The 7 Most Common ISO 17025 Nonconformities — And What They Mean for Your Test Results

There’s a question supplement and cosmetic brand managers ask us almost every week: “Does your lab have ISO 17025 accreditation?” It’s the right question. But the follow-up — the one almost nobody asks — is this: “And what did your last assessment find?”

ISO 17025 accreditation doesn’t mean a lab is perfect. It means the lab has been assessed against a rigorous international standard and operates within a formal quality management system designed to catch and correct its own failures. Nonconformities are expected to surface during assessments. How a lab responds to them is where competence actually shows.

After years of navigating A2LA assessments and internal quality reviews at our Irvine facility, I’ve watched the same gaps emerge with striking regularity — not just internally, but in conversations with peers across California’s testing community. These aren’t exotic failures. They’re structural weaknesses that any well-resourced lab can develop if sustained attention drifts. And they have direct consequences for the numbers on your test report.

If you’re selecting a testing lab, or trying to understand why your results vary between providers, knowing these nonconformities will make you a far sharper buyer.

Why ISO 17025 Nonconformities Are Your Business, Not Just the Lab’s

The 2017 revision of ISO 17025 replaced the 2005 version and introduced stronger requirements around risk-based thinking (Clause 8.5) and formal impartiality obligations (Clause 4.1). The transition deadline was June 2021, meaning any accredited lab operating today should be fully running against the current standard — not grandfathered rules from the previous edition.

When an accreditation body like A2LA (the American Association for Laboratory Accreditation) or PJLA (Perry Johnson Laboratory Accreditation) conducts an on-site assessment, their assessors document gaps as either minor or major nonconformities. A minor gap might mean a calibration record is missing a required data field. A major nonconformity — say, undocumented method validation for a test the lab has been running commercially for 18 months — typically requires a corrective action plan submitted within 60 to 90 days before accreditation scope can be maintained or extended.

Laboratories rarely advertise their nonconformity history. But you can request their current accreditation certificate and scope directly, and you can call the accreditation body to confirm the lab’s status and whether any corrective action plans are currently open. What follows are the seven gaps most worth understanding — and asking about.

The Nonconformities That Surface Most Often

1. Measurement Uncertainty Not Calculated — Clause 7.6

This is, consistently, the single most cited source of major nonconformities in ISO 17025 assessments. Clause 7.6 requires that labs identify and document measurement uncertainty for all quantitative test results. In practice, many labs calculate uncertainty rigorously for their flagship methods and quietly skip it for newer or lower-volume analytes added to scope over time.

Why it matters to you: every number on a test report is incomplete without context. If a lab tells you your protein powder contains 1.8 ppm arsenic, but cannot provide the measurement uncertainty of that result, you genuinely don’t know whether the true value is closer to 1.2 ppm or 2.4 ppm. With California’s Prop 65 limit for inorganic arsenic set at 10 micrograms per day, that margin can be the difference between a clean compliance determination and a required reformulation.

A properly accredited lab calculates expanded uncertainty at a 95% confidence interval — typically expressed as k=2 — for every method in its accredited scope. Ask for a sample test report before you commit. If uncertainty values are absent, ask why, and whether they can be provided on request for every result, not just flagged ones.

2. Calibration Records Without Documented Traceability — Clauses 6.4 and 6.5

ISO 17025 requires that all equipment used in testing be calibrated at defined intervals, with results traceable through an unbroken chain to national measurement standards — in the US, through NIST. Clause 6.5, on metrological traceability, is where labs frequently stumble, particularly for reference standards and ancillary equipment that technicians use daily without much thought.

The nonconformity isn’t always a missing calibration sticker. More often, it’s a calibration certificate from an outside provider that itself lacks documented traceability. A lab sends its ICP-MS sample introduction temperature sensor to a local calibration company; that company’s own reference standards were never verified against NIST-traceable references. Now the lab’s quantitative metal data has a traceability gap that voids the accreditation requirement — even though every technician followed the SOP perfectly.

Ask your lab which accreditation body certifies their external calibration providers. ISO/IEC 17025-accredited calibration labs — as opposed to ISO 9001-registered shops — are what the standard requires. It’s a specific question that immediately separates labs that have thought carefully about their supply chain from those that haven’t.

3. Method Validation Records Insufficient — Clause 7.2.2

When a lab develops or adapts a test method — rather than running an established standard like AOAC 2007.01 or USP <232> verbatim — Clause 7.2.2 requires full validation before that method is used for client testing. The required parameters include linearity, accuracy (percent recovery), precision (repeatability and intermediate precision), limit of detection, limit of quantitation, selectivity, and robustness.

Labs often conduct these studies. The nonconformity arises in the documentation: the raw validation data sits in a shared drive folder, the formal summary report was never reviewed and approved by a second analyst, and the method file doesn’t reference the validation study by document number. An assessor cannot verify that the method performs as claimed because the evidence isn’t organized, traceable, or formally approved.

For brands with products requiring non-standard methods — a proprietary botanical blend with no applicable pharmacopeial procedure, or a novel cannabinoid analyte — method validation records are worth requesting explicitly before work begins. A complete validation package should be available as a document, not a verbal assurance.

4. Personnel Competency Records Lapsed — Clause 6.2

Clause 6.2 requires that labs define the competency needed for each technical role, train personnel against those requirements, evaluate their technical performance at defined intervals, and document all of it. The administrative burden is real, and it’s where quality systems tend to erode first when labs are running at capacity.

Here’s the practical implication: if the analyst who ran your USP <61> microbial plate count has no documented training record for that methodology — or if their last competency evaluation was three years ago and the method has since been updated — the lab cannot demonstrate, under the accreditation standard, that the result was produced by a qualified person.

A common pattern: labs have strong onboarding documentation for new hires. Ongoing evaluation lapses. Annual HR performance reviews satisfy management; they don’t satisfy Clause 6.2. Robust labs conduct technical demonstrations, blind sample analyses, or witnessed procedures at regular intervals, typically annually at minimum, and they keep those records indexed by analyst and method.

5. Internal Audit Findings Not Closed — Clauses 8.7 and 8.8

Clause 8.8 requires labs to conduct internal audits at planned intervals covering the full management system. Clause 8.7 requires that nonconformities — from audits, client complaints, or external assessments — be addressed with formal corrective action plans that include root cause analysis and verified follow-through.

The typical failure isn’t that labs skip internal audits. It’s that they conduct them, document findings conscientiously, and then the corrective actions drift. Six months later, an external assessor asks to see evidence that a finding was resolved and confirmed effective. The quality manager has a folder of action items with no completion dates, no responsible owners, and no verification records confirming the fix actually worked.

A functioning corrective action system has five elements: root cause analysis, defined corrective steps, a named responsible party, a due date, and a verification step that confirms the fix addressed the root cause — not just the symptom. Labs that can walk an auditor (or a prospective client) through a completed corrective action from their most recent internal audit cycle are demonstrating a quality culture, not just quality paperwork.

6. Proficiency Testing Participation Gaps — Clause 7.7.2

Proficiency testing (PT) programs require labs to analyze blind reference samples with known consensus values and report results that are then scored against the peer group. ILAC — the International Laboratory Accreditation Cooperation — and its member bodies provide guidance on PT frequency and scheme selection. Clause 7.7.2 requires that labs participate in PT as ongoing evidence of technical competence.

In the US, programs like AAFCO (for feed and fertilizer), NSF International’s supplement proficiency schemes, and FAPAS (for food safety) are commonly used. A lab’s result is compared to the consensus mean; a Z-score between -2 and +2 is satisfactory. Outside that range, the lab must investigate, document root cause, and demonstrate corrective action.

Where labs get cited: maintaining PT participation for some analytes in their scope but neglecting others added more recently, or — more seriously — failing a PT round and filing no documented investigation. One PT failure isn’t disqualifying; it happens to every lab eventually. Undocumented, uninvestigated failures are a different matter entirely. Ask your lab which PT programs they participate in and for which analytes. It’s public information they should be comfortable sharing.

7. Technical Records Incomplete or Inadequately Protected — Clause 7.5

Clause 7.5 requires that technical records be retained for a defined period (typically a minimum of five years for most test categories), be legible and unambiguous, and be protected against unauthorized modification. For digital systems, that last requirement — protection against modification — is where gaps increasingly appear.

Lab data systems that allow technicians to overwrite raw chromatography files, delete instrument data, or re-integrate spectral peaks without a documented audit trail create a Clause 7.5 nonconformity. And it creates something more significant: a data integrity concern that an FDA inspector would find just as troubling as an accreditation assessor.

For labs producing records that may be submitted to FDA — as part of a dietary supplement recall response, a cosmetic safety substantiation, or a food safety investigation — 21 CFR Part 11 sets parallel requirements for electronic records. A lab that has addressed Clause 7.5 rigorously has usually addressed Part 11 compliance as a byproduct.

What to Ask Before You Sign a Testing Agreement

Knowing these seven gaps converts a vague “do you have ISO 17025?” question into a specific, revealing conversation. Before you hand over samples, ask:

“Can I see your current A2LA certificate and scope of accreditation?” Verify it’s current, confirm the expiration date, and check that your specific test method — not just the analyte category — is listed in scope. A lab accredited for “heavy metals in dietary supplements” may not have USP <232> specifically in scope.

“What did your last external assessment find, and how were those findings closed?” A lab that answers this question openly and can produce documentation is operating a healthy quality system. Defensiveness or vagueness is informative in its own right.

“Do you report measurement uncertainty on all test reports?” If the answer is “we can provide it on request,” ask for it included on every report, proactively, as a standard deliverable.

“Are your external calibration providers A2LA-accredited or NIST-traceable?” This confirms the traceability chain is intact all the way up. A yes answer with a name is better than a yes answer alone.

The goal isn’t to find a lab with zero nonconformities — that lab doesn’t exist. The goal is to find one that takes nonconformities seriously, investigates them with genuine root cause discipline, and closes them with documented evidence. That discipline is what makes ISO 17025 accreditation meaningful rather than just a logo on a certificate.

---

Written by Nour Abochama, Vice President of Operations, Qalitex Laboratories. Learn more about our team

Talk to our team about your testing needs. Contact us

Related from our network

• FDA Audit Readiness and 21 CFR Documentation Best Practices — Aurora TIC covers regulatory consulting strategies for supplement and medical device manufacturers preparing for FDA inspection.
• How to Evaluate a Canadian NHP Testing Laboratory — Androxa’s guide to Health Canada-compliant lab selection and what GMP compliance documentation should include.
• Supplier Qualification and COA Verification for Raw Materials — Ayah Labs on how accredited contract labs evaluate incoming raw material documentation and what a credible COA actually contains.