ISO/IEC 17025
ISO/IEC 17025:2017 — General requirements for the competence of testing and calibration laboratories
The records the standard asks for, held in one place and hard to alter after the fact.
ISO/IEC 17025:2017 is the competence standard for testing and calibration laboratories. Most of it is about evidence — that the analyst was trained, the instrument was in calibration, the method was validated, the result was checked by someone else, and that all of it can be reconstructed years later. ErgoLIMS is built around holding that evidence as a by-product of doing the work, rather than as a separate exercise before an assessment.
Who this is for: Quality managers preparing for accreditation or a surveillance visit, and lab directors deciding whether a LIMS will survive an assessor reading it.
Impartiality and confidentiality
Confidentiality is enforced by the data layer, not by a policy document. Every query is scoped to the tenant, so one lab cannot read another lab’s records even if a URL is guessed. Inside a lab, role and per-user permissions decide who sees which department’s work.
- Tenant isolation applied at query level, not by application convention
- 239 permissions across 67 resources, assignable per role and overridable per user
- Analyst conflict restrictions: a named user can be barred from a specific customer’s jobs
Structure, roles and authority
The org chart is a real structure in the system — sites, departments, roles and authorised signatories — and it is what the software checks against when someone tries to approve something.
- Department hierarchy with head-of-department and authorised-signatory registers
- Separation of duties: the analyst who entered a result cannot be the one who approves it
- Signatory snapshot stored on each issued report, so a later personnel change cannot rewrite history
Personnel, equipment and reference materials
Competence and calibration are enforced at the point of use. An instrument whose calibration has lapsed stops being selectable for results, rather than appearing in a report that someone notices during the assessment.
- Training and competence records per analyst, per method
- Instrument register with calibration and maintenance schedules, and auto-lockout on expiry
- CRM/RM register with traceability and expiry
- Externally provided services — subcontracted tests tracked with the subcontractor on record (§6.6)
Methods, uncertainty and quality control
The technical clauses are where a generic document system stops being enough. Method validation records, uncertainty budgets and QC rules are first-class objects here, and the QC rules can block a run rather than simply flag it afterwards.
- Method validation: LOD/LOQ, linearity, recovery, precision held per method
- Measurement uncertainty budgets — GUM and top-down approaches (§7.6)
- Calculation engine wired into result entry: formula, significant figures and expanded uncertainty computed on save, with an execution log
- Levey-Jennings charts with Westgard rules that can block a run, not just annotate it (§7.7)
- Chain of custody from registration, with sample condition on receipt (§7.4)
- Out-of-specification investigations, Phase 1 and Phase 2 (§7.7)
- Report amendments as a new report with a new number — the superseded one stays readable (§7.8.8)
- Complaints register with lifecycle and outcome (§7.9)
The management system
Option A management-system records live alongside the technical work, so an internal audit finding can point at the job it came from.
- Document control with a Draft → Effective → Obsolete lifecycle and controlled distribution (§8.3)
- Non-conformances and CAPA with owners, due dates and effectiveness checks (§8.5, §8.7)
- Internal audits with a finding lifecycle (§8.8)
- Management review records with tracked actions (§8.9)
- Risk and opportunity register (§8.5)
What an assessor can actually pull
The point of the audit trail is that it answers questions in the room. Changes to controlled records are captured by a database trigger rather than by application code, so the trail does not depend on a route remembering to write it — and it records the actor and role, the record touched, and the old and new value of every field that changed.
- Actor, role, timestamp, record, and the old and new value of each changed field
- Immutability enforced at database level rather than in application code
- Nightly encrypted backups with weekly restore tests that actually restore
- Records retention policies with legal holds and dependency guards before anything is swept
Selecting ISO/IEC 17025 at signup turns these on
Selecting ISO/IEC 17025 at signup switches these on for the tenant automatically. They union with the industry pack — nothing is switched off.
accreditation code: iso_17025
What ErgoLIMS does not do here
Every vendor page lists what the software handles. These are the boundaries, so you find them now rather than three weeks into an evaluation.
- Accreditation is granted to a laboratory by an accreditation body, never to its software. ErgoLIMS holds evidence; it does not confer competence.
- ErgoLIMS itself is not an accredited or certified product, and no accreditation body has assessed it. Assessors assess your lab, using records the system holds.
- Some §7 records still depend on people doing the work — a validation study has to be performed before the system can store it.
- The electronic laboratory notebook and stability study modules are coming soon, so those clauses are handled outside the system today.
- Instrument interfacing (direct capture from balances and chromatography data systems) is on the roadmap, not shipped.
Questions we get asked
Labs that hold this
Other standards
Bring your assessor’s checklist
The most useful demo is the one where you read the audit trail yourself and try to break an authority check. We would rather you found the limits in the demo than after signing.