Most calibration laboratories are good at calibration. That is rarely the problem. The problem arises when an assessor sits down with a list of samples and asks the laboratory to prove what it did, when it did it, who did it, which version of the method it followed, and how the result traces back to a national standard.
At that point, competence is not the thing under test; evidence is. A laboratory can hold decades of expertise and still pick up findings because the process the engineer used was revision 4 while the controlled copy on the server was revision 3, or because the manufacturer's handbook that the method depends on has never been treated as a controlled document.
That matters commercially as well as technically. Findings take time to close out, they can delay accreditation decisions, and they absorb weeks that have nothing to do with improving measurement.
Audit-ready means an assessor can request any document or record and receive it in the version that applies at the time, without anyone having to hunt for it.
Three things have to be true at once:
A useful test is to pick a certificate issued last year at random. Can you glean from it the method revision used, the reference standard's own certificate, the raw observations, and the competence record of the engineer who signed it, in two minutes? If not, the documentation is not yet audit-ready.
ISO/IEC 17025:2017 clause 8.3 requires the laboratory to control all documents, internal and external, that relate to meeting the standard. The word ‘external’ is where laboratories most often come unstuck.
Internal documents are the obvious set: the quality manual, procedures and work instructions, calibration methods, forms, and templates for capturing measurement data. Clause 8.3.2 sets out the controls, which, in plain terms, mean that documents are approved by authorised personnel before use, reviewed periodically and updated as necessary, uniquely identified, marked with revision status, available where the work happens, and protected from unintended use once obsolete, with suitable identification if they are retained.
External documents arrive from outside and then get used as though they were internal: manufacturers' handbooks, published standards the laboratory calibrates to, calibration tables, and accreditation body guidance. The laboratory cannot revise them, but it still needs to identify them, hold them at a known revision, and check that it is working to the current issue. A method citing a 2015 edition of a standard withdrawn in 2022 is a finding waiting to happen.
Technical records must contain sufficient information to repeat the calibration under conditions as close as possible to the original, which, in practice, means recording the result and everything that shaped it.
Clause 7.5 expects records to capture the original observations rather than only the tidy final figure, along with the date, the environmental conditions where these affect the result, the equipment and reference standards used, the calculations and derived results, and identification of both the person who performed the activity and the person who checked it. That last one is a common gap: a record with a result and no named checker cannot demonstrate that the laboratory's own verification step happened.
Amendments deserve particular attention. Where a record is corrected, both the original and amended data must be retained, along with the date of the alteration, what was changed, and who was responsible. Overwriting a spreadsheet cell destroys exactly the evidence the clause exists to preserve.
You need records showing each item of equipment is fit for use, and an unbroken documented chain linking your results to an appropriate reference. Clause 6.4 covers equipment, and clause 6.5 covers metrological traceability, meaning a result that can be related to a reference through a documented, unbroken chain of calibrations, each contributing to the measurement uncertainty.
On the equipment side, expect the assessor to look for a record that includes identification (including software and firmware version), manufacturer, model, serial number, location, and current calibration status, plus evidence that the calibration programme is reviewed and the results of any intermediate checks the laboratory has deemed necessary. Deciding to do intermediate checks and then not recording them is worse than not doing them, because the laboratory has documented a control it cannot evidence.
On traceability, UKAS policy TPS 41 (Edition 6, December 2022) sets out the acceptable sources for UK laboratories: services covered by the CIPM mutual recognition arrangement at a national metrology institute, such as the National Physical Laboratory (NPL) or NIST, or services provided by a laboratory accredited for those services by an accreditation body that is a signatory to the ILAC Arrangement. Anything else is a last resort requiring documented additional assurance. US laboratories accredited by A2LA, ANAB or NVLAP work to equivalent ILAC-aligned traceability policies.
Treat every certificate as a controlled output, not just a document you send to a customer. It is the one piece of your documentation that the outside world sees, and it is sampled at every assessment.
Clause 7.8 governs reporting, and for UKAS-accredited laboratories, LAB 5 (Edition 5, January 2025) sets out the details. For US laboratories, A2LA, ANAB and NVLAP set their own certificate reporting requirements. Certificates carry the result with its uncertainty and coverage factor (in the same unit as the measurand, or in relative terms), a statement of how the result is metrologically traceable, and, where a statement of conformity is given, the decision rule applied unless that rule is implicit in the specification quoted.
Two practical points follow. Each certificate needs a unique identifier, and there is no requirement for a numbering scheme separate from your document control; using the document reference provides a single traceable identifier from certificate to record rather than two unrelated sequences. And the certificate template is itself a controlled document, so a change to the traceability wording or uncertainty presentation should go through approval like any other revision.
Shared drives and spreadsheets fail at the point where the laboratory has to prove history rather than describe current practice. A folder tree shows what exists now, not what existed in March last year or who approved it.
The signs are familiar to most quality managers: filenames doing the work of version control, a superseded method still openable because someone kept a local copy, a distribution list maintained by hand and quietly out of date, and read-and-understood confirmations sitting in an email folder rather than against the document. None of these means the laboratory does poor work, but that it cannot easily prove otherwise.
Clause 8.4 adds the records dimension. Records must be legible, protected from unauthorised amendment, retrievable, and retained for a defined period, with access consistent with confidentiality commitments. A retention rule that nobody applies because the files sit across three servers is not really a control.
This is where a document management system helps, by removing the manual effort of proving what your laboratory already does well. Version history exists because the system retains it; distribution is inherent rather than maintained; obsolete versions become unavailable the moment they are superseded; and acknowledgements are recorded against the document.
Audit-ready documentation in a calibration laboratory is less about volume than retrievability. The assessor is not looking for a bigger quality manual. They are looking for the ability to pick a result, follow it back through the method, the equipment, the traceability chain, and the people involved, and find that every link holds. Sound practice that cannot be evidenced does not survive sampling, and controlled documentation is what converts competence into evidence.
It is also a proportionate exercise. A laboratory of twenty people does not need the cost, complexity, or rigidity of an enterprise quality platform to meet clause 8.3 and clause 8.4 properly. It needs its methods, templates, records, and outgoing certificates to be held in one place, with the history intact.
If your laboratory is preparing for ISO/IEC 17025 accreditation, or maintaining it on shared drives and spreadsheets, the Cognidox team can show you how document control works for a calibration laboratory: linked methods and templates, controlled certificate issue, recorded acknowledgements, and version history an assessor can sample against.
Book a demonstration with the Cognidox team and bring the documentation questions from your last assessment.
No. The standard requires that management system documents and records be controlled, not that you buy particular software, and a disciplined laboratory can meet clauses 8.3 and 8.4 on paper. In practice, a document management system is the straightforward way to maintain evidence of version history, approvals, and distribution without maintaining separate logs of who holds which copy.
ISO/IEC 17025:2017 does not set a single figure. Clause 8.4 requires a laboratory to define a retention period consistent with its own obligations, which in practice means considering contractual commitments, customer expectations, the recalibration interval of the items involved, and any sector or regulatory requirements that apply. Whatever period you set, the important part is applying it consistently and being able to retrieve records throughout it.
Accreditation attests to a laboratory's technical competence to carry out specific activities within a defined scope, which is what ISO/IEC 17025 and a body such as UKAS in the UK, or A2LA, ANAB or NVLAP in the US, deal with. Certification confirms that a management system meets the requirements of a standard, as with ISO 9001:2015. A laboratory can hold both, and ISO/IEC 17025:2017 (clause 8.1.3, Option B) allows the management system to sit within an established ISO 9001 system.