Method Validation Under ISO 17025: What Accredited Labs Actually Have to Prove Before Reporting Your Results

Most brands treat a Certificate of Analysis like the end of a story. You get a PDF, check the results against your spec, and either release the lot or put it on hold. What doesn’t get scrutinized nearly often enough is the analytical method behind those numbers — whether it was properly validated, whether that validation was done on representative matrices, and whether the lab’s accreditation actually covers what you just submitted.

Here’s something that surprises a lot of clients: ISO 17025 accreditation doesn’t automatically mean every method a lab offers is fully validated. Accreditation means the laboratory operates a documented quality management system and has demonstrated technical competency on a specific, listed set of methods and matrices. The scope of accreditation — publicly searchable in the A2LA, PJLA, or AIHA-LAP databases — tells you exactly what has been independently assessed. Anything the lab runs outside that scope may still produce a number, but the rigor behind that number is entirely at the lab’s discretion.

This distinction matters the moment a regulator, a retailer, or a plaintiff’s attorney starts asking questions.

What ISO/IEC 17025:2017 Actually Requires for Method Validation

The governing document here is ISO/IEC 17025:2017, and the specific requirement lives in Clause 7.2. It draws a clear and consequential line between two activities that sound similar but are not interchangeable.

Method validation is required when a lab develops a new method, modifies an existing standard method beyond its published scope, or applies a standard method to a matrix or analyte for which it wasn’t designed. It’s the full proof-of-concept exercise — the lab must demonstrate, with documented experimental data, that the method is fit for its specific intended purpose under its specific operating conditions.

Method verification applies when a lab adopts a standard method as-published — one issued by AOAC International, USP, ASTM, ISO, or a comparable body — without modification, for the purpose it was designed. Verification is a lighter exercise. The lab confirms it can achieve performance consistent with the published specifications: close enough precision, acceptable recovery, and LOD/LOQ at or below the method’s stated limits. Documented experimental evidence is still required. An assumption that the method works because it’s a standard method is not.

The practical implication: if your lab is running pesticide residues by AOAC 2007.01 as-published on representative botanical matrices, that may qualify for verification. But if they’ve modified the extraction solvent, changed the cleanup step, or are running it on a matrix — say, a protein powder with 40% fat content — that’s outside the method’s original validation scope. A verification study alone doesn’t cover it. What you should see is a validation report, or at minimum documented evidence that the method extension was evaluated for the specific matrix submitted.

We see this gap most often with clients who are sourcing testing from newer labs or offshore facilities. The scope of accreditation is real, but when the actual product is a sticky gummy or a high-lipid softgel, the question of whether the validated extraction procedure transfers cleanly is one a lot of labs haven’t formally answered.

The Six Validation Parameters That Matter for Supplement and Cosmetic Testing

Full quantitative method validation under ISO 17025:2017, informed by ICH Q2(R2) — the revised 2022 international guideline for analytical procedures — and USP <1225>, requires demonstrating performance across six core parameters. Each one should appear in the lab’s validation report with data, not just an assertion.

Specificity and Selectivity confirm that the method measures only the target analyte without interference from the sample matrix, degradation products, or co-eluting compounds. For an HPLC method measuring curcuminoids in a turmeric supplement, this means demonstrating unambiguous peak identity for curcumin, demethoxycurcumin, and bisdemethoxycurcumin even in the presence of excipients, natural pigments, and other phenolics that absorb at 425 nm.

Linearity and Range establish the concentration window over which detector response is proportional to analyte concentration. For most contaminant and potency methods, labs demonstrate linearity across a minimum of five concentration levels spanning 80% to 120% of the target specification. A Pearson correlation coefficient (r²) of 0.999 or above is the standard threshold. Linearity that breaks down at concentrations near the regulatory limit — which happens with real matrices — is a problem you want to catch in validation, not after you’ve released a product.

Accuracy — sometimes called trueness — is measured through spiked recovery studies. A known amount of analyte is added to a representative blank matrix, carried through the full sample preparation and analysis procedure, and the measured result is compared to the theoretical value. For dietary supplements and cosmetics, a recovery between 85% and 115% is the widely accepted criterion. That 30-point window sounds generous until you’re working with a dense botanical extract where matrix suppression in ICP-MS can push recovery to 70% without careful matrix-matched calibration.

Precision has two mandatory components. Repeatability is measured by running six or more injections of the same sample under identical conditions — same analyst, same instrument, same day — and calculating the percent relative standard deviation (%RSD). Intermediate precision extends this across different days, analysts, and instrument runs. For most quantitative supplement and cosmetic methods, a repeatability %RSD below 5% is standard; for trace-level contaminant work near the LOQ, up to 10–15% %RSD may be accepted depending on the analyte and application.

Limit of Detection (LOD) and Limit of Quantitation (LOQ) define the method’s sensitivity floor. LOD is conventionally calculated as 3.3 times the standard deviation of blank-matrix measurements divided by the calibration slope. LOQ is typically 3.3 times the LOD, or independently calculated as 10σ/slope — whichever approach the lab uses, it needs to be documented and consistent. For a heavy metals method targeting lead against a California Prop 65 no-significant-risk level of 0.5 µg per day, the LOQ needs to be comfortably below that threshold given typical serving sizes — usually in the range of 0.01 to 0.05 mg/kg in the finished product.

Robustness tests how method performance holds up under small, deliberate variations in operating conditions: slight changes in mobile phase pH, extraction temperature, reagent batch, or instrument flow rate. A method that passes every other parameter but fails robustness testing is fragile — it works when conditions are ideal, but produces unreliable results when reagent lots change or equipment drifts slightly between calibrations. Robustness data is frequently absent from validation reports at labs that treat validation as a paperwork exercise rather than a scientific one.

Verification vs. Full Validation: Why the Distinction Shows Up in Your COA

When a lab verifies a standard method rather than validating a novel one, the scope of what’s documented is intentionally narrower. A verification study confirms the lab can hit the published method’s performance targets — typically precision, accuracy via certified reference material or spiked recovery, and detection capability. It doesn’t require the same breadth of specificity, linearity, and robustness studies.

This is appropriate when the method and matrix genuinely match the standard. It becomes a problem when labs apply verification logic to situations that warrant full validation.

We’ve worked with clients who transferred testing from one contract lab to another and found that their previous heavy metals COAs had been generated using a method verified only in aqueous digest — a clean, interference-free matrix — then applied without adjustment to gummy supplements containing gelatin, fruit puree, and high sugar loads. Gelatin in particular creates significant ionization suppression in ICP-MS if matrix-matched calibration isn’t used. The COAs were internally consistent. They were not analytically accurate.

Measurement uncertainty compounds this. ISO 17025:2017 Clause 7.6 requires accredited labs to estimate and report measurement uncertainty when it’s relevant to the validity of results. Many brands have never been told their lab calculates this, let alone asked for it. But if your label claims 500 mg of magnesium per serving and the test result is 465 mg — whether that’s a real label claim failure depends entirely on the measurement uncertainty. An expanded uncertainty of ±8% at 95% confidence means you genuinely cannot statistically distinguish 465 mg from 502 mg. Knowing that before you make a release decision is the point.

Five Questions to Ask Any Lab Before Submitting Samples

None of this needs to be adversarial. The labs that are doing this correctly — running properly validated methods on appropriate matrices with documented uncertainty estimates — are proud of it. These are the five questions that separate them from the ones that aren’t.

1. Is this method within your accredited scope? Ask for the current A2LA or equivalent certificate and verify that your product type, analyte, and matrix are listed. Don’t assume that because the lab is ISO 17025 accredited, the specific test you’re ordering falls under that accreditation.

2. Was the method validated or verified — and can I see the key performance data? A reputable lab should be able to share a summary of the validation report: LOQ, recovery range, precision data, and linearity range. They don’t owe you the full internal study document, but the headline numbers should be accessible.

3. Has the method been evaluated in a matrix representative of my product? A validation in fish tissue doesn’t transfer automatically to a botanical extract, and a verification in aqueous digest doesn’t cover a softgel. Ask specifically.

4. Do you estimate and report measurement uncertainty? For applications where you’re making release decisions against a tight specification or a regulatory limit, knowing the uncertainty on each result changes how you interpret borderline data.

5. What is your between-run %RSD for this method? Intermediate precision data tells you how consistent results will be across different days and analysts. If you retest a retained sample six months later, you want to know how much of any difference is analytical noise versus actual product change.

A lab confident in its validation data will answer all five without hesitation. The goal isn’t to interrogate your testing partner — it’s to confirm that the COA you’re relying on to make product release decisions, respond to regulatory inquiries, and defend your label claims is built on something solid.

The number on your test report is only as good as the validation behind the method that produced it. In an environment where FDA is issuing more import alerts, Amazon is tightening its third-party testing requirements, and state enforcement of Prop 65 is increasingly data-driven, that foundational question deserves more attention than most brands are giving it.

---

Written by Nour Abochama, Vice President of Operations, Qalitex Laboratories. Learn more about our team

Talk to our team about your testing needs. Contact us

Related from our network

• FDA Audit Readiness and 21 CFR Compliance for Regulated Manufacturers — Aurora TIC helps pharmaceutical and device companies prepare documentation, validate software systems, and navigate FDA inspection readiness.
• Raw Material COA Verification and Supplier Qualification Testing — Ayah Labs provides independent raw material testing, USP/Ph.Eur. monograph verification, and supplier qualification support for global B2B buyers.