ISO 17025 Internal Audit Checklist (Downloadable)
A practical ISO/IEC 17025:2017 internal audit checklist walks a lab quality manager through all five mandatory clauses — 4 (General Requirements), 5 (Structural), 6 (Resource), 7 (Process), and 8 (Management System) — plus the Option A/B decision, so gaps surface before the accreditation body finds them. Use it as a structured self-assessment ahead of every internal audit cycle, not as a substitute for the standard itself.
Internal audits are one of the few ISO 17025 requirements that laboratories consistently underinvest in — not because teams don't understand the standard, but because "audit prep" usually means re-reading the clauses the week before, rather than working through a checklist built for how a lab actually operates day to day. This guide turns the five mandatory clauses into a checklist you can run against your quality management system (QMS) before your next internal audit, surveillance visit, or reassessment.
Why an internal audit checklist matters
ISO/IEC 17025:2017 Clause 8.8 requires laboratories to conduct internal audits at planned intervals to verify the management system continues to conform to the standard's requirements and to the laboratory's own documented procedures. An internal audit that only skims the paperwork misses the point: assessors from accreditation bodies (UKAS, ANAB, A2LA, and equivalents) are trained to trace evidence end to end — from a calibration certificate, through the uncertainty budget, to the specific test report that relied on it. Your internal audit should do the same tracing before an external assessor does.
A checklist-based approach also creates a defensible audit trail of its own: dated records showing what was checked, what was found, and what corrective action followed. That trail is itself audit evidence for Clause 8.8 and 8.9 (management review).
The checklist: Clauses 4 to 8
Clause 4 — General Requirements (Impartiality & Confidentiality)
- Is there a current, signed impartiality policy, and can staff explain what it means in practice?
- Are risks to impartiality (commercial pressure, ownership links, staff incentives) identified and reviewed on a defined schedule?
- Is client and results confidentiality documented, and are third-party access arrangements (subcontractors, IT support) covered by confidentiality undertakings?
- Are complaints and disputes relating to impartiality logged separately from routine non-conformances?
Clause 5 — Structural Requirements
- Is the laboratory's legal identity and organisational structure documented and current (org chart matches reality)?
- Are the responsibilities, authorities, and interrelationships of personnel who manage, perform, or verify work affecting results clearly defined?
- Is there a documented technical manager (or equivalent) with defined authority over technical operations?
- Is deputisation for key roles (quality manager, technical signatories) documented for absence cover?
Clause 6 — Resource Requirements
- Personnel: Are competence records current for every analyst, including initial competency assessment and ongoing monitoring against defined criteria?
- Facilities and environment: Are environmental conditions that affect results (temperature, humidity, vibration) monitored, recorded, and within documented limits?
- Equipment: Does every item of equipment affecting results have a unique identifier, a calibration status, and a documented calibration or verification interval?
- Metrological traceability: Can each calibration be traced to a national or international measurement standard, with the chain of certificates available on request?
- External products and services: Are subcontracted calibrations, reference materials, and consumables evaluated and approved before use, with supplier records retained?
Clause 7 — Process Requirements
- Is every method used a validated (for non-standard/lab-developed methods) or verified (for standard methods) method, with the validation or verification evidence retained and referenced?
- Is measurement uncertainty estimated and documented for each method, using a defined and justified approach?
- Are sampling plans (where sampling is in scope) documented and available to the client on request?
- Is the handling of test/calibration items — receipt, unique identification, storage, retention, disposal — documented and followed consistently?
- Does the laboratory have a documented procedure for evaluating measurement uncertainty and for assuring the validity of results, including proficiency testing or interlaboratory comparison participation?
- Do reports and certificates contain all elements required by Clause 7.8 (and 7.8.6/7.8.7 for statements of conformity or opinions and interpretations, where applicable)?
- Is there a documented procedure for complaints, and for identifying and controlling non-conforming work?
Clause 8 — Management System Requirements
- Option A/B decision confirmed: Has the laboratory formally decided and documented whether it operates under Option A (a standalone management system meeting all of Clause 8's specific requirements) or Option B (a management system conforming to ISO 9001 that also satisfies Clause 8's intent)? This decision should be recorded and understood by the quality manager and technical staff alike.
- Is document control in place, with controlled versions, defined review cycles, and no obsolete documents in active use?
- Are records — technical and quality — retained for the defined period, legible, and retrievable within a reasonable timeframe?
- Are risks and opportunities to the management system identified and actioned, with evidence the actions were evaluated for effectiveness?
- Is there a documented improvement process, including handling of feedback (positive and negative) from clients?
- Are corrective actions for non-conformances root-caused, not just closed on a symptom fix, with evidence the action prevented recurrence?
- Has an internal audit been conducted within the planned interval, covering all applicable clauses and the full scope of accreditation?
- Has management review taken place at the planned interval, with all required inputs (audit results, client feedback, corrective actions, changes to internal/external issues) addressed and outputs actioned?