LIMS and ISO 17025: what does the standard require from lab software?
ISO/IEC 17025 does not prescribe which software package you use. It does require that your data, records and traceability are reliable, even when they are stored digitally. A LIMS (laboratory information management system) is the program where much of that data lives: samples, orders, results and calibrations. The requirements on technical records (section 7.5) and on the management of data and information (section 7.11) determine what your LIMS must be able to do. The RvA (Dutch Accreditation Council) assesses the result, not the brand. Also read the page on the quality system, because the LIMS belongs on that document list. New to this? Start with the explanation of ISO 17025.
A LIMS is not a requirement. A well-maintained spreadsheet can comply if it is managed properly. The problems start when several people, several versions and several clients are involved.
What does the standard say about data?
The standard has two sections that are directly relevant to software. Section 7.5 covers technical records: what you must record so that a result can be reconstructed. Section 7.11 covers the management of data and information, including computers and systems. In its explanatory notes (INF002), the RvA explains a number of points:
| Point | What the RvA says | Example (fictional) |
|---|---|---|
| Standard software (7.11.2) | Manage the versions in use and validate the software appropriately when it changes | An update to the calculation package is first tested with known data |
| Internal ICT department (7.11.2) | Even when an internal ICT department manages the system, the work for the laboratory must be validated | The ICT department of a parent company hosts the LIMS |
| Calculations and transfer (7.11.6) | Check them systematically. This is not the same as periodically: you may do it on a risk basis, with an eye to the whole software and hardware environment | A spot check after every new connection, instead of once a year |
| Backup (8.4.2) | Check periodically that the backup works, including fully restoring data | A test restore of the database every quarter |
| Cloud (4.2.1) | The laboratory remains responsible for the information, including in a cloud service | The supplier hosts, the laboratory manages access |
| Information security (6.6) | An ISO 27001 certificate held by the ICT supplier does not cover all requirements of ISO 17025 | The laboratory also assesses the supplier itself |
| Automatic release (7.8.1.1) | Automated release of results is allowed if you set it up adequately and on a risk basis | Results within a logical range pass automatically |
An auditor tests software by tracing a result back. Can you go from the report to the raw data, the instrument settings and the calibration, without manual work? If so, the system works in practice.
Checklist: what must your LIMS be able to do?
Use this list as a starting point when choosing or assessing a system. Not every function has to be built in. What matters is that the whole chain can be shown to work.
| Function | Why it is needed | Question for the supplier |
|---|---|---|
| Unique sample identification | Traceability from sample to report | How is a sample uniquely linked to an order? |
| Audit trail (record of changes) | Changes to technical records must stay traceable (section 7.5) | Are changes recorded with user and time? |
| Permissions per role | Only authorised people enter or change results | How are roles and permissions managed? |
| Instrument connection | Raw data arrives directly without retyping | Which instruments and file formats are supported? |
| Version control of methods | The system uses the correct version of a method | How are method versions recorded? |
| Calibration management | Measuring equipment and references are linked to the result | Can the system show calibration data and expiry dates? |
| Report generation | Reports contain the correct data and references | Can the reporting show the method and uncertainty? |
| Backup and recovery | Data is not lost in a failure | How often, where, and how quickly can recovery take place? |
| Export | You can move your data if you change supplier | In which format and with what completeness? |
Fictional example: a spreadsheet that grew too big
A fictional environmental laboratory works with one Excel file per order. At first, this goes well. After three years and twelve staff members, the following problems arise.
| Situation (fictional) | Risk according to the standard | Solution |
|---|---|---|
| An analyst retypes measurement values from the instrument | Errors in the result, not traceable | Connection with the instrument, or a mandatory double check |
| Files in different versions on different laptops | Unclear which version applies | Controlled folder with version control |
| Changes without a trace | No audit trail | System that logs changes, with user and time |
| Laptop of a departed employee lost | Loss of data | Central storage with backup |
In the end, the laboratory chooses a LIMS with an audit trail and a connection to two instruments. The spreadsheet remains for the calculation sheets, but those sit in a controlled system.
How do you choose a LIMS sensibly?
Start with the requirements, not with the supplier’s feature list. Many systems promise a lot, but the question is what your laboratory needs.
- Make a list of your accredited methods and your instruments.
- Describe for each process where data is created, who enters it, and where it goes.
- Decide which data you must be able to reconstruct, and for how long.
- Ask suppliers for a demonstration with your own scenario, not with their sample data.
- Record the choice and the validation of the system in your quality system.
That last step is important. Software you use for results must be validated and managed (section 7.11). Calculation modules also belong with your measurement uncertainty, because a calculation error affects every result.
Step-by-step plan for introduction
Introducing a LIMS is more than installing it. It affects your processes, your staff and your quality system. A phased approach prevents you from having to manage two systems at once without clarity.
Map the current situation
Which data is created where, who enters it, and which records already exist? This is also the moment to see where you already deviate from your own procedures.
Choose a pilot
Take one method or one order type. This lets you test the system without bringing the whole laboratory to a standstill.
Validate the system for its purpose
Test whether the calculations, the reporting and the audit trail do what your procedure says. Record the test results in your quality system.
Migrate historical data in a controlled way
Decide which old data you transfer and which you keep in the old format. Check a sample of the transferred data to confirm it is correct.
Train, evaluate and expand
Let staff use the system in the pilot, improve the work instructions, and only then expand to other methods.
Audit and quality software alongside a LIMS
A LIMS stores the laboratory data: samples, results and reports. Quality management software does something different. It manages documents, internal audits and corrective actions. Many laboratories use both, or keep the quality part in a separate package.
For an initial application, the RvA requires that internal audits have confirmed that you meet all requirements for the whole requested scope (INF002, 8.8). An audit module can record the audit plan and the findings. Do not use it as a replacement for the checklist: the software keeps the outcome, but the auditor assesses the work. The requirements of 7.11 also apply to this package if it manages results or records.
Common mistakes
- Choosing software without describing your processes. The system is adapted to the software, not the other way round.
- Switching off the audit trail to make things faster. You can then no longer trace changes to records.
- Not testing backups. A backup that has never been restored is not a backup.
- All data in one shared folder. Permissions per role are missing, and you cannot show who did what.
Frequently asked questions
Is a LIMS required for ISO 17025? No. The standard requires reliable records and data, but it does not prescribe the means. A well-managed spreadsheet can comply, as long as it meets the same requirements.
Does the software have to be accredited? Software is not accredited itself. The laboratory must show that the software is suitable for its purpose and works correctly.
What if I change LIMS? Then you must be able to export your data and keep the history. Make sure you arrange this in the contract, not only when you leave.
Does a cloud solution count differently? The requirements stay the same. You must know where the data is stored, who has access to it, and how backups and recovery are arranged.