auditors gather evidence through three primary methods:
- Interviewing personnel — ask open-ended questions and listen for understanding, not just correct-sounding answers.
- Observing activities — watch a test being performed, a sample being received, or equipment being maintained. Compare what you see to what the procedure requires.
- Reviewing records — check calibration certificates, training records, test reports, PT results, maintenance logs, and anything else that constitutes objective evidence of system operation.
Take thorough notes during the audit. Record what you saw, who you spoke with, which documents you reviewed, and what specific records you sampled. These notes are the raw material for the audit report.
Closing meeting
At the end of each audit session, share your preliminary findings with the auditee before leaving. This gives them the opportunity to provide additional context and avoids surprises in the formal report. It also demonstrates respect for the people being audited.
Step 4: Write the Audit Report
The audit report is the formal record of what was done and what was found. It should include:
- Audit date(s), auditor name(s), and areas audited
- A statement of what was in scope and what was sampled
- A summary of findings — both conforming observations and nonconformities
- Any opportunities for improvement noted (observations that are not yet nonconformities but deserve attention)
- Reference to the audit checklists and evidence sampled
Classifying findings
Most labs classify findings in two tiers:
- Nonconformity (major): A finding that calls into question the lab’s ability to produce valid results, or a systemic failure of a requirement. An example is an entire category of equipment found to be operating without valid calibration.
- Nonconformity (minor): An isolated failure to meet a requirement that does not by itself undermine result validity. An example is a single training record missing a required signature.
Some labs add a third tier — observations or opportunities for improvement — for issues that are not yet nonconformities but indicate a trend or weakness worth addressing proactively.
Step 5: Issue and Track Corrective Actions
For every nonconformity, a corrective action request (CAR) must be issued. The CAR process should:
- Describe the nonconformity clearly, with reference to the specific requirement violated.
- Investigate root cause — what underlying condition allowed this problem to occur? Common root cause categories include inadequate training, unclear procedures, lack of oversight, resource constraints, or process design flaws.
- Define the corrective action — what will be done to eliminate the root cause, not just fix the specific instance?
- Set a due date and assign responsibility.
- Verify effectiveness — after the corrective action is implemented, check whether the root cause has actually been eliminated.
Document every step. An accreditation body assessor reviewing your CAR records wants to see evidence of genuine root cause analysis and verified effectiveness, not just a statement that the problem was fixed.
Step 6: Feed Results into Management Review
Internal audit results — including the number and type of findings, the status of corrective actions, and any trends observed — are required inputs to the management review. Schedule your audit cycle so that results are available in time to be meaningfully discussed at the management review meeting.
Management review outputs may include decisions to adjust the audit program, allocate additional resources to address systemic problems, or update risk assessments. Document these decisions and any resulting actions.
Common Internal Audit Mistakes
- Auditing only on paper: Reviewing documents without observing actual lab operations misses the gap between procedure and practice.
- Skipping technical areas: Many internal audits focus heavily on management system elements and gloss over technical requirements like method validation records, measurement uncertainty documentation, or traceability chains. Cover both equally.
- Closing findings without verified effectiveness: Marking a CAR “closed” when the action has been taken but not yet verified to be effective is one of the most common findings during external assessments.
- Running the audit too close to the management review: If the audit finishes the week before management review, there is no time for corrective actions to be initiated, let alone verified.
- Letting the audit program lapse: A single annual audit that covers everything in one concentrated session is vulnerable to cancellation. A rolling monthly or quarterly program is more resilient.
Frequently Asked Questions
Q: How often must an ISO/IEC 17025 internal audit be conducted? A: The standard requires internal audits at “planned intervals” but does not specify a fixed frequency. In practice, most accreditation bodies expect a complete audit cycle covering all management system elements within a twelve-month period. Some labs run continuous rolling programs on a monthly or quarterly cadence.
Q: Can a lab hire an outside consultant to conduct its internal audit? A: Yes. Using an external consultant to assist with or conduct internal audits is acceptable, provided the consultant’s independence and qualifications are documented. The audit is still considered “internal” because it is commissioned by the lab. The findings feed into the lab’s own corrective action and management review processes.
Q: What is the difference between an internal audit and an accreditation body assessment? A: An internal audit is conducted by or on behalf of the lab to check its own conformance — it is a self-assessment tool. An assessment by an accreditation body is an external evaluation by the body that decides whether to grant or maintain accreditation. Internal audits should prepare a lab for external assessments, but the two serve distinct purposes.
Q: Do internal audit findings have to be reported to the accreditation body? A: Not routinely. You are not required to share individual audit reports with your accreditation body between surveillance assessments. However, audit records are reviewed during on-site assessments, and significant systemic problems identified in audits may need to be reported under the requirement to notify the AB of changes that may affect accreditation status.
Q: What records must we keep from an internal audit? A: At minimum: the audit schedule, audit checklists or notes, the audit report, and all corrective action records including evidence of effectiveness verification. These records must be retained for the period specified in your records management procedure and must be available to assessors during on-site evaluations.