What Is ISO 17025? And Why the Hardest Part Isn't Getting Accredited — It's Staying That Way

A2LA — the largest accreditation body for testing and calibration laboratories in the United States — maintains active accreditations for more than 5,000 facilities across dozens of industries. Each one of those accreditations requires periodic surveillance, and a substantial number of those assessments close with corrective action requests. Meaning the lab had documented problems that needed to be resolved before the assessment could be signed off.

The most common findings aren’t about broken instruments or contaminated reagents. They’re about documentation, traceability, and an often-overlooked requirement called measurement uncertainty. And if you’re a dietary supplement brand, a cosmetic manufacturer, or a food company choosing a third-party testing partner, understanding where accredited labs actually fall short can help you ask far sharper questions than “are you ISO 17025 certified?”

What ISO 17025:2017 Actually Covers — Most Labs Emphasize Only Half

ISO/IEC 17025:2017 is the international standard for the general competence of testing and calibration laboratories. The 2017 revision replaced the 2005 version and introduced a stronger risk-based thinking framework borrowed from ISO 9001:2015 — a meaningful shift that caught some labs off guard. When labs market themselves as ISO 17025 accredited, they tend to lead with the tangible proof: instruments, validated methods, accreditation certificates. That’s the technical side. But the standard has two equally weighted pillars.

The first is the management system requirements: document control, handling of nonconforming work, internal audits, corrective and preventive actions, and the feedback loops that keep a lab’s processes reproducible month over month. The second is the technical requirements: method validation, measurement uncertainty estimation, equipment calibration traceability, and personnel competency. Weakness in either pillar is enough to generate a finding during assessment.

One thing that catches clients off guard, and that we explain to virtually every new partner we work with: ISO 17025 accreditation is always scope-specific. A lab accredited for heavy metals analysis by ICP-MS under a specific EPA or AOAC method is not automatically accredited for microbial enumeration under USP <61>. The accreditation scope document — a public record available through the accreditation body’s online directory — lists every specific test method covered. If a lab can’t produce that document on request, or gets evasive when you ask which specific methods fall within their accredited scope, that’s meaningful information.

The 6 Most Common Nonconformities Seen in ISO 17025 Assessments

Having gone through multiple A2LA surveillance assessments at our Southern California facility, and staying current on published assessment trends from accreditation bodies, certain findings surface repeatedly. None of them are obscure. All of them are preventable.

1. Measurement uncertainty not calculated for all accredited methods

This is consistently one of the top findings across U.S. laboratories. ISO/IEC 17025:2017 Clause 7.6 requires labs to identify and account for all significant contributions to measurement uncertainty — from sampling variability and calibration uncertainty to method repeatability and environmental factors. Many labs calculate uncertainty budgets for their flagship assays and leave the remaining methods undocumented. When an assessor asks to see the uncertainty budget for a less-common test in the accredited scope, the gap becomes immediately apparent.

2. Method validation gaps — especially for modified compendial methods

Running a USP or AOAC method exactly as written is one thing. Modifying it — changing the sample matrix, the extraction solvent, the instrument platform, or the sample preparation steps — creates an in-house method that requires full validation under Clause 7.2. Linearity, accuracy, precision, limit of detection, limit of quantitation, specificity: all of it needs to be documented. A common shortcut is citing the original USP reference as the validation basis when the methodology has been materially changed. That doesn’t survive an assessor’s scrutiny, and it shouldn’t.

3. Equipment calibration records with gaps in traceability

Every piece of measurement equipment — analytical balances, volumetric pipettes, HPLC systems, reference standards — needs to trace its calibration back to a national or international measurement standard. In the U.S., that’s typically NIST. The chain of traceability must be documented without breaks. A balance calibrated with a weight set that has no calibration certificate of its own breaks the chain. So does a reference standard purchased from a non-certified vendor with no certificate of analysis documenting purity and traceability. Both are findings under Clause 6.4, and both are more common than you’d expect.

4. Proficiency testing not covering the full accredited scope

Participation in interlaboratory proficiency testing programs is a requirement, not an option. Labs need to demonstrate technical proficiency for all methods within their accredited scope, typically through FAPAS, AOAC FEPAC-accredited PT providers, or custom bilateral schemes. A common gap: labs actively accredited for 35 or 40 methods but enrolled in PT exercises covering only 15 to 20 of them. Assessors cross-reference the accredited scope against PT participation records. The math tends to surface quickly.

5. Personnel competency records that are incomplete or outdated

Training records need to show not just that an analyst received instruction, but that their competency was evaluated — and re-evaluated periodically, or whenever a method changes significantly. A log showing “attended method training, April 2024” with a signature is not the same as a documented competency assessment with defined pass criteria and a qualified supervisor’s sign-off. Clause 6.2 requires labs to ensure personnel competency on an ongoing basis, and paper trails matter when an assessor is looking at a method that changed 6 months ago with no corresponding re-qualification on file.

6. Internal audit programs that aren’t genuinely risk-based

ISO/IEC 17025:2017 requires internal audits, and it requires them to reflect risk — meaning higher-complexity methods, historically problematic processes, and newer analysts should receive proportionally more attention than stable, low-risk operations. Labs that run annual check-the-box audits covering every department equally, regardless of performance history or operational complexity, typically receive a finding for not demonstrating risk-based scheduling. The 2017 revision made this expectation explicit in a way the 2005 version did not, and some labs are still catching up.

What Accreditation Actually Means When You’re Choosing a Testing Partner

ISO 17025 accreditation is the floor for competent third-party testing, not the ceiling. But it’s a meaningful floor. An accredited lab has demonstrated to an independent body — A2LA, Perry Johnson Laboratory Accreditation (PJLA), NVLAP, or another ILAC-recognized body — that its management systems and technical operations meet documented, externally audited criteria. That assessment happens on a defined cycle, with annual surveillance visits and a full re-assessment every two to four years depending on the accreditation body and the lab’s scope.

When evaluating a testing partner, ask for two specific documents: the accreditation certificate and the scope of accreditation. The certificate confirms the lab is accredited and shows the expiration date. The scope tells you exactly what they’re accredited for. These are two separate documents, and both matter.

You can verify independently through the A2LA directory at a2la.org or the PJLA public directory. Both are searchable by laboratory name and return the current scope, certificate status, and expiration date. If a lab’s certificate lapsed several months ago and they haven’t proactively mentioned it, you’ll find out in about 90 seconds of searching.

One more practical point: if a lab tests your product using a method that isn’t listed on their active accredited scope, that result cannot be reported as an accredited result. For FDA compliance purposes under 21 CFR Part 111 (dietary supplement GMPs), and for Amazon’s third-party testing requirements, that distinction can matter significantly. Always confirm that the specific test you’re ordering falls within the lab’s current, active accredited scope — not just that the lab holds some form of ISO 17025 accreditation somewhere on their certificate.

Why Maintaining Accreditation Is Harder Than Getting It

An initial ISO 17025 assessment for a mid-sized testing laboratory typically runs two to three days on-site, requires months of preparation, and results in a scope that has to be re-earned through ongoing surveillance. Getting accredited the first time is genuinely difficult. But maintaining it is where operational discipline separates labs that are truly operating at the standard from those that treat accreditation as a credential to win and then manage minimally.

Annual surveillance assessments require labs to demonstrate continued compliance across their full scope. Any significant change — adding a new test method, replacing a key instrument, relocating to a new facility, losing a senior analyst — typically triggers a scope amendment process requiring additional documentation or a supplemental assessment. When corrective action requests come in after a surveillance visit, labs have defined timeframes, often 30 to 90 days, to respond with documented root cause analysis and verified corrective actions. Labs that close CARs poorly can face scope suspension.

The labs that handle this well treat their quality management system as an operational discipline rather than a compliance artifact. They run internal audits seriously, keep method validation records current, and invest in personnel competency programs that go beyond onboarding paperwork. The difference between a lab that holds accreditation and a lab that genuinely operates at the standard ISO 17025 sets tends to show up in how they respond to your questions. A high-performing lab will hand you their scope document without hesitation, walk you through the basis for their measurement uncertainty estimates, and tell you directly when a requested test falls outside their accredited scope.

That kind of transparency isn’t just reassuring to hear. For regulated products in dietary supplements (21 CFR Part 111), cosmetics under FDA authority, and food products subject to FSMA, it’s the standard your supply chain and your customers deserve.

---

Written by Nour Abochama, Vice President of Operations, Qalitex Laboratories. Learn more about our team

Talk to our team about your testing needs. Contact us

Related from our network

• FDA Audit Preparation and 21 CFR Compliance Consulting — Aurora TIC helps US companies navigate FDA inspections, GAMP5 validation, and software compliance under 21 CFR Part 11.
• Raw Material COA Verification and Supplier Qualification Testing — Ayah Labs provides contract testing and supplier qualification for raw materials sourced from global supply chains.
• Health Canada NHP Testing and Canadian GMP Compliance — Androxa supports brands entering the Canadian market with NHP licensing, GMP compliance, and Health Canada-aligned testing programs.