The 5 Most Common ISO 17025 Nonconformities Found During Lab Assessments—And How to Fix Them

Most labs know ISO/IEC 17025:2017 cold by the time the assessor walks through the door. They’ve read the standard, updated the quality manual, and drilled the staff on the right answers. And then the assessment report comes back with seven nonconformities.

The frustrating part? Five of them are probably the same five issues that appear on nearly every initial assessment and a surprising number of surveillance visits. Not because the labs are negligent — but because certain clauses are genuinely difficult to implement consistently, the standard leaves meaningful interpretation gaps, and documentation discipline tends to slip in the daily grind of running a real laboratory.

We’ve been through multiple surveillance assessments and scope expansions here at Qalitex Laboratories under our ISO/IEC 17025:2017 accreditation, and the patterns don’t change much. Below is an honest breakdown of the five nonconformities assessors flag most often, what’s actually driving them, and what it takes to fix each one before the assessor shows up — not after.

Why the Same Clauses Keep Generating Findings

ISO/IEC 17025:2017 runs across five major sections and roughly 25 clauses. But a disproportionate share of assessment findings cluster around just a handful: Clauses 6.2, 6.4, 7.2, 7.6, and 7.7. That concentration isn’t random.

The 2017 revision introduced a risk-based approach and substantially elevated the requirements for measurement uncertainty (Clause 7.6) and method validation (Clause 7.2) relative to the 2005 version. Labs that transitioned by the November 2020 deadline had 3 years to rebuild documentation systems that many had developed incrementally over decades. For smaller labs, that was a short runway, and some of the documentation rebuilds were incomplete.

The deeper issue is that these clauses require demonstrable, documented evidence — not just having the right process, but proving it. Assessors from A2LA, Perry Johnson Laboratory Accreditation (PJLA), and other accreditation bodies work from objective evidence. If it isn’t in a document they can review on-site, it effectively doesn’t exist from an accreditation standpoint.

The 5 Nonconformities Assessors Flag Most Often

1. Measurement Uncertainty Not Calculated or Inadequately Documented (Clause 7.6)

This is the most consistently cited nonconformity across accreditation bodies, and it’s not particularly close. Clause 7.6 requires labs to identify all contributions to measurement uncertainty and calculate a combined uncertainty estimate for each method in scope. What assessors find, repeatedly, is one of three problems: no uncertainty budget exists at all; one exists but uses an oversimplified model that doesn’t reflect actual measurement contributions; or the reported uncertainty doesn’t align with the lab’s own historical precision data.

In chemistry testing for dietary supplements — where you’re measuring active ingredients by HPLC or trace minerals by ICP-MS — a defensible uncertainty budget needs to account for calibration curve variability, sample preparation repeatability, instrument precision, and reference standard purity. Collapsing those contributions into a single “±2% relative” figure without supporting data won’t hold up under scrutiny.

The fix isn’t one corrective action. It’s a methodology rebuild. The GUM (Guide to the Expression of Uncertainty in Measurement, JCGM 100:2008) and the EURACHEM/CITAC CG4 guide are the primary references. ILAC G17:01/2021 provides practical guidance specifically for testing labs. Budget at least 40 hours per method to do this properly, and more for complex multi-step methods.

2. Personnel Competency Records Incomplete or Undated (Clause 6.2)

Clause 6.2 requires that all personnel performing technically significant activities be demonstrably competent to do so. That means documented training, supervised performance records, and a formal authorization — signed and dated — before working unsupervised. What assessors routinely find: authorization letters without dates, training records that don’t specify which methods or instruments were covered, or competency evaluations that were completed but never formally signed off.

In a busy lab, it’s easy to train someone well and simply forget to close the paperwork loop. The person is clearly competent — they’ve been doing the work for six months — but the document trail isn’t there to prove it.

For supplement testing labs operating under 21 CFR Part 111 (dietary supplement GMP regulations) in parallel, this problem is doubly expensive. FDA investigators ask for the same documentation during GMP inspections. The habit of rigorous personnel records serves multiple compliance frameworks at once, which is a useful reframe when it feels like administrative overhead.

3. Equipment Calibration Traceability Gaps (Clause 6.4)

Every piece of measurement equipment needs a calibration record tracing back to national or international measurement standards — in the US, that generally means traceability to NIST. Assessors look for three things: current calibration status, documented calibration intervals justified by risk, and an unbroken traceability chain to SI units.

Where labs stumble: using internally calibrated balances without external verification at appropriate intervals, relying on certificate-of-conformance statements from vendors without actual calibration data, or maintaining equipment logs that show calibration dates but not the expanded uncertainty of the calibration itself.

One subtle issue that gets cited more often than labs expect: pipettes. Labs will calibrate analytical instruments rigorously and treat pipettes as commodity consumables. But if you’re using a 1 mL pipette to prepare a standard solution for a quantitative assay, that pipette’s volumetric accuracy is a direct contribution to your measurement uncertainty. It needs a calibration record tied to a traceable reference — and that record needs to accompany the pipette through its working life.

4. Method Validation and Verification Documentation Incomplete (Clause 7.2)

For standard methods — USP General Chapters, AOAC Official Methods, EPA methods — labs are required to perform method verification, demonstrating they can achieve the method’s stated performance characteristics under their specific laboratory conditions. For non-standard or in-house methods, full validation is required. Assessors want to see the actual data: accuracy and recovery data, precision at both repeatability and intermediate precision levels, linearity, LOD and LOQ, and selectivity/specificity studies.

What they frequently find: validation reports that cite published literature as evidence of performance without any lab-generated data; verification studies performed once and never repeated after a significant method change, instrument swap, or analyst turnover; or LOD/LOQ values calculated theoretically using the 3σ/10σ rule without empirical confirmation across multiple runs.

For dietary supplement testing labs running USP General Chapters — such as <621> for chromatography or <2091> for weight variation — verification documentation should be a standing file that gets updated whenever an instrument changes, a major reagent lot shifts, or the analyst pool changes significantly. Many labs create the file once and assume it remains valid indefinitely. It doesn’t.

5. Proficiency Testing Gaps or Unresolved Outlier Findings (Clause 7.7)

Clause 7.7 requires labs to monitor their performance through proficiency testing (PT) or inter-laboratory comparisons. Most accreditation bodies require participation in at least 1–2 PT rounds per year per technical area in scope, and the PT provider should ideally be accredited to ISO/IEC 17043. Assessors check that z-scores or En numbers are recorded, and — critically — that any outlier or “questionable” result (|z| > 2.0) has been investigated through a formal nonconformance or corrective action process.

The nonconformity isn’t always failing the PT round. It’s failing to investigate. Labs that participate, receive a z-score of 2.4, note it on the spreadsheet, and move on without documented root cause analysis are setting themselves up for a finding. Assessors treat an uninvestigated outlier as a signal that the lab’s measurement assurance system isn’t functioning as intended — even if subsequent rounds were clean.

In the dietary supplement space, PT providers offering relevant schemes for vitamins, minerals, and contaminants include FAPAS, BIPEA, and LGC Standards. Participating in at least 2 schemes per year per discipline is a reasonable minimum; labs with broader scope coverage often run 4–6 rounds annually to build a robust performance history.

What to Do Before Your Next Assessment

The practical advice: don’t wait for an assessor to find these. Internal audits can work — but only when the auditors are looking for objective evidence the same way an external assessor would. A useful self-test: “If an assessor asked me to show them this record right now, could I pull it immediately?” If the answer involves hesitation, searching, or explaining why the document is somewhere else, that’s a finding waiting to happen.

A pre-assessment review focused specifically on these five areas — measurement uncertainty budgets, personnel authorization records, calibration traceability files, method validation packages, and PT participation and investigation logs — will surface most of what would otherwise appear as nonconformities. We typically reserve 2–3 full business days for this kind of focused documentation review before a surveillance assessment, with a dedicated checklist mapped to the relevant clause requirements.

One more thing worth flagging: corrective action timelines are unforgiving. A2LA, PJLA, and most accreditation bodies give labs a 30–60 day window for root cause analysis and corrective action submission after an assessment closes. Extensions exist but aren’t guaranteed. Labs that arrive underprepared and then scramble to close five findings in 30 days are under real pressure — and rushed corrective actions have a way of generating their own follow-on issues.

ISO 17025 accreditation isn’t a certification you earn once. It’s an ongoing maintenance system with real consequences for lapses in documentation discipline. The labs that stay in good standing year over year treat surveillance preparation the same way they treat method validation: as a rigorous, documented process with assigned owners, clear deliverables, and no shortcuts. If your documentation can withstand a well-prepared assessor’s scrutiny, it can withstand almost anything else.

---

Written by Nour Abochama, Vice President of Operations, Qalitex Laboratories. Learn more about our team

Talk to our team about your testing needs. Contact us

Related from our network

• Understanding FDA Quality System Regulations for Labs — Aurora TIC covers 21 CFR compliance, software validation, and FDA audit preparation for regulated industries.
• Supplier Qualification and COA Verification for Raw Materials — Ayah Labs provides contract testing and supplier qualification services for raw material sourcing teams.
• GMP-Compliant Lab Testing for the Canadian Market — Androxa supports Health Canada NHP compliance and GMP-aligned testing for Canadian supplement brands.