What Is ISO 17025 Accreditation — and Why Do Labs Keep Failing the Same Assessment Clauses?

Every few weeks, we receive samples from brands who mention — almost as an aside — that the lab they switched from “had ISO 17025.” It usually comes up right before they describe results that couldn’t be traced back to a validated method, a COA with equipment that hadn’t been calibrated in over two years, or potency claims that collapsed when we ran the same product ourselves.

ISO 17025 accreditation is real and it matters. But the credential on a letterhead only tells you a lab met the standard at the time of its most recent assessment. What happens in between those assessments — and what gets cited during them — is where the actual picture of lab quality lives.

Here’s what the standard genuinely requires, which clauses generate the most findings, and what that means if you’re a brand evaluating a testing partner.

What ISO 17025 Accreditation Actually Means

ISO/IEC 17025:2017 is the international standard governing the technical competence of testing and calibration laboratories. It replaced the 2005 version in November 2017 and introduced a more risk-based, outcome-focused framework — a meaningful shift that required labs to restructure documentation, revise method validation records, and rethink how they demonstrate personnel competency. The transition period closed in November 2020, giving labs 3 years to migrate. A number of facilities that had held accreditation for years still struggled with the 2017 requirements.

The standard is built around three core pillars. General requirements cover impartiality and confidentiality — labs must be structurally independent from commercial pressures that could bias results. Resource requirements cover the building blocks of technical quality: personnel, facilities and environmental conditions, equipment, and metrological traceability to national standards. Process requirements are the heart of the standard and cover method selection and validation, sampling, measurement uncertainty, result reporting, and complaints. There’s also a management system component that parallels ISO 9001 and covers internal audits, corrective actions, and management review.

In the US, the two dominant accreditation bodies for commercial testing labs are A2LA (American Association for Laboratory Accreditation) and PJLA (Perry Johnson Laboratory Accreditation). Both conduct on-site assessments using technical assessors with genuine subject matter expertise — a microbiologist assesses microbiology scope, an analytical chemist assesses chemistry methods. That specificity matters.

A2LA currently accredits more than 2,000 testing and calibration facilities across the US. Accreditation isn’t permanent — initial assessments typically take 6 to 12 months from application to grant, and the accreditation cycle involves annual surveillance assessments with a full reassessment every 4 years. A lab can lose accreditation or have specific methods suspended between full reassessments if significant nonconformities are cited and not resolved.

And here’s the detail most brands overlook: accreditation is never a blanket credential. Every accredited lab has a Scope of Accreditation document — publicly searchable on A2LA’s database — that lists each specific test method and the matrices for which accreditation has been demonstrated. A lab can be ISO 17025 accredited for AOAC 2007.01 (pesticide residues in botanical matrices) and have zero accredited scope for heavy metals by ICP-MS. The COA will look the same either way.

The Nonconformities That Show Up Most Often

If you’ve been through an ISO 17025 assessment — on either side of the table — you know certain clauses generate a disproportionate share of findings. These aren’t obscure edge cases. They’re the same gaps that surface across labs of every size and vintage.

Measurement uncertainty — Clause 7.6. This is consistently one of the highest-frequency nonconformities cited in ISO 17025 assessments, and it’s the one that most undermines the value of a COA in practice. The standard requires labs to identify all sources of measurement uncertainty for every accredited method and to provide uncertainty estimates in reports when clients need them. In practice, many labs calculate uncertainty once during initial method validation, document it, and never revisit the calculation — even as reagent lots change, instruments age, analysts turn over, and new matrices get added to the workload. For a dietary supplement lab, a complete uncertainty budget needs to account for sample preparation variability, instrument drift, reference standard purity, matrix effects, and analyst-to-analyst repeatability. If a lab can’t hand you its uncertainty budget for a specific method, that’s meaningful.

Method validation documentation — Clause 7.2. The 2017 revision made validation requirements more explicit than the 2005 version. When labs use non-standardized methods or modify published standard methods, they’re required to validate — not just verify — those methods. Validation requires documented evidence of specificity, linearity, working range, accuracy (typically via spike recovery), precision (repeatability and intermediate precision), limit of detection, limit of quantitation, and robustness. What assessors commonly flag is incomplete records: linearity data collected across 5 concentration levels but no documentation linking those levels to the claimed calibration range, or accuracy data from a single matrix when the lab regularly tests 4 or 5 different product types. In any lab that’s scaled up quickly — adding new product categories to meet client demand — the validation records often lag behind the actual testing scope.

Equipment calibration and metrological traceability — Clause 6.4. Every measurement instrument must be calibrated by a source with traceability to national measurement standards — NIST, in the US context. That covers balances, volumetric glassware, pipettes, temperature sensors, reference standards, and analytical instruments. The gap we see most often isn’t outright missing calibration records; it’s broken traceability chains. A top-loading balance might be calibrated annually by an external service provider, but if that provider’s certificate doesn’t include an explicit NIST traceability statement, the chain is incomplete. Assessors pull calibration certificates and follow the documentation upstream. A single missing traceability link can generate a nonconformity across every method that instrument touches.

Personnel competency records — Clause 6.2. ISO 17025:2017 strengthened personnel requirements significantly relative to the 2005 version. It’s no longer enough to document that an analyst received training; labs must demonstrate that analysts are competent to perform specific tasks and must maintain records of that competency evaluation. In practice, that means documented training records, analyst-specific proficiency data (not just lab-wide participation in proficiency testing programs), and formal authorization records for each test method. In commercial labs with high technician turnover — and most commercial labs do have high turnover right now — keeping these records current is genuinely difficult. Assessors routinely find analysts running methods for which no competency authorization record exists in the personnel file.

Internal audit completeness — Clause 8.8. Internal audits must cover all elements of the management system within each audit cycle. It’s surprisingly common for labs to conduct audits that systematically miss specific clauses — particularly the more technical areas of Clause 7 — when the internal auditor is more comfortable with quality management concepts than with analytical chemistry. An internal audit that doesn’t probe measurement uncertainty or method validation in any meaningful depth isn’t providing the oversight the standard intends. Assessors compare audit records against the full scope of the standard and will note any structural gaps.

Corrective action effectiveness — Clause 8.7. This one is subtler than the others. A lab might have flawless documentation of every nonconformity from its previous assessment cycle, with corrective actions closed on time and signed off by management. But if the root cause analysis was superficial — “analyst error” instead of the actual systemic gap in authorization or training — the same category of issue resurfaces at the next assessment. Assessors look for patterns. “Analyst error” is almost never an adequate root cause because it doesn’t explain why the error was possible or why the system didn’t catch it.

What the Scope Document Means for Your COA

The scope issue deserves specific attention because it’s the detail most frequently missed by brands reviewing test reports.

When you receive a COA from an ISO 17025 accredited lab, look for the accreditation symbol and scope number in the report header. Then go to the accreditor’s public database — A2LA’s is freely searchable at a2la.org — and pull the lab’s current scope document. You’re looking to confirm two things: first, that the specific test method listed on your COA is within the lab’s accredited scope; second, that the matrix (your product type — capsule, powder, liquid, topical) is listed for that method.

We’ve reviewed COAs from competitors where the potency assay was within scope but the microbiological methods were not. The brand had no idea, and had no reason to suspect a problem unless they knew where to look. A COA can look identical regardless of accreditation status. The scope document is the only way to verify it.

For dietary supplement brands responding to an FDA inspection, submitting documentation to Amazon, or defending a label claim, the scope of accreditation is what validates the analytical integrity behind the COA. It’s not a formality worth skipping.

The Questions Actually Worth Asking

Most brands ask testing labs: “Are you ISO 17025 accredited?” That’s the wrong question — or at least, it’s the incomplete one. A more useful set of questions before you submit samples:

• Is this specific test method listed in your current accredited scope for this matrix?
• What is the measurement uncertainty for this method, and can I see the uncertainty estimate that appears on my report?
• When was this method last assessed by your accreditation body?
• Which accreditation body issued your accreditation, and where can I verify it?
• Have any methods in your scope been suspended or placed under corrective action in the last 12 months?

Those five questions will surface more useful information about lab quality than any marketing language on the website. A well-run ISO 17025 lab should be able to answer all of them without hesitation.

At Qalitex, our scope only includes methods we’re actively running under full accreditation — we don’t mark methods as accredited on reports unless we can confirm they’re current in scope. That distinction sounds basic. In practice, it’s not uniformly observed across the industry.

ISO 17025, maintained rigorously and applied honestly, is one of the strongest signals of analytical credibility in commercial testing. The value of that credential lives in the details — and those details are public, searchable, and worth verifying before your product’s quality documentation depends on them.

---

Written by Nour Abochama, Vice President of Operations, Qalitex Laboratories. Learn more about our team

Talk to our team about your testing needs. Contact us

Related from our network

• Understanding FDA Audit Readiness for Supplement Manufacturers — Aurora TIC covers the 21 CFR compliance steps labs and manufacturers need before an FDA inspection.
• Supplier Qualification and Raw Material COA Verification — Ayah Labs explains what a credible supplier COA should include and how to qualify raw material vendors analytically.