ISO/IEC 17025:2017 sets the general requirements for the competence, impartiality and consistent operation of testing and calibration laboratories, and it is the basis for accreditation by bodies that participate in the ILAC mutual recognition arrangement. The standard does not require a LIMS; it applies just as much to a laboratory that runs on paper. But once a laboratory uses a LIMS, the system becomes part of how it meets the standard, and assessors will examine it. The 2017 revision made this explicit in clause 7.11. This article walks through the clauses that matter most for a LIMS and the capabilities to look for.
Key takeaways
- The 2017 edition is outcome-focused. It specifies fewer mandatory procedures than the 2005 edition and expects risk-based thinking.
- Clause 7.11 applies directly to your LIMS. The system must be validated before use, changes must be authorized, documented and validated, and externally hosted systems must still meet the standard.
- Technical records must allow a test to be repeated and must preserve original observations alongside any amendments.
- Statements of conformity need a documented decision rule that accounts for measurement uncertainty and the risk of false accept or false reject decisions.
- A LIMS earns its keep by linking things: staff authorization to methods, equipment status to results, quality control data to release and nonconforming work to the reports it affects.
How the standard is organized
The 2017 edition has five main requirement clauses: general (4, covering impartiality and confidentiality), structural (5), resource (6), process (7) and management system (8). Clause 8 lets a laboratory either follow its management system requirements directly (Option A) or use an ISO 9001 system that supports clauses 4 to 7 (Option B). A LIMS touches clauses 6 and 7 most heavily, along with records control in clause 8.
Clause 6: Resource requirements
6.2 Personnel
The laboratory must document competence requirements for each function that influences results, and keep records of how it determines competence and selects, trains, supervises, authorizes and monitors personnel. Clause 6.2.6 requires authorization of personnel for specific activities, including developing and validating methods, analyzing results and statements of conformity, and reviewing, reporting and authorizing results.
LIMS implications: training and authorization records per person and per method, used to control what each person can do. An analyst whose authorization for a method has lapsed should not be able to record results for it, and only authorized staff should be able to approve reports.
6.4 Equipment
Equipment is a broad term in ISO/IEC 17025, covering measuring instruments, software, measurement standards, reference materials, reference data, reagents, consumables and auxiliary apparatus. The laboratory must verify equipment before use, calibrate it where accuracy or uncertainty affects results, maintain a calibration program, make calibration status readily identifiable, perform intermediate checks where needed, and remove defective or suspect equipment from service. When equipment proves defective, the laboratory must examine the effect on earlier results and apply its nonconforming work procedure. Clause 6.4.13 lists required equipment records, from software and firmware versions to calibration results, due dates and repairs.
LIMS implications: an equipment register with calibration and maintenance schedules, status that blocks out-of-calibration or out-of-service instruments from use, and traceability from each result to the instruments, reagents and reference materials used. When an instrument fails a check, the system should list every result produced since its last good check.
6.5 Metrological traceability
The laboratory must establish metrological traceability through a documented, unbroken chain of calibrations, each contributing to measurement uncertainty, linked to an appropriate reference, normally the SI. Where that is not technically possible, traceability may be shown to another appropriate reference, such as certified values of certified reference materials. Annex A of the standard and ILAC policy (ILAC P10) give further guidance.
LIMS implications: calibration and reference material certificates stored against the relevant items, with lot numbers, expiry dates and certified values, and a record of which standards were used for each measurement.
Clause 7: Process requirements
7.2 Selection, verification and validation of methods
The laboratory must use appropriate methods, use the latest valid version of a standard method unless that is inappropriate, and verify that it can properly perform a method before introducing it. Deviations from methods must be documented, technically justified, authorized and accepted by the customer. Non-standard methods, laboratory-developed methods and standard methods used outside their intended scope or modified must be validated, with records of the procedure, requirements, performance characteristics, results and a statement on validity.
LIMS implications: version-controlled methods and specifications, an approval workflow before a method version becomes active, links to verification and validation records, and a controlled way to authorize method deviations on specific tests.
7.4 Handling of test or calibration items
The laboratory needs procedures for transport, receipt, handling, protection, storage, retention and disposal or return of items, and an identification system that prevents items from being confused, physically or in records, including when items are subdivided or transferred. Deviations from specified conditions on receipt must be recorded, and specified storage conditions must be maintained, monitored and recorded.
LIMS implications: unique sample IDs with labels, parent and child tracking for aliquots, chain of custody, receipt checks that record deviations, storage location and condition tracking, and retention and disposal scheduling.
7.5 Technical records
Technical records must contain the results, the report and enough information to identify factors affecting the result and its uncertainty, and to allow the activity to be repeated under conditions as close as possible to the original. They must show the date and the people responsible for each activity and for checking data and results. Original observations, data and calculations must be recorded at the time they are made. Clause 7.5.2 requires amendments to be traceable to previous versions or original observations, retaining both original and amended data, the date, what changed and who changed it.
LIMS implications: this is effectively an audit trail requirement (see our article on data integrity and ALCOA+). Look for a record of who did what and when, links to instruments and reagents, environmental conditions where relevant, direct instrument capture and an amendment history that never overwrites the original value.
7.6 Evaluation of measurement uncertainty
The laboratory must identify contributions to measurement uncertainty and take all significant ones into account. Calibration laboratories must evaluate uncertainty for all calibrations. Testing laboratories must evaluate it too, and where the method precludes rigorous evaluation, an estimate based on the theoretical principles or practical experience of method performance is acceptable.
LIMS implications: uncertainty stored per method, analyte and range, or calculated from validated budgets; uncertainty carried with results where needed for reporting or conformity decisions; and the QC and replicate data that feed uncertainty estimates.
7.7 Ensuring the validity of results
The laboratory must monitor the validity of its results, recording data so trends can be detected and applying statistical techniques where practicable. Options include reference or QC materials, replicate tests, retesting of retained items, intermediate checks, intralaboratory comparisons and blind samples. Clause 7.7.2 adds external monitoring through proficiency testing or other interlaboratory comparisons. When monitoring data falls outside predefined criteria, action must be taken to prevent incorrect results from being reported.
LIMS implications: QC samples and control charts with configurable rules, automatic flagging or blocking of batches that fail control criteria, proficiency testing tracking and trend reports.
7.8 Reporting of results
Results must be reviewed and authorized before release and reported accurately, clearly, unambiguously and objectively. Clause 7.8.2 lists information every report should include unless the laboratory has valid reasons otherwise, such as unique report identification, customer and item identification, method, relevant dates, results with units and the identity of the person authorizing the report. Clause 7.8.3 adds measurement uncertainty where it is relevant to the validity or application of results, requested by the customer, or affects conformity with a specification limit.
7.8.6 Statements of conformity. When a laboratory states that a result conforms to a specification, it must document the decision rule used, taking into account the associated level of risk, such as false accept and false reject, and apply it. Where the customer, a regulation or a normative document prescribes the rule, no further risk consideration is needed. The report must identify which results the statement covers, which specifications are met or not met, and the decision rule applied, unless it is inherent in the specification. Clause 7.1.3 adds that when a customer requests a statement of conformity, the specification and decision rule must be clearly defined and, unless inherent, agreed with the customer. ILAC G8 and JCGM 106 are the usual references for designing decision rules.
Clause 7.8.8 covers amendments: changes to an issued report must be clearly identified, and a replacement report must be uniquely identified and reference the original.
LIMS implications: report templates that enforce mandatory content, authorization workflows with electronic signatures, specification evaluation with configurable decision rules (such as simple acceptance or uncertainty-based guard bands), and controlled amendment and reissue with version history.
7.10 Nonconforming work
The laboratory needs a procedure for work that does not conform to its procedures or agreed customer requirements. It must define responsibilities, base actions (including halting work and withholding reports) on risk, evaluate significance including impact on previous results, decide on acceptability, notify customers and recall work where necessary, and define who authorizes resumption. Where nonconforming work could recur, corrective action under clause 8.7 is required.
LIMS implications: nonconformances raised against samples, tests, instruments or reports; holds that block report release; impact analysis that finds affected results and issued reports; and links to corrective action records.
7.11 Control of data and information management
This clause is written with a LIMS in mind; the standard notes that the term includes both computerized and non-computerized systems. The system must be validated for functionality, including interfaces, before introduction. Any change, including configuration changes or modifications to commercial off-the-shelf software, must be authorized, documented and validated before implementation. A note says off-the-shelf software used within its designed application range can be considered sufficiently validated, but a configured LIMS usually goes beyond that.
The system must be protected from unauthorized access, safeguarded against tampering and loss, operated in a suitable environment and maintained to ensure data integrity, and system failures must be recorded with the immediate and corrective actions taken. Clause 7.11.4 states that when the system is managed or maintained off-site or by an external provider, the laboratory must ensure the provider complies with the applicable requirements. Calculations and data transfers must be checked in an appropriate and systematic way.
LIMS implications: vendor validation documentation plus your own testing of configuration and interfaces, change control for configuration and releases, role-based access, tested backup and restore, incident records, and contractual and audit rights over any hosting or SaaS provider.
Clause 8: 8.4 Control of records
The laboratory must keep legible records that demonstrate it meets the standard, with controls for identification, storage, protection, backup, archiving, retrieval, retention time and disposal. Retention must be consistent with contractual obligations, and access consistent with confidentiality commitments.
LIMS implications: retention rules by record type, controlled archiving and disposal, reliable backup, fast retrieval for assessors, and access controls that respect customer confidentiality under clause 4.2.
Clause-to-capability table
| Clause | Requirement in brief | LIMS capability to look for |
|---|---|---|
| 6.2 | Competence and authorization | Training and authorization records per method; permissions that enforce them |
| 6.4 | Equipment calibration and status | Equipment register; calibration and maintenance scheduling; use blocked when out of service; result-to-instrument traceability |
| 6.5 | Metrological traceability | Reference standard and CRM inventory with certificates, lots, expiry and certified values |
| 7.2 | Method selection and validation | Version-controlled methods; approval workflow; links to validation records; controlled deviations |
| 7.4 | Handling of items | Unique IDs and labels; aliquot tracking; chain of custody; receipt checks; storage and disposal tracking |
| 7.5 | Technical records | Full audit trail; original and amended values retained; instrument, reagent and condition capture |
| 7.6 | Measurement uncertainty | Uncertainty stored or calculated per method and range; reported where required |
| 7.7 | Validity of results | QC samples; control charts and rules; proficiency testing tracking; trend reports |
| 7.8 | Reporting | Templates enforcing mandatory content; e-signature authorization; controlled amendments |
| 7.8.6 | Decision rules | Configurable decision rules, including guard bands; rule stated on the report |
| 7.10 | Nonconforming work | Nonconformance records; report holds; impact analysis; CAPA links |
| 7.11 | Data and information management | Validation package; change control; access control; backup; incident logging; provider oversight |
| 8.4 | Control of records | Retention rules; archiving and disposal; backup; fast retrieval; confidentiality controls |
What assessors typically ask to see
Assessors tend to test the system rather than read about it. Be ready to show validation evidence for the LIMS and its interfaces, including changes since the last assessment. Expect to trace a reported result back to raw data, the analyst’s authorization, the instrument’s calibration status and the reference materials used, and to demonstrate a report amendment, a nonconformance impact assessment and the decision rule behind a statement of conformity. If your LIMS is hosted externally, have the provider agreement and your oversight records available. Accreditation bodies also publish their own policies, so check those alongside the standard.
For selection and planning, see our LIMS buyer’s guide and LIMS migration playbook. Laboratories that also work under FDA rules should read our 21 CFR Part 11 checklist.
How HDLIMS approaches this
HDLIMS connects the pieces ISO/IEC 17025 asks laboratories to link: staff authorization and equipment status in resource management, samples, results and reporting in the LIMS, and nonconforming work and CAPA in the quality module. Our services team can support validation and accreditation readiness, or you can request a demo to walk through your own clause-by-clause assessment.