An ISO 17025 internal audit checklist helps testing and calibration laboratories assess whether their management system meets ISO/IEC 17025:2017 requirements and whether documented procedures are followed in practice. It gives auditors a consistent way to review laboratory activities, examine objective evidence, record findings, and follow up on corrective actions.
ISO/IEC 17025:2017 Clause 8.8 requires laboratories to conduct internal audits at planned intervals. The audit programme must consider the importance of laboratory activities, changes affecting the laboratory, and previous audit results. It must also define audit criteria and scope, communicate results to relevant management, and retain audit records.
Use the checklist below as a starting point for your next internal audit. Adapt the questions to your laboratory's scope, test and calibration methods, documented procedures, and applicable accreditation requirements.
ISO 17025 Internal Audit Checklist: Quick Reference
For each question, record the result as Conforming, Nonconforming, or Not Applicable. Include objective evidence and document references rather than relying only on a yes/no answer.
ISO 17025 Internal Audit Checklist by Clause
Clause 4: General Requirements
Objective: Confirm that the laboratory manages impartiality risks and protects confidential information.
- Has the laboratory identified risks to impartiality arising from its activities, relationships, or personnel?
- Are appropriate actions taken to eliminate or minimize identified impartiality risks?
- Are arrangements in place to protect customer information and laboratory records?
- Are confidentiality obligations communicated to personnel and relevant external parties?
- Is confidential information disclosed only when authorized or legally required?
Evidence to review: Impartiality risk assessments, confidentiality agreements, policies, and relevant records.
Clause 5: Structural Requirements
Objective: Verify that the laboratory has a clear organizational structure and defined responsibilities.
- Are the laboratory's legal identity and activities clearly established?
- Are management responsibilities and authorities documented?
- Are responsibilities for implementing and maintaining the management system assigned?
- Are personnel aware of their authority and responsibilities?
- Are changes to the organizational structure assessed for their effect on laboratory operations?
Evidence to review: Organizational charts, role descriptions, responsibility matrices, and management system documentation.
Clause 6: Resource Requirements
Objective: Check whether personnel, facilities, equipment, and external resources are suitable for laboratory activities.
- Are personnel competent for the testing, calibration, or sampling activities they perform?
- Are training, competence assessment, and authorization records maintained?
- Are environmental conditions monitored and controlled when they can affect results?
- Is equipment suitable for its intended use and maintained appropriately?
- Are calibration status, maintenance records, and equipment identification traceable?
- Is metrological traceability established where required?
- Are external providers evaluated and monitored against defined requirements?
Evidence to review: Training records, authorization records, environmental logs, equipment registers, calibration certificates, and supplier evaluations.
Clause 7: Process Requirements
Objective: Determine whether laboratory activities are performed using appropriate methods and supported by reliable technical records.
- Are customer requests, tenders, and contracts reviewed before work is accepted?
- Are appropriate test and calibration methods selected and kept current?
- Are methods verified or validated when required?
- Are sampling, sample handling, identification, and storage procedures followed?
- Are technical records sufficient to reconstruct laboratory activities and results?
- Is measurement uncertainty evaluated where required?
- Are processes in place to monitor the validity of results?
- Are reports reviewed and authorized before release?
- Are complaints and nonconforming work handled through defined procedures?
- Are laboratory data, information systems, and data transfers appropriately controlled?
Evidence to review: Contract reviews, method records, sample logs, raw data, calculations, quality-control results, reports, complaints, and nonconforming-work records.
Clause 8: Management System Requirements
Objective: Verify that the management system is documented, maintained, and improved.
- Are management system documents reviewed, approved, and controlled?
- Are records identifiable, protected, retrievable, and retained according to defined requirements?
- Are risks and opportunities identified and addressed?
- Are improvement opportunities evaluated and implemented where appropriate?
- Are nonconformities investigated and corrective actions documented?
- Is the effectiveness of corrective action reviewed?
- Are internal audits conducted according to a planned programme?
- Are audit criteria and scope defined for each audit?
- Are audit results reported to relevant management?
- Are audit records retained?
- Are management reviews conducted and documented?
Evidence to review: Document registers, record-retention controls, risk assessments, corrective-action records, audit programmes, audit reports, and management-review minutes.
Clause 8.8: Internal Audit Programme Checklist
Clause 8.8 deserves special attention because it addresses the internal audit process itself. A checklist for laboratory technical activities is not enough unless the audit programme is also planned, implemented, and documented appropriately. <Cite refs={["turn716518search24","turn716518search3"]}/>
Use these questions to review the audit programme:
- Is there a documented internal audit programme?
- Does the programme define audit frequency, methods, responsibilities, planning, and reporting?
- Does audit planning consider the importance of activities, changes, and previous audit results?
- Are the criteria and scope of each audit defined before the audit?
- Are auditors competent and able to maintain appropriate objectivity?
- Do audits examine both conformity with the standard and conformity with the laboratory's own management system?
- Are findings and conclusions communicated to relevant management?
- Are corrections and corrective actions addressed without undue delay?
- Are audit plans, reports, findings, and follow-up records retained?
Evidence to review: Annual audit programme, audit plans, auditor assignments, checklists, reports, nonconformity records, and follow-up evidence.
How to Conduct an ISO 17025 Internal Audit
A useful audit does more than complete a checklist. It tests whether the documented management system is implemented and effective.
1. Define the audit scope
Select the processes, locations, methods, equipment, or management system requirements to be examined. Make the scope specific enough for the auditor to collect meaningful evidence.
2. Review previous findings
Examine prior audit results, corrective actions, complaints, process changes, and other relevant information. Use these inputs to identify areas that may need additional attention.
3. Gather objective evidence
Review records, observe activities, interview personnel, and trace selected jobs from request and sample receipt through testing or calibration to reporting. Verify what happens in practice against the applicable procedures.
4. Record findings clearly
For each finding, record the applicable requirement, the objective evidence observed, and the specific gap identified. Distinguish a confirmed nonconformity from a general observation or improvement suggestion.
5. Follow up on corrective actions
Assign responsibility, evaluate the cause of each nonconformity, document appropriate actions, and assess their effectiveness. Retain evidence that the issue was addressed.
6. Report results and retain records
Communicate the audit results to relevant management and retain records of the programme and audit outcomes. Feed significant findings and trends into the laboratory's broader improvement and management-review processes.
Common ISO 17025 Internal Audit Mistakes
Even a detailed checklist can miss important gaps when audits become a paperwork exercise.
- Checking documents without checking implementation: A procedure may exist, but the laboratory may not consistently follow it.
- Using generic questions without objective evidence: Record the actual records, observations, and interviews that support each conclusion.
- Repeating the same audit scope: Consider previous findings, process changes, and the importance of laboratory activities when planning audits.
- Closing findings without checking effectiveness: Document whether corrective action addressed the cause and reduced the likelihood of recurrence.
- Keeping evidence in disconnected locations: Scattered files and spreadsheets can make it difficult to reconstruct what happened during a specific laboratory activity.
A structured audit process connects requirements to evidence, findings, responsible owners, corrective actions, and follow-up.
Laboratories pursuing ISO 17025 Certification must demonstrate technical competence, reliable results, and an effective management system. Structured documentation, traceability, and corrective actions help prepare for assessments and maintain audit readiness.
How Scispot Supports ISO 17025 Audit Readiness
Scispot helps laboratories organize sample information, workflows, documentation, and quality records in a connected digital environment. Depending on the configured workflows and intended use, this can help teams retrieve evidence and follow laboratory activities more consistently.
For internal audit preparation, laboratories can evaluate how their systems support:
- Sample and technical record traceability: Connecting sample information and relevant testing records.
- Workflow consistency: Supporting structured processes and documented handoffs.
- Documentation access: Making relevant records easier to find and review.
- Quality follow-up: Organizing nonconformities and corrective-action workflows where configured.
Software can support audit readiness, but it does not automatically establish ISO/IEC 17025 conformity or guarantee accreditation. Laboratories remain responsible for meeting applicable requirements and demonstrating that their management system works effectively.
Make Your Next ISO 17025 Internal Audit More Structured
A practical ISO 17025 internal audit checklist helps your laboratory move from last-minute preparation to a repeatable process for examining evidence, documenting findings, and following corrective actions through to closure.
Use this checklist as a starting point, tailor it to your laboratory's activities, and confirm requirements against the official standard and your accreditation body's guidance.
Scispot helps laboratories connect sample data, operational workflows, and quality records to support better visibility and traceability.
