Measurement Uncertainty • Live Risk Management • Effective Internal Assessments
ISO/IEC 17025:2017 emphasizes both technical competence and a systematic quality management approach for testing and calibration laboratories. However, recurring nonconformities observed during Assessments tend to fall into three key areas:
- Measurement Uncertainty
- Risk Analysis
- Internal Assessments
Weaknesses in these areas do not stay isolated. They trigger a domino effect—impacting decision rules, reporting accuracy, supplier management, and even top management review. This article identifies common mistakes and explains how they affect compliance with specific clauses of the ISO/IEC 17025 standard.
1) Measurement Uncertainty: Incomplete Models = Incomplete Decisions
Relevant clause: 7.6 – Evaluation of Measurement Uncertainty
Common Mistake:
Only calibration uncertainty is included in the uncertainty budget, while key contributors—such as sample preparation, environmental influences, operator variability, and method performance—are ignored or considered negligible without justification. Measurement uncertainty should be provided as the best measurement uncertainty. It must be actively calculated based on the specific instrument used in each measurement. For example, if a 6-digit device is used for calibration, the uncertainty model should be updated accordingly to reflect the precision of that instrument. Calibration laboratories must use active measurement uncertainty.
Why This Impacts Other Clauses:
- 7.8.6 – Statement of Conformity: Without accurate uncertainty, decision rules are flawed, increasing false accept/reject risk.
- 7.7 – Ensuring Validity of Results: Control charts, proficiency tests, and repeatability studies must align with uncertainty claims.
- 7.2 – Method Selection and Validation: Method characteristics must support the estimated uncertainty.
- 7.1 – Review of Requests, Tenders and Contracts: Decision rules requested by customers must align with actual measurement capabilities.
- 7.8 – Reporting: If uncertainty and decision rules are missing or outdated in reports, they become misleading.
- 7.10 – Nonconforming Work: Incorrect uncertainty calculations discovered post-reporting require retrospective impact analysis.
- 6.5 & 6.4 – Metrological Traceability and Equipment: Uncertainties in calibration certificates (CMCs) must flow into your model.
Field Observations:
- “Uncertainty = value from calibration certificate”
- Decision rule applied, but no uncertainty is stated—or the value is outdated.
Actionable Tip:
Develop a component inventory, validate your uncertainty model, and update it periodically. Ensure alignment between your decision rules and reported uncertainty.
2) Risk Analysis: If It’s Not Dynamic, It’s Not Effective
Relevant clause: 8.5 – Actions to Address Risks and Opportunities
Common Mistake:
The risk register is static. Risks are not re-evaluated after corrective actions. Operational triggers—such as method changes, staff turnover, new suppliers, or updated decision rules—are not reflected in the risk analysis.
Why This Impacts Other Clauses:
- 8.7 – Corrective Actions: Without linking root cause to risk, issues tend to recur.
- 7.10 – Nonconforming Work: Weak risk monitoring = late detection.
- 8.9 – Management Review: Incomplete risk picture = flawed strategic planning.
- 6.6 – External Providers: Supplier risks (e.g., calibration labs’ capabilities, turnaround times, certificate content) go unmonitored.
- 6.2 & 7.2 – Personnel and Methods: Staff and method changes introduce unmanaged risk.
- 7.11 – Data & Information Management: IT risks (cybersecurity, backups, integrity) must be addressed.
- 7.1 & 7.8 – Contracts and Reporting: Risk from unaligned decision rules or customer specifications.
Field Observations:
- Corrective action is closed, but residual risk is not re-evaluated.
- IT/personnel/supplier risks are missing or barely mentioned.
Actionable Tip:
Mandate risk reassessment after corrective actions. Create a trigger list (e.g., new suppliers, staff changes, IT systems) to keep your risk register alive.
3) Internal Assessments: Ineffective or Non-Independent = Hidden Risks
Relevant clauses: 8.8 – Internal Assessments and 4.1 – Impartiality
Common Mistake:
Assessment programs are based on calendar schedules, not risk or performance data. Assessment reports lack evidence. Conflicts of interest—like Assessmenting one’s own department—are not addressed.
Why This Impacts Other Clauses:
- 8.9 – Management Review: Poor Assessments = weak input = misinformed leadership.
- 8.7 & 8.6 – Corrective Actions and Improvement: Surface-level Assessments lead to superficial corrective actions.
- 7.10 – Nonconforming Work: Process gaps go undetected.
- 8.3 & 7.5 – Document and Record Control: Without Assessments, document quality degrades.
- 6.2 – Personnel: Unqualified Assessmentors = ineffective Assessments.
- 4.1 – Impartiality: Self-Assessments damage credibility.
Field Observations:
- Same Assessment plan every year—no link to risk or performance.
- Assessment reports filled with “compliant” but lacking evidence.
- Assessmentor is responsible for the Assessmented process.
Actionable Tip:
Build your Assessment program on risk and performance data. Define a matrix of independence (who can Assessment whom) and enforce evidence-based reporting.
Quick Reference: Domino Effect Map
Weakness in 7.6 (Uncertainty) → Affects:
- 7.8.6, 7.7, 7.2, 7.1, 7.10, 6.5, 6.4
Weakness in 8.5 (Risk) → Affects:
- 8.7, 7.10, 8.9, 6.6, 6.2, 7.2, 7.11, 7.1, 7.8
Weakness in 8.8 (Internal Assessment) → Affects:
- 4.1, 8.9, 8.7, 7.10, 8.3, 7.5, 6.2
Sample Nonconformity Wording
7.6 – Measurement Uncertainty:
“Environmental and sample preparation influences are not quantified; decision rule applied without corresponding uncertainty in reports (7.6, 7.8.6).”
8.5 – Risk Management:
“Risk levels not updated post-corrective action; supplier switch not recorded in risk register (8.5, 8.7, 6.6).”
8.8 – Internal Assessment:
“A staff member Assessmented a process under their responsibility; no impartiality evaluation documented (8.8, 4.1).”
Checklist Summary
Measurement Uncertainty (7.6)
- All critical components considered
- Model is validated and current
- Decision rule matches report content
Risk Management (8.5)
- Risk updates are part of corrective actions
- Change triggers defined (e.g. supplier, staff, IT)
- Current risk status fed into management review
Internal Audit (8.8)
- Program based on risk/performance
- Audit independence ensured
- Reports contain objective evidence
Final Thoughts
The strength of your ISO/IEC 17025 system lies not in isolated compliance—but in how well your processes support and reinforce each other. Solid uncertainty models, dynamic risk analysis, and effective Internal Audits form the backbone of robust, Assessment-proof laboratory systems.
Getting these three right ensures smoother Assessments, reliable reporting, and sustained compliance.