ISO 15189 Internal Auditor Training: Audit a Medical Laboratory to ISO 15189:2022

Opens with a self-check on ISO 15189, what it is for and why laboratories seek accreditation. Then three cases, each with the questions an auditor would ask. In 2021, Immensa Health Clinic in Wolverhampton reported an estimated 39,000 COVID-19 PCR results as negative because reporting thresholds were set incorrectly. In June 2019, Quest Diagnostics disclosed that a billing vendor's breach could have exposed data of about 11.9 million patients. And on 3 June 2024, a ransomware attack on Synnovis in south east London cut blood testing and postponed 10,104 outpatient appointments. Introduces Northbank Hospital laboratory in London, plus a diagnostic chain in Mumbai and a blood bank in Singapore, and explains that laboratories are accredited by an accreditation body. Outlines the twenty-seven modules, from planning to a practice audit at Northbank, and closes with a recap: audit the results, not only the paperwork.

What you will be able to do

• Explain why internal audit matters in a medical laboratory
• Turn a laboratory failure into questions an auditor would ask
• Describe how the course audits Northbank across twenty-seven modules

Why it matters

An audit that finds nothing while results go wrong protects no patient; real evidence and acted-on findings do.

Practice: Practice: Welcome: why laboratory internal audit matters · 3 questions

Starts with an audit moment at Northbank, where last year's scope covered only the benches in office hours and missed phlebotomy, courier boxes from family doctors, ward glucose meters and the night shift. Reads clause 3.20, which defines the medical laboratory to include pre-examination, examination and post-examination processes and advice, and follows the path of a sample through those terms. Explains terms to keep apart: patient and user, verification and validation, reference interval and decision limit. Covers how the requirements sit in clauses 4 to 8 in the ISO/IEC 17025 format, with Annex A on point-of-care testing as normative, and patients and risk at the centre. Uses a Mumbai chain with home collection and a Toronto genetics laboratory referring examinations abroad. Explains that laboratories are accredited, not certified, and closes with a recap: audit the whole path, not only the bench.

What you will be able to do

• Define the scope of a medical laboratory as ISO 15189 clause 3.20 does
• Tell verification from validation and reference intervals from decision limits
• Describe how clauses 4 to 8 and Annex A are organised

Why it matters

The standard says a laboratory's work starts long before the bench; knowing its terms tells you where to audit.

Practice: Practice: The language and structure of ISO 15189 · 3 questions

Opens at Northbank before its accreditation assessment, where last year's one-page audit report said all sections audited and no findings, despite complaints about delays and mislabelled samples. Reads clause 8.8.1 on evaluations at planned intervals, monitoring quality indicators in 8.8.2, and internal audits in 8.8.3, including what the programme must cover in outline, starting with risk to patients. Then the language of ISO 19011:2026: audit, criteria, objective evidence, findings and conclusions, shown on one blood storage fridge at Northbank, and the 2026 guidance on remote auditing. Explains the audit chain from criteria to evidence, finding and conclusion, with quality control review before release and amended reports in microbiology, plus a Sydney microbiology laboratory and a Singapore blood bank. Covers first-, second- and third-party audits, such as Northbank auditing its courier, and closes with a recap: no criteria and no evidence means no finding.

What you will be able to do

• Explain what ISO 15189 clause 8.8 requires of internal audits
• Build a finding from criteria, objective evidence and a conclusion
• Tell first-, second- and third-party audits apart

Why it matters

An audit report that says nothing was found, with no evidence, tells the laboratory director nothing they can act on.

Practice: Practice: What ISO 15189 requires of internal audits · 3 questions

Starts in Northbank's haematology section, where the section head audited her own work and found nothing, until an assessor found unwritten acceptance criteria and a verification she had signed herself. Covers the seven principles in clause 4 of the auditing guidance, from integrity, fair presentation and due professional care to confidentiality, independence and the evidence-based and risk-based approaches, with four shown at Northbank. Explains what ISO 15189 asks of auditors: trained, qualified and authorised, and independent whenever resources permit. Shows Northbank's cross-section auditing, with microbiology and haematology auditing each other, and a pathologist from another hospital as technical expert in cellular pathology. Covers the small-team case of a private clinic group in Hong Kong with one quality officer, then auditor behaviour: polite, inquiring and resilient, never gullible or opinionated. Closes with a recap: nobody audits their own work.

What you will be able to do

• Apply the seven principles of auditing in a laboratory audit
• Arrange audits so nobody audits their own work
• Describe the behaviours of an effective internal auditor

Why it matters

Nobody can see their own blind spots; independent auditors find what a section head auditing her own work would miss.

Practice: Practice: The principles of auditing and the internal auditor · 3 questions

Opens with Northbank's programme from two years ago, auditing sections in alphabetical order and leaving out the collection clinics, ward glucose meters and the night shift where incidents happened. Shows Figure 1 of ISO 19011:2026 and how clause 5 manages a programme as plan, do, check and act, with each single audit inside the do step. Explains the four inputs Northbank's quality manager now uses, giving priority to risk to patients, with sample identification rated highest. Covers the schedule shaped by risks, past results, nonconformities, incidents, complaints and changes, such as rising clinic rejections moving the clinic audit to spring. Shows how the programme reaches every site, from the main laboratory and two clinics to point-of-care testing on twelve wards, a simple auditor roster, and a Mumbai chain with forty collection centres. Closes with a recap: plan from risk to patients, not from the alphabet.

What you will be able to do

• Build an audit schedule from risk to patients and past results
• Include every site, shift and point-of-care service in the programme
• Change the programme during the year when risks change

Why it matters

Auditing in alphabetical order misses where patients are harmed; a risk-based programme puts audit time where errors happen.

Practice: Practice: A risk-based audit programme · 3 questions

Starts with an auditor who spent a day reading microbiology procedures at a desk, never watching a plate being read or following a result. Explains three practical approaches, noting that ISO 15189 does not require them and ISO 19011 does not name them: horizontal across sections, vertical tracing one result back, and witnessing work. Shows each at Northbank, from a critical potassium result last Tuesday night to patient identification at the outpatient phlebotomy unit. Adds glucose meters at a private hospital in Dubai and a cellular pathology laboratory in Boston. Covers writing an audit's objectives, scope and criteria, with clause numbers and titles and a scope naming sites, shifts and periods, then audit seven's plan, with the riskiest work first, timed to when it happens and shared in advance. Closes with a recap: choose how to look before you look.

What you will be able to do

• Choose between horizontal, vertical and witnessing audits
• Write audit objectives, scope and criteria with clause numbers
• Prepare an audit plan timed to when the work actually happens

Why it matters

A day at a desk audits documents, not work; choosing the right approach shows you what really happens.

Practice: Practice: Audit approaches and the audit plan · 3 questions

Opens with a downloaded checklist a new auditor took to specimen reception at Northbank: forty ticks, no records asked for, and a first question about a quality manual, which ISO 15189 does not require. Explains preparation as the step that matters most, at least one to one and a half hours, from four sources: the standard, the area's own documents and instructions for use, its risks from clauses 5.6 and 7.1, and past results. Shows checklists built from the requirement text and the laboratory's own rules, such as Northbank's rule to reject unlabelled samples and never relabel at reception. Every line asks for evidence: tell me, show me and how many. Goes part by part through the procedures and records the standard requires, and where to hold back. Closes with a recap: a checklist asks for evidence, not for ticks.

What you will be able to do

• Prepare for an audit from the standard, procedures, risks and past results
• Write checklist questions that ask for records and numbers
• Identify which procedures and records ISO 15189 actually requires

Why it matters

A generic checklist produces ticks, not findings; one built from the section's own rules finds what needs fixing.

Practice: Practice: Checklists and the evidence to ask for · 3 questions

Starts in the laboratory director's office at Northbank, where the impartiality record says no threats identified, while a supplier paid for four staff to attend an overseas conference and private samples go to a laboratory part-owned by a consultant. Reads clause 4.1 on impartial activities, management commitment, resisting commercial and financial pressure, and monitoring relationships, including staff, to identify, eliminate or minimise threats. Covers a clinician asking the duty biochemist to remove a haemolysis comment, and how to write an impartiality finding at Northbank. Then clause 4.2 on patient information managed through enforceable agreements, released only as law or contract requires, with Northbank's list of every outside party that touches it. Adds a Toronto laboratory receiving a court order. Explains that a relationship alone is not a threat and anonymised use is not a breach, and closes with a recap: follow the money, and follow the data.

What you will be able to do

• Audit how a laboratory identifies and handles threats to impartiality
• Check confidentiality agreements with every party holding patient data
• Write an impartiality finding that traces back to clause 4.1

Why it matters

A three-year-old 'no threats' record is not believable; auditing relationships and data flows shows what is really there.

Practice: Practice: Auditing impartiality and confidentiality · 3 questions

Opens with Northbank's incident log, where two patients' samples were swapped, a dose was changed, and the log does not say whether the patient or clinician was told. Reads clause 4.3: patients' well-being, safety and rights as the primary considerations, and its nine processes, from patient information and public information on costs and turnaround to periodic review of the examinations offered. Shows Northbank's review withdrawing an older cardiac marker, and wellness panels for walk-in patients at a Dubai private hospital. Covers the legal entity, with Northbank part of its hospital, and the laboratory director's documented duties, delegation and ultimate responsibility, with a Singapore blood bank. Explains the range of activities, covering both clinics, all twelve wards' glucose meters and every Mumbai collection centre, advice to users, and a Hong Kong clinic group being sold. Closes with a recap.

What you will be able to do

• Audit the nine patient-related processes in ISO 15189 clause 4.3
• Check the laboratory director's documented duties and delegations
• Confirm the defined range of activities covers every site

Why it matters

If an error harms a patient, the standard expects a process and a record; this shows you how to check both.

Practice: Practice: Patients, the director and laboratory activities · 3 questions

Starts at Northbank's quality meeting: an objective of excellent quality nobody can measure, twelve indicators in a spreadsheet nobody reviews, and a two-year-old risk register untouched despite a new analyser line and courier. Reads clause 5.4.1 on the organisation, responsibility, authority and lines of communication for everyone who manages, performs or verifies work, tested against Northbank's merger of clinical chemistry and haematology into blood sciences. Covers quality management with authority and resources, and objectives that are measurable and known at all levels, with two objectives side by side. Explains quality indicators planned with limits and an action plan under clause 8.8.2, auditing one indicator from start to finish at a Sydney microbiology laboratory, and late reports tracked in Toronto. Then clause 5.6 on risk management as a living process evaluated by the director. Closes with a recap: a number is only useful if it leads to an action.

What you will be able to do

• Check that quality objectives are measurable and known at all levels
• Audit a quality indicator from its limit to the action taken
• Confirm that the risk register is current and reviewed for effectiveness

Why it matters

Indicators nobody reviews and a register nobody updates steer nothing; auditing them shows whether management is in control.

Practice: Practice: Structure, objectives, indicators and risk · 3 questions

Opens on Northbank's transfusion night shift, where an agency locum is crossmatching and releasing blood alone, with a degree certificate and reference but no competence assessment or authorisation at Northbank. Reads clause 6.1 on resources and 6.2.1 on access to enough competent people, internal and external, acting impartially and ethically. Covers specified competence requirements for each function, assessment by suitable methods at the frequency the laboratory sets, such as Northbank's yearly assessment, and authorisation for methods, result release and access to patient data, with system access matching the paper. Shows how to write the finding for the transfusion locum. Then procedures and records for requirements, training, authorisation and monitoring, continuing education, a Mumbai chain with forty collection centres and Hong Kong receptionists starting with no introduction. Closes with a recap: competent is shown, authorised is decided.

What you will be able to do

• Check competence assessments for internal and agency staff
• Confirm that system access matches documented authorisations
• Write a personnel finding that traces back to clause 6.2

Why it matters

Whoever releases a result at three in the morning must be shown competent and authorised; this shows how to check.

Practice: Practice: Auditing personnel: competence, authorisation · 3 questions

Starts in a corridor behind Northbank's blood sciences laboratory: a sample freezer with its alarm switched off, and a coagulation analyser marked do not use with no record of when it failed or which results it produced. Reads clause 6.3.1: facilities suitable for the work at every site, including collection and point-of-care testing, with requirements specified, monitored and recorded. Shows Northbank's specified temperature and humidity, and the week the alarm was off, then storage that keeps samples and reagents intact and collection facilities that protect privacy. Covers equipment under clause 6.4: accepted before use and after repair against the laboratory's own criteria, maintained to plan, and taken out of service when it fails, with the effect on past results examined. Writes the finding for the corridor, adds a Toronto genetics laboratory and a loaned centrifuge in Mumbai, and closes with a recap: a fault is a question about past results.

What you will be able to do

• Check that environmental conditions are specified, monitored and recorded
• Audit equipment acceptance after installation and repair
• Trace the effect of an equipment fault on earlier patient results

Why it matters

When equipment fails, the real question is which patient results it produced; auditing records shows if anyone asked.

Practice: Practice: Facilities, environment and equipment · 3 questions

Opens in Northbank's reagent store: a new chemistry reagent lot loaded the day after delivery, checked and unchecked boxes on one unmarked shelf, and a stain made in cellular pathology with no expiry date or maker's name. Reads clause 6.5.1 on calibration and traceability requirements sufficient for consistent reporting, for quantitative and qualitative methods. Covers calibration procedures for status, re-calibration and correction factors, and what happens when calibration was out of control. Explains traceability through an unbroken chain, often the manufacturer's for unmodified systems, or by reference sequences or known material, with a Toronto genetics laboratory controlling reference sequence versions. Then reagents and consumables stored correctly wherever they arrive, accepted before use and kept apart until accepted, with a Dubai hospital's point-of-care clinics and a Singapore blood bank's in-house reagent. Writes the reagent store finding and closes with a recap.

What you will be able to do

• Audit calibration records and what is done when calibration fails
• Check metrological traceability for quantitative results
• Confirm reagent lots are accepted before use and kept apart until then

Why it matters

A new reagent lot can shift results before anyone notices; auditing acceptance stops it reaching patients first.

Practice: Practice: Calibration, traceability, reagents and consumables · 3 questions

Starts at Northbank's specimen reception, where a referral laboratory e-mailed a critical result on a Friday evening, nobody read it until Monday, the agreement said nothing about critical results and the laboratory was missing from Northbank's list. Reads clause 6.7.1 on establishing and reviewing agreements, specifying requirements, checking capability and telling users about changes. Covers the written contract with the hospital Northbank serves, and agreements with each ward running glucose meters or blood gas analysers. Explains clause 6.8 on referral laboratories and consultants, who receive the laboratory's requirements, including critical results, and are kept on a list, with a remote pathologist two days a week and a Hong Kong clinic group using one referral laboratory. Covers selecting, evaluating and re-evaluating every external provider, Northbank's courier audit after warm samples, and a Sydney laboratory's cheapest pipette calibration service. Writes the reception finding and closes with a recap.

What you will be able to do

• Audit agreements with users and point-of-care testing sites
• Check that referral laboratories receive requirements for critical results
• Confirm external providers are evaluated and re-evaluated against criteria

Why it matters

Unless the agreement says otherwise, a late critical result from a referral laboratory is the referring laboratory's problem.

Practice: Practice: Agreements and external providers · 3 questions

Opens with a phone call to Northbank's reception asking to add magnesium to Mrs Smith's sample, when two patients called Smith are in today's samples and no written confirmation ever arrives. Reads clause 7.1 on identifying, assessing and mitigating risks to patient care along the pre-examination, examination and post-examination path, communicating residual risk and monitoring effectiveness, with sample identification Northbank's highest risk. Covers the information the laboratory gives patients and users, tested against what it actually does, such as Northbank's intranet user handbook and urgent samples to main reception until eight in the evening. Explains each accepted request as an agreement, with the patient traceable, the requester reachable and oral requests confirmed in writing, mostly electronic at Northbank. Adds a New York home-collection service and a Singapore crossmatch request with no requester details. Writes the finding and closes with a recap: most errors start before the bench.

What you will be able to do

• Audit how risks along the examination path are identified and monitored
• Test user information against what the laboratory actually does
• Check that oral requests are confirmed and the patient is traceable

Why it matters

Many laboratory errors begin before the sample arrives; auditing requests and information catches them at the source.

Practice: Practice: Process risks, information and requests · 3 questions

Starts at Northbank's reception at four in the afternoon, where a warm courier box arrives six hours after collection and an unlabelled tube is labelled from the request form with no record. Reads clause 7.2.4.1 on collection procedures available wherever collection happens, with deviations recorded and the risk of accepting or rejecting assessed and communicated. Covers patient identity and labelling at collection, with a Boston cancer centre's frequent blood draws. Explains transport within time and temperature limits that are evaluated, and receipt that applies criteria with every portion traceable, at a Mumbai chain with forty collection centres. Covers compromised samples accepted for the patient's sake with the risk assessed and the report saying so, silent exceptions at a private hospital in Dubai, and adding an examination three days later in Hong Kong. Writes the reception finding and closes with a recap: exceptions are never silent.

What you will be able to do

• Audit collection procedures and how deviations are recorded
• Check transport time and temperature limits and their evaluation
• Confirm that compromised samples are risk-assessed and noted on reports

Why it matters

A precise result from the wrong patient helps nobody; sample identity is where patient safety starts.

Practice: Practice: Collection, transport, receipt and handling · 3 questions

Returns to Northbank's haematology section and the new coagulation method from Module 4, whose thirty-page verification file holds results but no performance criteria, so nobody can tell whether it met its targets. Reads clause 7.3.1 on methods validated for intended use, with performance specifications related to patient care and preferred methods from instructions for use or authoritative texts. Explains that a method used as directed is verified, while one designed, modified or used outside its scope is validated, with a Toronto genetics laboratory's own method and a Singapore blood bank using a kit on an uncovered sample type. Covers records of specifications, results and a statement of whether they were met, reviewed by authorised people. Then measurement uncertainty evaluated against specifications, and reference intervals and decision limits with a recorded basis, reviewed when methods change. Writes the haematology finding and closes with a recap.

What you will be able to do

• Tell when a method needs verification and when it needs validation
• Check that verification records state criteria and whether they were met
• Audit the basis for reference intervals and measurement uncertainty

Why it matters

Results without criteria show nothing; checking the criteria behind a new method protects every patient tested on it.

Practice: Practice: Verification, validation and uncertainty · 3 questions

Opens with Northbank's chemistry night log, where a sodium control failed twice at ten past two, fell inside limits on the third run, and nobody looked at results released since the last good control at ten the evening before. Reads clause 7.3.7.1 on a planned and reviewed procedure for monitoring validity, with data recorded so trends and shifts show. Covers internal quality control with fit material at a frequency set by risk, and holding patient results when it fails while evaluating those since the last good control, with glucose at Northbank. Explains external quality assessment done by routine staff, with every failure investigated for impact on patients, at a Sydney microbiology laboratory. Then comparability where methods, equipment or sites differ, such as a Mumbai hub and two satellites, with clinically significant differences told to users. Writes the night log finding and closes with a recap.

What you will be able to do

• Audit what happens to patient results after an IQC failure
• Check that EQA is done by routine staff and failures are investigated
• Confirm comparability between methods, analysers and sites

Why it matters

Rerunning a control until it passes is a common habit; a failed control asks about every result since the last good one.

Practice: Practice: Ensuring the validity of results · 3 questions

Starts with Northbank's critical results log: a potassium result at twenty to four in the morning noted only as ward 7 informed, and an out-of-hours call marked no answer with no later entry. Reads clause 7.4.1.1 on accurate, clear reports with the information needed for interpretation, notifying delayed results and retaining all associated information. Covers review and authorisation before release, and critical results notified as soon as relevant with who, when, what and the repeat-back recorded, plus escalation when nobody answers. Explains automated release on validated rules, re-verified after changes, recalling Northbank's June software update that changed one rule unchecked. Covers report content under clause 7.4.1.6, amendments visible as revisions rather than overwritten as at a Dubai private hospital, a Toronto genetics laboratory example, and samples kept findable after examination. Writes the critical results finding and closes with a recap.

What you will be able to do

• Audit critical result notification records for who, when and read-back
• Check that automated release rules are re-verified after changes
• Confirm that amended reports show the revision, not an overwrite

Why it matters

A result is only useful if the right person understands it; a vague log entry cannot show that they did.

Practice: Practice: Reporting, release and critical results · 3 questions

Opens on ward 9 at Northbank, where a glucose meter failed quality control on Monday, was put back in its dock and used until Thursday by three nurses, two never trained on that model. Explains that the 2022 edition brought in requirements from ISO 22870, defines point-of-care testing under term 3.22, and that Annex A is normative. Covers A.1 on the laboratory's responsibilities, the governing body's ultimate responsibility, and agreements with every testing location with clinical approval, such as ward 9's agreement that expired two years ago. Explains the person responsible for POCT quality and the person managing training and competency assessment, both held by Northbank's coordinator. Then the threads in the main text: range, devices, supplies, operators, EQA, comparability and management review, with Dubai outpatient clinics and a Singapore board never told about POCT accuracy. Writes two ward 9 findings and closes with a recap.

What you will be able to do

• Audit POCT governance and agreements with each testing location
• Check POCT operator training and competency records
• Trace POCT requirements through the main text of ISO 15189

Why it matters

A glucose result from a ward is still the laboratory's concern; auditing POCT stops failed meters being used on patients.

Practice: Practice: Auditing point-of-care testing · 3 questions

Starts with Northbank's immunology fridge, which drifted above its limit overnight: the alarm was reset, reagents were used without assessment, nothing was recorded, and a ward complaint the same week was answered by the same scientist. Reads clause 8.5.1 on identifying risks and opportunities for five purposes, prioritising, acting in proportion, recording and evaluating effectiveness. Covers clause 7.5 on nonconforming work: who decides, halting work where patients are at risk, a look-back at released results, a decision and an authorised restart, with a Hong Kong clinic group, a Singapore blood bank and a failed stain batch in Boston. Writes the fridge finding, with the correct action of discarding reagents and repeating samples. Then clause 7.7 on complaints, formal or not, received, investigated and resolved by someone not involved, with the outcome given to the complainant. Closes with a recap: problems recorded are problems that can be fixed.

What you will be able to do

• Audit how nonconforming work is stopped, assessed and restarted
• Check that released results are looked back on after a nonconformity
• Confirm complaints are investigated by someone not involved

Why it matters

If nobody knows who can stop examinations, the first patient harmed finds out; auditing the process prevents that.

Practice: Practice: Risks, nonconforming work and complaints · 3 questions

Recalls the Synnovis ransomware attack of 3 June 2024 in south east London, which cut blood testing and postponed 10,104 outpatient appointments, and the questions it raises for every laboratory. Reads clause 7.6.1 on access to the data and information needed, including computer and non-computerised systems, then verification before use, authorised and validated changes, including interfaces, and protection with cybersecurity in mind. Covers off-site and cloud-hosted systems held to the same requirements, with a Hong Kong clinic group's software company. Explains downtime plans that keep the laboratory working, including automated reporting, and Northbank's plan of paper request forms, manual labels and telephone reporting, with a check of all data entered on paper. Covers clause 7.8 on continuity and emergency risks, plans tested and exercised where practicable, with a Sydney microbiology laboratory, and writes the downtime finding. Closes with a recap: test the plan before the day you need it.

What you will be able to do

• Audit validation and change control of laboratory information systems
• Check that downtime plans cover urgent results and data re-entry
• Confirm continuity plans are tested and staff are trained

Why it matters

When systems stop, urgent results still have to reach doctors; a tested downtime plan is how they do.

Practice: Practice: Information systems, downtime and continuity · 3 questions

Starts at Northbank's urine analyser, where version 6 of the procedure is approved in the document system but a laminated quick card from version 4 with an old dilution step is what staff use. Reads clause 8.1.1 on the minimum elements of the management system, and clause 8.1.2's option of meeting it through a system such as ISO 9001. Covers document control so documents are current at the point of use, and records made at the time, changed openly with the date, what changed and who, and retained for the specified time. Explains improvement and feedback sought from patients, users and staff. Then management review evaluating every required input, with decisions acted on and shared, and a June review that missed point-of-care testing, external providers and interlaboratory comparisons. Writes the finding and closes with a recap: the bench shows whether the system is real.

What you will be able to do

• Audit document control at the point of use, not only in the system
• Check that record changes show the date, change and person
• Confirm management review covers every required input

Why it matters

If staff follow an old quick card, every other control rests on uncertain ground; the bench shows whether the system works.

Practice: Practice: Documents, records, improvement, review · 3 questions

Opens with an auditor in Northbank's microbiology section who skips the opening meeting, wears no laboratory coat and picks up a culture plate, so the section head is annoyed and answers are short. Reads clause 6.4.3 of the auditing guidance on the opening meeting's three purposes, chaired by the audit team leader, and the eight points it covers, from objectives to biosafety. Covers conduct on site: protective clothing, hands off, and no disturbance of critical work, such as questioning at the transfusion bench only after a unit is issued. Explains remote auditing, with new emphasis in Table A.1 of the 2026 guidance, and a remote session done well with a New York home-collection service. Shows the same interview done by two auditors, ten good interviewing habits, and witnessing done with care, even with simple equipment. Closes with a recap: open well, work safely, and people talk.

What you will be able to do

• Run an opening meeting that covers the eight agreed points
• Follow laboratory biosafety rules while auditing on site
• Interview and witness staff so they give complete and accurate information

Why it matters

How you open and behave decides whether people tell you what really happens at the bench.

Practice: Practice: Conducting the audit: opening and on site · 3 questions

Starts with a section head saying every result is reviewed before release, and why that is information, not yet evidence. Walks through Figure 2 in clause 6.4.7 of the auditing guidance: sources of information, appropriate sampling, verification, audit evidence, evaluation against criteria, findings and conclusions, with evidence recorded. Explains investigating to the depth necessary. Shows a full three-step trace at Northbank, from the report to the examination and the sample, which finds no acceptance record for the reagent lot used on a troponin run. Adds a trace at a Singapore blood bank and the same checks at a Hong Kong clinic group. Covers verifying information as complete, correct, consistent and current, sampling by judgement or statistics sized to risk, such as night-shift critical results at Northbank, and notes that name where, what, which and who. Closes with a recap: only verified information is evidence.

What you will be able to do

• Trace a patient result back through report, examination and sample
• Verify information before accepting it as audit evidence
• Choose and record an audit sample sized to the risk

Why it matters

Tracing one result tests the links between almost every process; a break in the trace is your next lead.

Practice: Practice: Tracing a result, sampling and evidence · 3 questions

Opens at Northbank's closing meeting, where the draft finding 'critical results not managed properly' is withdrawn because the auditor cannot name the requirement, requests or dates. Reads clause 6.4.8 of the auditing guidance on generating findings, recording nonconformities with evidence, and optional grading, quantitative or qualitative, with defined criteria. Explains the three parts of every nonconformity: the requirement, specific verifiable evidence and why it is not met, graded major by Northbank's own criteria where a patient could be harmed. Covers a waste permit finding, an opportunity for improvement on hand-logged courier boxes, and a Boston cancer centre's finding that applied to two other rooms. Explains reviewing findings with the auditee before the closing meeting, recording diverging opinions, and a report with everything clause 6.5.1 lists, including the sampling statement, sent to those who act, as a Dubai hospital did well. Closes with a recap.

What you will be able to do

• Write a nonconformity with requirement, evidence and statement
• Grade findings using the laboratory's own defined criteria
• Prepare an audit report with everything clause 6.5.1 of the guidance lists

Why it matters

A finding that cannot name its requirement and evidence is withdrawn; well-written findings get management to act.

Practice: Practice: Findings, the closing meeting and the report · 3 questions

Starts with Northbank's nonconformity log, where an unlabelled sample was accepted in February, May and September, each time closed with staff retrained. Reads clause 8.7.1: control and correct the nonconformity, address consequences with a focus on patient safety, determine causes, check whether similar ones exist, implement action and review its effectiveness. Explains following up your own findings until the action works. Then a practice audit at Northbank against clauses 7.2.4 to 7.2.6 and Northbank's own collection and receipt procedures, including a nonconformity with clause 7.2.4.4 a when identity was read from a wristband instead of asked. Gives the key takeaways in three lines: plan from risk to patients, say show me and verify what you hear, and write findings management acts on. Ends with the final exam, and a reminder to start small, and start soon.

What you will be able to do

• Check that corrective action removed the cause of a nonconformity
• Follow up audit findings until actions are shown to work
• Apply the full audit method in a practice audit of sample collection

Why it matters

A nonconformity is closed when the action works, not when the form is signed; follow-up shows the audit changed something.

Practice: Practice: Corrective action, follow-up and next steps · 3 questions