What ISO 17025 Accreditation Actually Means for Your Food Safety Test Results

Most food manufacturers have collected enough COAs to wallpaper a small conference room. But ask them whether the lab that issued those certificates holds ISO/IEC 17025:2017 accreditation — and more specifically, whether the tests on those COAs actually appear in that lab’s scope of accreditation — and you’ll often get a blank stare.

That’s not a criticism. Nobody explained the distinction when you first started outsourcing testing. You were told to get testing done; you found a lab; you got a report. The assumption was that all food safety laboratories operate to the same standard. They don’t — and the gap between an accredited lab and an unaccredited one is far more consequential than most brands realize until FDA is standing in the building.

ISO 17025 vs. “We Have a Quality System”: The Difference Is Significant

ISO 9001 is the most widely held quality management certification in the world, and plenty of testing laboratories carry it. But ISO 9001 certifies a management system — documented procedures, nonconformance tracking, management reviews. It says nothing about whether analysts can actually measure what they claim to measure, with defensible accuracy, using validated methods.

ISO/IEC 17025:2017 — the standard’s third edition, published in November 2017 — is technically demanding in ways ISO 9001 simply isn’t. To earn and maintain accreditation under it, a food safety testing laboratory must:

• Validate the specific methods it uses, demonstrating linearity, precision, accuracy, specificity, detection and quantitation limits, and matrix effects for each analyte-matrix combination
• Quantify measurement uncertainty for every reported numerical result — meaning a lead result of 0.5 ppm should be understood as 0.5 ± 0.08 ppm, even when only the point estimate appears on the COA
• Participate in proficiency testing (PT) for each method on its scope, typically at minimum once per year, through programs like FAPAS, AOAC’s FERN PT network, or USDA/GIPSA schemes
• Maintain calibrated, traceable reference standards with a documented chain of traceability to NIST or other recognized national metrology institutes
• Submit to external technical assessment from an approved accreditation body — in the US, the most common are A2LA (American Association for Laboratory Accreditation), PJLA (Perry Johnson Laboratory Accreditation), and NVLAP under NIST

That last point is what separates accreditation from self-certification. An accreditation body sends trained technical assessors — typically working scientists in the relevant discipline — to audit the lab’s method validation packages, quality control charts, equipment calibration logs, and analyst training records. They’re not reviewing a binder of policies. They’re evaluating actual data.

An initial accreditation assessment takes 2 to 3 days on-site, followed by annual surveillance visits. The costs to the lab are real, which is partly why accreditation still functions as a meaningful quality signal rather than something every lab picks up as an afterthought.

The Scope of Accreditation: Where Most Manufacturers Stop Looking Too Soon

Here’s a mistake we see regularly: a brand confirms that a lab is ISO 17025-accredited and stops there. But accreditation is scoped to specific tests, matrices, and methods. A lab might be accredited for Salmonella detection in poultry products but not in botanical powders. It might be accredited for aflatoxins in corn by HPLC-MS/MS but run your dietary supplement samples using a method that doesn’t appear on its scope at all.

Every accreditation body publishes scope of accreditation documents online — they’re public records. The scope lists, in specific terms, the tests and matrices for which the lab has demonstrated technical competence to its accreditor. Before sending samples, pull that document and check three things:

1. Is your specific test listed? Not “heavy metals” generically, but the specific analytes — lead, arsenic, cadmium, mercury — and the recognized method (EPA 6020B, USP <2232>, or a similarly cited procedure).
2. Is your matrix represented? “Food” is not a matrix. Finished supplement powder, ready-to-eat deli meat, raw grain, and fresh produce each present different extraction and interference challenges. A scope that lists “food products” without further detail warrants clarification.
3. Is the cited method one you recognize? AOAC Official Methods, FDA Bacteriological Analytical Manual (BAM) procedures, USDA FSIS methods, and ISO methods are all auditor-defensible. An internally developed method that doesn’t appear on the scope — or that the lab describes as “equivalent to” a recognized method — deserves more scrutiny before you rely on it.

If any of those three items is unclear, ask the lab directly and get a written response. Gaps in scope don’t automatically mean incompetence; the lab may conduct the testing but hasn’t yet sought accreditation for that specific combination. But you need to know which situation you’re in before those results become central to an FDA inspection.

FSMA, FDA Enforcement, and Why Your Lab Choice Surfaces at the Worst Possible Moment

Under 21 CFR Part 117.165, manufacturers subject to FSMA’s Preventive Controls for Human Food rule must verify that environmental monitoring and finished product testing are conducted using “scientifically valid methods.” The regulation doesn’t name ISO 17025 explicitly — but ISO 17025 accreditation is the most auditable, third-party-verified way to demonstrate that a method qualifies.

FDA issued roughly 3,000 warning letters in fiscal year 2024 across all regulated product categories, with food and dietary supplement manufacturers accounting for a substantial share. In letters where investigators challenge lab data, they typically focus on two questions: whether the method was validated for the specific product matrix, and whether the laboratory had any independent quality oversight. An accredited food safety laboratory satisfies both by definition. An unaccredited lab requires you to defend both points yourself, in writing, during the inspection.

We’ve seen situations where a manufacturer’s borderline pathogen result — a Salmonella presumptive positive that was re-tested as negative — became nearly impossible to defend when the originating lab had no formal method validation records and wasn’t enrolled in any external proficiency program. “We re-tested and it was negative” is not a strong response when FDA has no reason to trust the method that produced either result.

There’s also a supply chain dimension that’s easy to miss. Major retail buyers and large contract manufacturers increasingly specify ISO 17025-accredited food safety laboratories in their supplier qualification requirements — buried in technical agreements and vendor questionnaires. That requirement doesn’t surface until a supplier audit or contract dispute, neither of which is an ideal moment to discover that your incoming ingredient COAs came from a lab that didn’t qualify.

What to Ask a Food Safety Testing Laboratory Before You Send a Sample

Can I see your scope of accreditation, and does it cover my specific product matrix and test method?

Not “are you ISO 17025 accredited” — the scoped version of the question. Push for the scope document, not just the framed certificate. A lab with nothing to hide shares this without hesitation; in fact, a credible food safety laboratory will usually offer it proactively.

How often do you participate in proficiency testing for this method, and can I see recent results?

For pathogen methods, annual PT participation through programs like AOAC FERN is standard. For chemical methods — pesticide residues, heavy metals, mycotoxins — participation twice per year through FAPAS or equivalent schemes is common among high-quality labs. Recent PT results showing acceptable z-scores (typically |z| ≤ 2.0) are a concrete indicator of method performance.

What is the measurement uncertainty for this test?

For any quantitative result, you’re entitled to an uncertainty estimate. If the answer is “we don’t calculate that,” the lab is either not accredited for the test or hasn’t implemented ISO 17025:2017 requirements in full. An acceptable answer for a heavy metal near its detection limit might be ± 15–20% of the measured value; at higher concentrations, you’d expect tighter figures.

What happens to client samples when an internal QC sample fails?

In an ISO 17025-compliant food safety laboratory, there are control charts for each method with defined action and warning limits. When an in-house QC sample falls outside those limits, results for associated client samples are held and investigated before reporting. The answer to this question reveals more about lab culture than almost anything else you can ask.

---

The price difference between an accredited food safety laboratory and an unaccredited one is typically 10–25% on routine tests. That’s not nothing. But it has to be weighed against what you’re actually purchasing. An accredited result is defensible. An unaccredited result is data, and only data — with no external validation of the method or the laboratory behind it.

For manufacturers operating under FSMA, or sourcing from suppliers who do, ISO 17025-accredited food safety labs aren’t a premium option. They’re the most practical way to demonstrate that your testing decisions were based on scientifically sound methods. And that’s a defense worth having before you need it.

---

Written by Nour Abochama, Vice President of Operations, Qalitex Laboratories. Learn more about our team

Talk to our team about your testing needs. Contact us

Related from our network

• FDA Audit Readiness and Regulatory Compliance Consulting — Aurora TIC helps food and supplement companies prepare for FDA inspections and navigate FSMA documentation requirements.
• Raw Material COA Verification and Supplier Qualification Testing — Ayah Labs specializes in verifying incoming ingredient COAs and qualifying raw material sources against USP and Ph.Eur. monographs.