What Is ISO 17025 Accreditation and Why Supplement Brands Should Care

A supplement brand came to us earlier this year carrying a COA from a lab that advertised itself as “ISO-accredited” across its entire website. When we asked for the scope of accreditation, the brand went back to the lab and got a generic certificate — one that didn’t list a single test method, matrix, or analyte by name. Just a logo, a certificate number, and an expiration date. The product they were selling contained botanical extracts tested for heavy metals. The method used wasn’t listed anywhere in the lab’s publicly accessible scope document.

Their Amazon listing had already been flagged.

“What is ISO 17025” gets typed into search engines roughly 260 times per month in the US. It’s a fair question. But the more important one — the one most supplement brands never think to ask — is: what does this lab’s ISO 17025 accreditation actually cover? Those two questions have very different answers, and the gap between them is where brands get exposed.

ISO 17025 Is a Technical Competence Standard, Not a Quality Stamp

ISO/IEC 17025:2017 is an international standard developed jointly by the International Organization for Standardization and the International Electrotechnical Commission. It specifies the general requirements for the competence, impartiality, and consistent operation of testing and calibration laboratories.

That word — competence — carries a lot of weight. ISO 17025 isn’t a product quality certificate. It doesn’t mean every result a lab produces is correct. What it means is that the lab has demonstrated, to an independent third-party accreditation body, that it has the right equipment, trained personnel, documented procedures, measurement traceability, and quality management systems to produce technically valid results within a defined scope.

The current version, ISO/IEC 17025:2017, replaced the 2005 edition. Labs worldwide had a mandatory transition deadline of November 30, 2020. Any lab still referencing “ISO 17025:2005 accreditation” is advertising an expired credential — a red flag worth acting on.

The 2017 revision brought two substantive changes that matter for how labs actually operate. First, it aligned more closely with ISO 9001:2015 by embedding risk-based thinking into laboratory management decisions. Second, it strengthened requirements around impartiality — a direct response to growing industry concern about labs that face commercial pressure to produce favorable results, particularly in the supplement and food sectors. Those aren’t cosmetic updates. They reflect real problems the standard was designed to address.

The Scope Document Is the Only Thing That Actually Matters

Here’s the piece that most supplement brands miss entirely: a lab’s ISO 17025 accreditation is scoped. The accreditation body — typically A2LA (American Association for Laboratory Accreditation), PJLA (Perry Johnson Laboratory Accreditation), or NVLAP (National Voluntary Laboratory Accreditation Program, administered by NIST) — has evaluated the lab’s competence for specific test methods, specific matrices, and specific analytes.

A lab can be ISO 17025-accredited for heavy metals in drinking water by ICP-MS and simultaneously not be accredited for heavy metals in botanical supplement matrices. Those are analytically different challenges. Botanical matrices carry high organic loads, variable moisture content, and complex matrix interferences that don’t exist in clean water samples. If a lab hasn’t been formally assessed for that method-matrix-analyte combination, the “ISO 17025 accredited” language on your COA is technically accurate and practically misleading at the same time.

The scope document is publicly searchable. A2LA maintains a searchable directory at a2la.org where you can look up any accredited lab by name and download its current scope as a PDF. Before you sign a testing contract, pull that document. Look for your specific method — AOAC 2013.06 for heavy metals in food, USP <2232> for elemental impurities in dietary supplements, or AOAC 2012.19 for microbiology, as examples — alongside your product matrix. If it’s not there, ask the lab directly. A lab that’s genuinely accredited for your work will give you a specific, document-referenced answer in about two minutes.

Common Nonconformities: What Gets Labs Cited During Assessment

We’ve been through multiple A2LA assessments at our own facility, and we follow the patterns that come up at AOAC International symposia and in accreditation body technical bulletins. There are three areas where labs consistently get cited.

Measurement uncertainty not properly estimated or reported. Clause 7.6 of ISO 17025:2017 requires labs to estimate and report measurement uncertainty for quantitative results. Expanded uncertainty should be calculated using a coverage factor of k=2, representing approximately 95% confidence, and it should be reportable for each method and matrix combination. A surprising number of labs either skip this entirely or apply generic estimates that were never validated for their specific analytical conditions. If a COA you receive doesn’t mention measurement uncertainty, or can’t provide it on request, that’s worth flagging — not as a dealbreaker, but as a question that deserves a clear answer.

Calibration traceability gaps. Every piece of measurement equipment — balances, volumetric glassware, pipettes, the ICP-MS itself — requires calibration records traceable to national standards, which in the US means traceability to NIST. Assessors check calibration logs closely. Missing intervals, expired certificates, or documented use of equipment outside its calibrated range are straightforward nonconformities, but they’re also consistently found. Equipment operating outside its calibration window produces data of unknown reliability. That uncertainty flows directly into your COA.

Method validation documentation that doesn’t match commercial practice. Labs must validate each test method for each matrix they claim to test commercially. That means documented linearity, accuracy (typically expressed as spike recovery), precision (both within-run and between-run), limits of detection and quantitation, and selectivity against common interferences. When assessors request method validation records and the documentation was performed in a simpler matrix than what the lab actually tests — or was performed years ago and never re-validated after a major equipment change — that’s a nonconformity that can affect an accreditation decision. It also means the validation data underlying your COA may not reflect current performance.

ISO 17025 and 21 CFR Part 111: Two Frameworks, Two Different Purposes

One of the more persistent confusions we encounter: supplement brands asking whether their contract testing lab needs to be GMP-compliant. The short answer is no — but understanding why matters.

FDA’s 21 CFR Part 111 establishes current Good Manufacturing Practice requirements for dietary supplements. Those GMP requirements apply to supplement manufacturers, not to independent testing laboratories. A lab isn’t manufacturing a product; the GMP manufacturing framework doesn’t govern lab operations the same way it governs a contract manufacturer.

ISO 17025 is what governs a testing lab’s competence. These two frameworks serve different purposes and different entities in the supply chain. A supplement brand needs a manufacturer that follows 21 CFR Part 111 GMPs and an independent testing lab that holds ISO 17025 accreditation with a relevant scope. They’re complementary requirements, not interchangeable ones.

Where it gets more nuanced: FDA does reference laboratory methods within its GMP guidance for supplements. Under 21 CFR § 111.75, finished supplement products must be tested using appropriate specifications and validated laboratory methods. FDA has cited supplement companies in warning letters specifically for relying on test results generated by methods that weren’t properly validated — the same standard ISO 17025 requires labs to meet. The regulation doesn’t mandate ISO 17025 by name, but the technical competency it demands maps directly onto what ISO 17025 accreditation is designed to verify.

Why California Brands Face Extra Exposure Without Accredited Lab Data

If you’re selling supplements in California, Proposition 65 adds a layer that makes the quality of your testing data a legal question, not just a quality assurance one. Proposition 65 requires a warning label — or exposes you to 60-day notice enforcement actions by private plaintiffs — for any dietary supplement where a consumer could be exposed to lead above 0.5 micrograms per day, or cadmium, arsenic, or mercury above their respective MADLs.

In Prop 65 enforcement proceedings, the evidentiary weight of your COA matters significantly. COAs from labs whose scope of accreditation doesn’t cover the tested matrix, or from labs that weren’t assessed by an ILAC (International Laboratory Accreditation Cooperation) MRA-signatory accreditation body, carry substantially less weight in technical disputes. We’ve seen situations where brands attempted to use COA data to push back against enforcement notices, only to have the methodology challenged on the grounds that the lab wasn’t accredited under an ILAC-recognized body for that specific test.

California’s supplement market — and particularly the concentration of brands in the Southern California corridor — also means Amazon enforcement actions land more frequently here than in other regions. Amazon’s compliance teams have increasingly required third-party accredited lab documentation, and while enforcement is uneven, the direction of travel is clear. Getting ahead of that with a properly scoped ISO 17025 COA is straightforward risk management, not a premium service.

What to Ask Before You Sign a Testing Contract

Three documents. That’s what you should request from any lab before you commit.

First, the current accreditation certificate — and verify it independently through the accreditation body’s online directory rather than just accepting the PDF the lab sends you. Second, the full scope of accreditation, and confirm that your specific test methods and product matrices are listed. Third, a representative method validation summary for your product type. Not a generic document — one that covers your matrix.

If a lab hesitates on any of these, or provides vague answers about scope, treat that hesitance as information. Accredited labs that routinely operate within their scope have these documents ready. Those that don’t have them accessible are usually the ones you find out about the hard way.

---

Written by Nour Abochama, Vice President of Operations, Qalitex Laboratories. Learn more about our team

Talk to our team about your testing needs. Contact us

Related from our network

• FDA Compliance Consulting and 21 CFR Audit Preparation — Aurora TIC helps US brands navigate FDA regulatory frameworks, including GMP audits and documentation readiness.
• Supplier Qualification and Raw Material COA Verification — Ayah Labs supports global B2B clients with raw material testing, USP/Ph.Eur. monograph compliance, and supply chain qualification.