Auditing Laboratory Quality Systems: Calibration, Competence and Records

Auditing laboratory quality systems is one of the more demanding assignments an auditor can take on. Laboratories operate with a level of technical precision that most other workplaces do not, and the audit evidence you need to gather reflects that. Whether you are auditing a testing laboratory against ISO 9001, a medical device manufacturer against ISO 13485, or a calibration laboratory with ISO 17025 requirements woven into its quality system, the three areas that consistently reveal the most findings are calibration, personnel competence, and records management. Get these three right in your audit, and you will have a genuinely useful picture of whether the laboratory's quality system is working.

Why Laboratories Are Different to Audit

Most quality systems share the same structural bones. There is a policy, some objectives, a set of processes, and records to demonstrate conformity. Laboratories have all of that, but they also have something else: measurement. Everything a laboratory does ultimately comes back to whether its measurements are reliable. That means the quality system is not just administrative scaffolding. It directly underpins the technical output.

When you audit a warehouse or a service company, a gap in a training record is a problem, but it rarely threatens the validity of the work already done. In a laboratory, an out of calibration instrument or an incompetent analyst can invalidate months of test results. That raises the stakes considerably, and it should change how you approach your audit planning and sampling.

The other thing that makes laboratories distinctive is the density of documented information they are required to maintain. Method validations, uncertainty budgets, calibration certificates, analyst qualification records, environmental monitoring logs, chain of custody records. An auditor who is not methodical about sampling this material will either miss critical findings or spend the whole day drowning in paper without reaching a useful conclusion.

Calibration: What Auditors Actually Need to Verify

Calibration is the area where laboratory audits most often produce significant findings, and it is also the area where auditors most often scratch the surface without going deep enough. Checking that a calibration sticker is current is not auditing calibration. It is checking a date.

The Calibration Register

Start with the calibration register or equipment register. This should list every piece of measuring and test equipment that affects the validity of results. Ask the laboratory to walk you through how equipment gets added to the register. What triggers an entry? What happens when new equipment is purchased or borrowed? What happens when equipment is taken out of service?

Common findings here include equipment that is in active use but not on the register, equipment that has been removed from the register without any record of why, and registers that have not been updated to reflect the current state of the laboratory floor. A quick walk through the laboratory while comparing what you see to what is on the register is one of the most productive things you can do in the first hour of an on site audit.

Calibration Certificates and Traceability

Once you have confirmed the register is complete, pull a sample of calibration certificates. You are looking for several things. First, is the calibration traceable to national or international measurement standards? The certificate should state this explicitly, typically referencing the national measurement institute of the country where calibration was performed. In Australia, that is the National Measurement Institute. If a certificate does not demonstrate traceability, the calibration result is essentially unverifiable.

Second, does the certificate include measurement uncertainty? For a laboratory that uses the equipment to generate results with stated uncertainty, the calibration uncertainty needs to be factored into the uncertainty budget. Many laboratories have calibration certificates sitting in a folder that nobody has ever actually read in detail. Ask the quality manager or laboratory manager to explain how the calibration uncertainty from a specific instrument is reflected in the uncertainty budget for a test method that uses it. That question alone will tell you a great deal about how seriously calibration is managed.

Third, check the calibration interval. The certificate will show when the equipment was calibrated and when the next calibration is due. Cross reference this against the register and against what you observe in the laboratory. Out of date calibration is a straightforward finding, but the more interesting question is how the interval was determined. Was it set by the manufacturer? Has it been reviewed based on historical calibration data? Some laboratories set intervals once and never revisit them, even when calibration records consistently show drift approaching the tolerance limit.

In House Calibration and Verification

Not all calibration is performed by an external provider. Many laboratories perform in house calibration or verification checks on equipment between formal calibrations. Ask whether in house calibration is performed, and if so, how it is controlled. There should be a procedure, records of each check, and evidence that the person performing the check is competent to do so.

A common finding in this area is that verification checks are performed and recorded, but there is no defined acceptance criterion. The record shows a result, but there is nothing to compare it against. Without a defined pass or fail criterion, the check is decorative rather than functional.

For more detail on what auditors should examine when reviewing equipment and resources under quality system clauses, the article on auditing resources under ISO 9001 Clause 7.1 provides a useful framework that applies directly to laboratory contexts.

Competence: Going Beyond the Training Matrix

Competence in a laboratory setting is not just about qualifications. A person can hold a degree in chemistry and still be incompetent to perform a specific test method if they have not been trained, assessed, and authorised on that particular method in that particular laboratory. This distinction is fundamental, and it is one that auditors frequently miss when they accept a training matrix as sufficient evidence of competence.

Authorisation to Perform Test Methods

Ask the laboratory how analysts are authorised to perform specific test methods. There should be a process: initial training, a period of supervised practice, a proficiency assessment, and then formal authorisation. The authorisation should be documented and linked to specific methods or method groups. If an analyst leaves and a new person joins, the authorisation process should start again from the beginning, not be assumed based on the new person's general experience.

Pull a sample of test reports and trace them back to the analysts who performed the work. Then check whether those analysts are authorised for those methods at the time the work was performed. This is a targeted sampling approach that connects the output of the laboratory directly to the competence records. It is far more effective than simply reviewing the training matrix in isolation.

Proficiency Testing and Interlaboratory Comparisons

For laboratories that need to demonstrate ongoing competence, participation in proficiency testing schemes or interlaboratory comparisons is a critical indicator. Ask whether the laboratory participates in any proficiency testing programs. If yes, request records of recent participation and the outcomes. What happened when a z score was unsatisfactory? Was there an investigation? Was there corrective action? Were affected results reviewed?

If the laboratory does not participate in any external proficiency program, ask how it otherwise verifies that its results are comparable to those produced by other laboratories. This is a legitimate question even for laboratories operating only under ISO 9001, because the standard requires that monitoring and measurement be conducted in a manner that produces valid results.

Competence Records for Specific Roles

Do not limit your competence review to analysts. Sample managers, signatories, and technical reviewers are also roles with specific competence requirements. A laboratory that issues reports under a technical signatory's name should be able to demonstrate that the signatory has the technical background and current knowledge to take responsibility for those results.

Also check what happens when a competent person is absent. Is there a deputy? Is the deputy also authorised? Or does work simply stop, or worse, get performed by someone who is not authorised? The contingency arrangements for key competence roles often reveal gaps that the normal day to day operation conceals.

The article on auditing competence and training records covers the broader principles of how to sample and evaluate competence evidence across any type of organisation, and those principles apply directly here.

Records: The Evidence Trail That Makes or Breaks a Laboratory Audit

Laboratories generate an enormous volume of records. Raw data, worksheets, instrument printouts, chain of custody documentation, sample receipt records, test reports, review and approval records. The challenge for an auditor is not finding records. It is determining whether the records are complete, legible, traceable, and protected from unauthorised alteration.

Raw Data Integrity

Raw data is the foundation of every test result. Ask to see the raw data for a sample of completed tests. Can you trace from the final report back to the original instrument output? Is the raw data stored separately from the final report, or is it embedded in a spreadsheet that could be overwritten? Are corrections to raw data made in a controlled way, with the original entry still visible, the correction initialled, and a reason recorded?

Electronic records present particular challenges. If the laboratory uses a laboratory information management system or instrument software that generates data files, ask how those files are protected from modification. Is there an audit trail in the software? Are the files stored in a location where only authorised users can access them? Data integrity in electronic systems is an area where laboratories frequently have informal practices that do not match what their procedures describe.

Sample Identification and Chain of Custody

A test result is only meaningful if it can be unambiguously linked to a specific sample. Ask how samples are identified from receipt through to disposal. Is there a unique identifier? Is that identifier maintained throughout the process, including on the instrument, on the worksheet, and on the final report? What happens if a sample label becomes damaged or illegible?

Chain of custody is particularly important for laboratories that handle samples with legal or regulatory significance, such as environmental monitoring samples or forensic specimens. Even for laboratories without formal chain of custody requirements, the ability to demonstrate that a sample was handled correctly from receipt to disposal is a basic quality requirement.

Report Review and Approval

Before a test report leaves the laboratory, it should be reviewed. Ask how reports are reviewed and who is authorised to approve them for release. Is there evidence of the review, such as a signature, an electronic approval, or a review record? Is the review substantive, meaning does the reviewer actually check the data and calculations, or is it a rubber stamp?

A useful audit technique here is to take a completed report and ask the reviewer to walk you through what they checked before approving it. This quickly distinguishes between a genuine review process and one that exists on paper only.

Retention and Retrieval

Ask about the record retention policy. How long are records kept? Is this defined in a procedure? Does the retention period reflect any regulatory or contractual requirements? Can records from three years ago actually be retrieved within a reasonable timeframe, or are they buried in an archive that nobody has accessed since they were filed?

Test the retrieval process by asking the laboratory to locate a specific record from a previous period. The speed and ease with which they can do this tells you a great deal about how the records system actually functions in practice.

Method Validation and Control Charts

Two additional areas deserve attention in a laboratory audit, even if they are not always explicitly called out in the audit criteria.

Method validation records demonstrate that a test method is fit for purpose in the laboratory's specific environment with its specific equipment and analysts. Ask whether test methods are validated or verified before use. What parameters were assessed? Where are the validation records? Have they been reviewed when the method, equipment, or personnel changed significantly?

Control charts and quality control sample results are the ongoing evidence that a test method remains in control between calibrations. Ask whether quality control samples are run alongside test batches. Are the results plotted? Are control limits defined? What happens when a result falls outside the control limits? A laboratory that runs quality control samples but never acts on out of control results is going through the motions without getting the benefit.

Common Nonconformities in Laboratory Quality System Audits

Based on audit experience across a range of laboratory environments, the following findings come up repeatedly:

• Equipment in active use that is not listed on the calibration register
• Calibration certificates that do not demonstrate traceability to national measurement standards
• Calibration intervals that have never been reviewed or justified
• Analysts performing test methods without documented authorisation
• Training records that record attendance at training but contain no evidence of competence assessment
• Raw data that cannot be traced back to the original instrument output
• Electronic records with no protection against unauthorised modification
• Report review processes that are documented but not genuinely practiced
• No participation in proficiency testing or any equivalent external verification of results
• Record retention periods that do not reflect regulatory or contractual requirements

None of these findings are exotic. They are the predictable result of a quality system that has been built around paperwork rather than around the actual technical processes of the laboratory. Your job as an auditor is to get behind the paperwork and test whether the system is genuinely functioning.

Preparing Your Audit Checklist for a Laboratory

A generic ISO 9001 checklist will not serve you well in a laboratory audit. You need to adapt your checklist to reflect the specific technical environment. Before the audit, review the laboratory's scope of activities, the test methods it uses, the types of samples it handles, and any regulatory requirements that apply. Use this information to build targeted questions around calibration, competence, and records that are specific to what this laboratory actually does.

Also plan your sampling strategy before you arrive. Decide in advance that you will trace a sample of recent test reports back through the system, that you will check a sample of calibration certificates against the register, and that you will verify authorisation records for a sample of analysts. Having this plan in place means you will not spend the first hour of the audit deciding what to look at.

For auditors who want to build stronger skills in gathering evidence that stands up to scrutiny, the article on how to gather audit evidence that stands up to scrutiny is worth reading before your next laboratory assignment.

A Note on Technical Expertise

You do not need to be a chemist or a microbiologist to audit a laboratory effectively. What you need is a clear understanding of what a quality system is supposed to achieve, strong interviewing skills, and the discipline to follow the evidence trail wherever it leads. If you encounter technical content you do not understand, ask the laboratory staff to explain it. Their ability to explain their own processes clearly is itself a useful indicator of competence and understanding.

Where the technical complexity genuinely exceeds what you can assess as an auditor, consider whether a technical expert should be part of the audit team. ISO 19011 explicitly allows for technical experts to support auditors in areas requiring specialist knowledge, and a laboratory audit is one of the clearest cases where this provision is useful.

If you are developing your auditing skills across different industries and want to build confidence in technically demanding environments, the courses at Audit Workshop cover practical audit techniques that apply directly to complex quality systems. The Internal Auditor and Lead Auditor courses across ISO 9001 and ISO 13485 are particularly relevant for those working in or around laboratory environments, with training delivered by an auditor who has conducted over 500 external certification audits across a range of industries.