ISO 17025 quality system: which documents do you need?
The quality system of a laboratory under ISO/IEC 17025 has three layers: the management document, the procedures and work instructions, and the records of what you actually do. This is a structure of its own, not one taken from the standard. The standard requires that your documents are up to date and demonstrably used. For the application to the RvA (Dutch Accreditation Council), this is the basis of the file you submit with your accreditation application. How to check that file is set out in the checklist. The records are covered further down under records as evidence.
The chapter on the management system (8) has two options. Option A means you fill in the requirements of 8.2 to 8.9 yourself. Option B is for laboratories that already have an ISO 9001 system. The RvA then does not assess ISO 9001 itself, but whether the requirements of 8.2 to 8.9 are met (INF002, section 8.1). You explain the difference between the two standards on ISO 17025 or ISO 9001.
Many laboratories think they must write a thick handbook. That is not necessary. A short handbook with a good document list and well-kept records works better than a bundle nobody uses.
The three layers of the quality system
| Layer | What it contains | Example |
|---|---|---|
| 1. Management document | Policy, objectives, organisation, responsibilities, scope | A short quality manual |
| 2. Procedures and work instructions | How you work, per process and per method | Procedure for sample receipt, work instruction for a titration |
| 3. Records | Evidence that you did it | Receipt form, raw measurement data, calibration log |
The first layer answers “what do we want?”, the second “how do we do it?”, the third “what have we done?”. An auditor tests the three layers in that order, but often starts with the third.
Which documents are the minimum?
The list below is a workable starting point and not an official list. Which documents you need depends on your activities and your scope. The RvA’s own list is under what the RvA asks for in an application.
| Document | Purpose | Part of the standard |
|---|---|---|
| Quality manual or management document | Policy, organisation, responsibilities | Chapter 8 (option A or B) |
| Document list | Overview of all documents and their version | Chapter 8 |
| Document control procedure | How you create, change and withdraw documents | Chapter 8, records 8.4 |
| Procedure for requests and contracts | How you review a request before you start | 7.1 |
| Procedure for samples or test items | Receipt, identification, storage | 7.4 |
| Work instructions per method | Step-by-step performance of each accredited method | 7.2 |
| Equipment and calibration procedure | Management, calibration and control of measuring equipment | 6.4 and 6.5 |
| Reporting procedure | Layout and content of results | 7.8 |
| Complaints and nonconformities procedure | Handling complaints and nonconforming work | 7.10 and 8.7, see nonconformities |
| Internal audit and management review procedure | Checking the system and review by management | 8.8 and 8.9 |
The numbers come from the RvA explanatory notes on the standard (INF002). Those notes help you translate the standard into your own file.
What makes a document checkable?
A document that an auditor can test has four features. They look small, but they largely determine the outcome.
A document without a version number, date and owner cannot be checked by an auditor. Then nobody knows which version applies.
- Title and version. Each document has a unique name and a version number.
- Date and owner. Who is responsible, and when was it last revised?
- Approval. Who released it?
- Cross-reference. Is there a clear link to the document list?
What the RvA asks for in an application
The RvA has its own list of documents that you submit with an application. It is in annex A of ASR105 (accreditation specification for testing laboratories). A calibration laboratory uses ASR106 (accreditation specification for calibration laboratories). For an initial application, this includes the following:
| Document | Why the RvA wants to see it |
|---|---|
| Quality manual or comparable documentation | How you work, at management level |
| Cross-reference table between the standard and your system | Where each requirement appears in your own documents |
| Report of the internal audit and the management review | That your system checks itself |
| Work instructions for all tests you apply for | How the method is performed exactly |
| Validation or verification file | That the method works for your application |
| Results of internal quality control | That you monitor your own work daily |
| Results and plan of PT or ILC, see proficiency testing | That your work agrees with that of others |
| Example of a report to the client | That your report meets the requirements |
The RvA also asks for forms and proof of registration with the Chamber of Commerce (Kamer van Koophandel). For the current application route, see the application page.
Records as evidence
Records are the most underrated part of the system. A procedure that says you record every sample receipt says nothing as long as the form stays blank. The auditor picks an order and asks for everything that belongs to it: request, receipt, measurement, report and check.
A fictional example. A soil analysis laboratory receives a soil sample for a heavy metals test. The record chain looks like this:
| Step | Document or record (fictional) | What the auditor sees |
|---|---|---|
| Request | Order confirmation with scope check | Is the method accredited? |
| Receipt | Receipt form with sample label and condition | Is the sample identifiable and intact? |
| Analysis | Raw measurement data, processing sheet, calibration of the instrument | Is the result traceable? |
| Report | Test report with reference to the method | Is the report correct and complete? |
| Check | Internal review of the report by a second analyst | Was the check carried out? |
The records must also show which equipment you used for a test or calibration. If you have several identical devices, it must be visible which one was used (INF002, 7.5.1). Such a chain makes the difference between a good system and a system that exists only on paper. It does not need to be complicated. It needs to be complete.
Document control in practice
Document control is often the first point where a laboratory gets stuck. Everyone works with copies, and nobody knows which version applies. A simple solution:
- Keep all documents in one controlled folder or system.
- Make a document list with version, date and owner.
- Remove old versions from the workplace, or mark them as withdrawn.
- Record who may change a document and how the change is approved.
If you work digitally, there are also requirements for the software itself. These are set out on the page about LIMS and lab software.
A quality officer who checks the document list once a quarter prevents many problems. For digital records, also test restoring a backup. The RvA expects you to check the working of the backup periodically, including fully restoring data (INF002, 8.4.2). This also applies to an external ICT supplier.
Common mistakes
- Too many documents. A system with two hundred loose documents is harder to maintain than one with thirty good ones.
- Procedures nobody follows. If the shop floor works differently from the procedure, either the procedure is wrong or the shop floor is.
- Records filled in afterwards. Auditors recognise this from dates and handwriting.
- No risk register. The standard requires actions to address risks and opportunities (8.5). The RvA expects documented measures that you check for effect, but no mandatory overall list.
- No link between the layers. A procedure refers to a form that does not exist, or the other way round.
Frequently asked questions
Must my quality manual follow the standard, chapter by chapter? It helps to use the structure of the standard as a checklist, but the manual does not have to be divided by chapter. Make sure every requirement can be found somewhere.
Can I reuse an ISO 9001 quality manual? You can use it as a basis, but ISO 17025 requires specific things such as method validation and uncertainty. Read the difference on the page ISO 17025 or ISO 9001.
How long must I keep records? The sources used here do not state a fixed period. Your own procedure sets the period. Check the requirements of your clients and your sector.
Who is responsible for the quality system? A named person with sufficient authority and time. This does not have to be a separate job function, but it must be written down.