ISO 17025 internal auditor training: audit your laboratory's results, not just its quality manual

Opens with the question of what you would show a customer who asks how you know a result is right, and a self-rating. Covers the bigger picture of more than 114,600 ILAC-accredited laboratories in 2024, then three cases: CDC COVID-19 test kits in February 2020 that some laboratories could not verify; the Immensa laboratory in Wolverhampton, where around 39,000 results were reported negative in 2021 because thresholds were set wrongly; and Daihatsu's 174 test irregularities found in December 2023. Turns them into auditor questions on methods, settings and pressure. Introduces Meridian Environmental Laboratory in Singapore, the twenty-seven modules in three parts, the exam, and why this is not a lead auditor or accreditation course. It ends with a recap and three practice questions.

What you will be able to do

• Turn a laboratory failure into questions an auditor would ask
• Explain why an internal audit should trace results to evidence
• State what this course does and does not qualify you to do

Why it matters

Auditing results, not only the manual, finds wrong settings and unverified methods before customers act on them.

Practice: Practice: Welcome: why laboratory internal audit matters · 3 questions

Starts at Meridian in Singapore, where the auditor and the organic chemistry supervisor mean different things by 'validated' for a new pesticide method. Covers nine terms from clause 3, from impartiality to validation, including the difference between verification, which shows you can do a method, and validation, which shows it fits the intended use, and the decision rule in 3.7, agreed when work is accepted and applied when results are reported. Explains how the standard is built in five clauses of requirements, with Option A or Option B for the management system and clauses 4 to 7 applying either way. Shows why only 'shall' is a requirement, so reading the verb decides whether a finding stands. It ends with a recap and three practice questions.

What you will be able to do

• Use the clause 3 terms correctly in audit findings
• Tell verification from validation of a method
• Explain Option A and Option B and which clauses apply either way

Why it matters

Getting the defined words right is what makes a laboratory finding stand up when it is challenged.

Practice: Practice: The language of the laboratory · 3 questions

Opens with the question of when your laboratory last audited a result rather than a procedure. Starts with Meridian's last internal audit, run as a rehearsal a week before the accreditation body's visit and never reaching the bench. Covers clause 8.8 for Option A and the ISO 9001 route for Option B: internal audits at planned intervals covering laboratory activities, with a programme, criteria, reporting, action and records. Explains the internal audit as a first-party audit that can go deeper than the third-party accreditation assessment. Teaches three kinds of audit: vertical, following one result, horizontal, across one requirement, and witnessing, watching the work itself, as at a Los Angeles laboratory's toy drop test. It ends with a recap and three practice questions.

What you will be able to do

• Explain what clause 8.8 requires of internal audits
• Tell an internal audit from an accreditation assessment
• Choose between vertical, horizontal and witnessing audits

Why it matters

Using the right kind of audit takes you from the manual to the bench, where results are actually made.

Practice: Practice: The laboratory internal auditor · 3 questions

Starts with a vertical audit at Meridian tracing an effluent report for a large factory customer whose result sits just below its discharge limit after a re-test. Covers clause 4.1: risks to impartiality identified on an ongoing basis, from relationships, commercial pressure and payments such as sales commission for referrals, and how the laboratory shows each is eliminated or minimised under clause 4.1.5. Explains testing impartiality against real re-tests and real people, interviewed in private, not only against the register. Covers clause 4.2: legally enforceable confidentiality commitments covering staff, committees and contractors, and why a relationship is not a finding but an unmanaged one is. It ends with 'Which clause?' moments, a recap and three practice questions.

What you will be able to do

• Audit how impartiality risks are identified and managed
• Test impartiality against real re-tests and interviews
• Check confidentiality commitments for staff and contractors

Why it matters

Testing impartiality on real results protects the laboratory from the pressure that ruins trust in its reports.

Practice: Practice: Impartiality and confidentiality · 3 questions

Opens at Meridian, where the auditor samples a groundwater report for a building developer and checks whether the work sits within the activities the laboratory claims. Covers clause 5 from the legal entity onward: the range of laboratory activities defined and documented, with conformity claimed only for that range, including work at sites away from permanent facilities and at customers' sites under clause 5.4. Explains responsibilities and authorities specified for all personnel, and people with the authority and resources for the five quality duties, whatever else they do. Covers management keeping the system whole when it changes, and the check that the range matches the reports actually issued. It ends with 'Which clause?' moments, a recap and three practice questions.

What you will be able to do

• Check that the range of laboratory activities matches issued reports
• Audit responsibilities and authority for the five quality duties
• Verify that work at customer sites is covered and audited

Why it matters

Matching the claimed range to real reports stops the laboratory claiming conformity for work it never covered.

Practice: Practice: Structural requirements · 3 questions

Starts in microbiology at Meridian, where tracing a drinking water report back to raw data reveals who actually did the work and whether they were allowed to. Covers clause 6.2.5: procedures and records for a chain of six steps, competence requirements, selection, training, supervision, authorisation and monitoring of competence. Explains authorisation under clause 6.2.6 as a recorded decision for specific tasks, which must come before the work, including analysis of results and statements of conformity, shown by an analyst adding conformity statements nobody authorised. Covers everyone who could influence results being in scope, internal or external, and starting from a result to find the person behind it. It ends with 'Which clause?' moments, a recap and three practice questions.

What you will be able to do

• Audit the six-step chain from competence requirements to monitoring
• Check that authorisation is recorded before the work is done
• Trace a result to the competence and authorisation of its analyst

Why it matters

Finding the person behind a result, and their authorisation, shows whether the result can be defended.

Practice: Practice: Resources and personnel · 3 questions

Opens in the metals section at Meridian, where a small clean room prepares water samples for trace metals analysis and the auditor notices conditions that could move a reading. Covers facilities and environmental conditions that are suitable and do not adversely affect the validity of results, starting from what each method requires. Explains documenting the conditions needed, and monitoring, controlling and recording them where methods require it or validity depends on it, with access, contamination and separation of incompatible activities controlled. Covers clause 6.3.5: the same requirements at sites or facilities outside the laboratory's permanent control, and the auditor's question: which condition could change this result? It ends with 'Which clause?' moments, a recap and three practice questions.

What you will be able to do

• Audit facilities and conditions against what each method requires
• Check monitoring and records of environmental conditions
• Verify control of conditions at sites outside permanent control

Why it matters

Asking which condition could change a result finds the dust, heat or vibration that quietly moves readings.

Practice: Practice: Facilities and environmental conditions · 3 questions

Starts in Meridian's soil section, where a balance dropped during the refit raises the question of how the laboratory would find out if it were wrong for two weeks. Covers equipment verified before it goes into service, capable of the accuracy needed, and calibrated where accuracy affects validity or traceability requires it. Explains what happens between calibrations: intermediate checks, visible status under clause 6.4.8 with labels or codes, updated correction factors, and protection against unintended adjustments. Covers taking doubtful equipment out of service, examining the effect on earlier results, and equipment records, with the auditor's focus on the days between calibrations. It ends with 'Which clause?' moments, a recap and three practice questions.

What you will be able to do

• Check equipment verification and calibration before use
• Audit intermediate checks and calibration status labels
• Verify action on doubtful equipment and its effect on results

Why it matters

Auditing the days between calibrations catches a faulty balance before weeks of results depend on it.

Practice: Practice: Equipment · 3 questions

Opens in organic chemistry at Meridian, where the auditor follows a pesticide result back to the calibration of the instrument and its reference standard, link by link. Covers metrological traceability as a documented unbroken chain of calibrations, each adding its uncertainty, to the SI or, where that is not technically possible, to an appropriate reference, with every laboratory and producer in the chain competent. Explains clause 6.6 for products and services bought in: defined requirements, criteria for evaluation, selection, monitoring and re-evaluation of external providers, and checks before use, with proficiency testing services named in the note to 6.6.1. Ends with following the chain, then the purchase order. It ends with 'Which clause?' moments, a recap and three practice questions.

What you will be able to do

• Trace a result through an unbroken chain of calibrations
• Check the competence of calibration and reference material providers
• Audit requirements and evaluation of external providers

Why it matters

Following the chain and the purchase order shows whether your results are really comparable with others'.

Practice: Practice: Traceability and external provision · 3 questions

Starts at Meridian with a factory that asked for monthly effluent tests and a statement of whether each result meets its limit, without anyone agreeing how that would be decided. Covers the review before work: defined and documented requirements, capability and resources under clause 7.1.1 item b, approved external providers, and appropriate methods. Explains that when a statement of conformity is requested, the specification and decision rule are clearly defined and the rule is agreed with the customer. Covers communicating, reviewing and recording deviations and amendments to contracts, and the auditor's method of comparing the contract with the report issued. It ends with 'Which clause?' moments, a recap and three practice questions.

What you will be able to do

• Audit the review of requests, tenders and contracts
• Check that decision rules are agreed with the customer
• Compare the agreed contract with the report issued

Why it matters

A decision rule agreed up front prevents disputes when a result lands close to the customer's limit.

Practice: Practice: Review of requests, tenders and contracts · 3 questions

Opens in organic chemistry at Meridian, where a published standard method for water is being used on samples outside its scope. Covers methods that are appropriate, current and available, telling the customer which method was chosen, and four conditions for deviations. Explains clause 7.2.1.5: verifying that the laboratory can properly perform every method before introducing it, and again when the issuer revises it, with records. Covers validating non-standard, laboratory-developed, out-of-scope and modified methods, with five records ending in a statement of fitness for the intended use. Ends with the auditor's first questions: where did the method come from, and what changed? It ends with 'Which clause?' moments, a recap and three practice questions.

What you will be able to do

• Check that methods are verified before use and after revision
• Decide when a method must be validated
• Audit validation records and the statement of fitness for use

Why it matters

Knowing where a method came from, and what changed, shows whether it really works on the samples tested.

Practice: Practice: Selection, verification and validation of methods · 3 questions

Starts with Meridian's field team, whose sampling plan for a factory's effluent calls for a composite sample collected over twenty-four hours. Covers sampling when the laboratory samples: a sampling plan and method available on site, and records that include any deviation. Explains how who took the sample decides what the report may claim. Covers handling items: protecting them, identifying them unambiguously, checking them on receipt with deviations recorded, and storing them under the right conditions. Shows clause 7.4.3: when suitability is in doubt, consulting the customer before proceeding, recording the result and adding a disclaimer if testing goes ahead. Ends with following one bottle from site to bin. It ends with 'Which clause?' moments, a recap and three practice questions.

What you will be able to do

• Audit a sampling plan, method and sampling records
• Check receipt, identification and storage of test items
• Verify what happens when an item's suitability is in doubt

Why it matters

Following one bottle from site to bin shows whether the sample tested is really the one that was taken.

Practice: Practice: Sampling and handling of test items · 3 questions

Opens in inorganic chemistry at Meridian, where tracing a nickel result in effluent leads to questions about where the raw data are. Covers technical records that hold enough to identify the factors affecting a result and to repeat the work, with observations recorded at the time, and clause 7.5.1's requirement to identify who did each activity and who checked data and results. Explains amendments that are traceable with the original kept. Covers measurement uncertainty: identifying contributions, including sampling where significant, and evaluating uncertainty for all calibrations, including the laboratory's own. Ends with the auditor's method: recalculate one result, and read one audit trail. It ends with 'Which clause?' moments, a recap and three practice questions.

What you will be able to do

• Check that technical records allow a test to be repeated
• Audit traceable amendments and who checked data
• Check that measurement uncertainty contributions are identified

Why it matters

Records that let someone repeat a test are what let the laboratory defend a result a customer questions.

Practice: Practice: Technical records and measurement uncertainty · 3 questions

Starts in inorganic chemistry at Meridian, where an analyst runs a check standard of known value with every batch of metals tests, yet nobody could spot a trend in the results. Covers monitoring validity with a planned and reviewed mix of checks, recorded so that trends are detectable and, where practicable, statistical techniques applied under clause 7.7.1. Explains comparing performance with other laboratories through proficiency testing or other interlaboratory comparisons, where available and appropriate. Covers acting when data fall outside criteria to prevent incorrect results being reported, including a poor proficiency result for lead. Monitoring is what you do with the data, not just collecting it. It ends with 'Which clause?' moments, a recap and three practice questions.

What you will be able to do

• Audit internal quality control checks and trend detection
• Check participation in proficiency testing or comparisons
• Verify action when monitoring data fall outside criteria

Why it matters

Spotting drift in your own checks stops a laboratory slowly reporting wrong results without noticing.

Practice: Practice: Ensuring the validity of results · 3 questions

Opens at Meridian, where the information system now emails a report to the customer as soon as the analyst finishes, before anyone reviews it. Covers results reviewed and authorised before release by authorised people. Explains the common content of clause 7.8.2, plus the items for test reports, calibration certificates under clause 7.8.4.1, such as measurement uncertainty, and sampling, unless there are valid reasons or a simplified format was agreed. Covers identifying customer-supplied data, and stating that results apply to the sample as received when the laboratory did not sample. Ends with the auditor's method: check the order of review and release, then the content. It ends with 'Which clause?' moments, a recap and three practice questions.

What you will be able to do

• Check that reports are reviewed and authorised before release
• Audit report content against clause 7.8.2 and the specific items
• Verify statements on customer data and samples as received

Why it matters

Checking reports before customers read them protects the part of the laboratory customers actually see.

Practice: Practice: Reporting of results · 3 questions

Returns to Meridian and the factory's March effluent result that sat just below the discharge limit. Covers statements of conformity resting on a documented decision rule, with risk considered unless the rule is prescribed, and clause 7.8.6.2: the statement identifies the results it applies to, the specifications met or not met, and the decision rule. Explains opinions and interpretations released by authorised people, based on results, clearly labelled, and recorded when given in conversation. Covers amendments to issued reports that are identified, reasoned and traceable to the original, and why two reports should never share one identity. It ends with 'Which clause?' moments, a recap and three practice questions.

What you will be able to do

• Audit statements of conformity and the decision rule used
• Check that opinions are authorised, based on results and labelled
• Verify that amended reports are identified and traceable

Why it matters

Clear conformity statements and traceable amendments stop customers acting on the wrong version of a report.

Practice: Practice: Conformity, opinions and amendments · 3 questions

Starts at Meridian with a factory complaining that its oil and grease result was far higher than usual. Covers complaints validated, investigated and decided by someone not involved in the original work, with progress reports, a formal end where possible, and a process description available on request under clause 7.9.2. Explains managing nonconforming work by a procedure: actions based on risk, an evaluation including the impact on previous results, a decision on acceptability, notifying the customer or recalling work where necessary, and authorised resumption. Covers when corrective action must follow, because the work could recur or the system is in doubt, and the auditor's method of tracing one event backwards. It ends with 'Which clause?' moments, a recap and three practice questions.

What you will be able to do

• Audit how complaints are validated, investigated and closed
• Check that nonconforming work is evaluated for impact on earlier results
• Decide when nonconforming work requires corrective action

Why it matters

Asking which earlier results a problem touched is what stops one error spreading to other customers.

Practice: Practice: Complaints and nonconforming work · 3 questions

Opens at Meridian, whose laboratory information management system is hosted by its supplier, which installed an update in June without the laboratory checking that calculations were still correct. Covers information systems, on screen or on paper, validated before use, with every change authorised, documented and validated, including at hosted suppliers. Explains protecting systems against unauthorised access, tampering and loss, and recording failures and the actions taken. Covers clause 7.11.6: checking calculations and data transfers in an appropriate and systematic manner, including copying results by hand into reports. Ends with the auditor's method: follow one number from the instrument to the report. It ends with 'Which clause?' moments, a recap and three practice questions.

What you will be able to do

• Check that LIMS and software changes are validated before use
• Audit protection of data against access, tampering and loss
• Verify that calculations and data transfers are checked

Why it matters

Following one number from instrument to report finds software and copying errors before customers do.

Practice: Practice: Control of data and information · 3 questions

Starts with Meridian's field team, where the effluent sampling procedure in the document system is at revision 4, with a changed preservation step, while the copy in the field kit is older. Covers the two management system options, and policies and objectives that address competence, impartiality and consistent operation and are known and used at all levels. Explains controlling internal and external documents so they are approved before issue by authorised personnel, as clause 8.3.2 item a requires, reviewed, identified and current at the point of use, with obsolete versions kept out of use. Covers records that are legible, protected, retrievable and kept as long as contracts require, and visiting the points of use. It ends with 'Which clause?' moments, a recap and three practice questions.

What you will be able to do

• Explain how Option A and Option B shape the management system
• Audit document control at the point of use
• Check that records are protected, retrievable and retained

Why it matters

Checking the copy at the bench, not only the system, catches the outdated procedure that gives wrong results.

Practice: Practice: Options, documents and records · 3 questions

Returns to Meridian's poor proficiency result for lead from Module 14, where a corrective action was finally raised but its cause was not found. Covers clause 8.5: risks and opportunities considered, with planned, proportional actions whose effectiveness is evaluated, and no formal risk method required. Explains clause 8.6: identifying and acting on opportunities for improvement, and seeking, analysing and using customer feedback. Covers clause 8.7: corrective action that finds causes, looks for similar cases, makes changes and, under clause 8.7.1 item d, reviews effectiveness, with records of each step, set against a laboratory that closes every action as soon as it is done. It ends with 'Which clause?' moments, a recap and three practice questions.

What you will be able to do

• Audit actions on risks and opportunities and their effectiveness
• Check that customer feedback is sought and used
• Verify corrective actions for cause analysis and effectiveness

Why it matters

Checking that a cause is really gone stops the laboratory meeting the same problem again next year.

Practice: Practice: Risks, improvement and corrective actions · 3 questions

Opens at Meridian, where last year's management review minutes cover sales, new staff and the building refit, but record no decisions on quality. Covers auditing the internal audit programme itself: considering importance, changes and previous results, and audit findings that lead to action without undue delay. Explains management review inputs, recorded and covering all fifteen items, from audits and complaints to the validity of results. Covers clause 8.9.3 outputs that record all decisions and actions on effectiveness, improvement, resources and any need for change, and checking at the next review what happened to them. Closes Part B and leads into Part C and ISO 19011:2026. It ends with 'Which clause?' moments, a recap and three practice questions.

What you will be able to do

• Audit the internal audit programme against clause 8.8
• Check that management review covers all fifteen inputs
• Follow management review decisions into the next year

Why it matters

Following one review decision into the next year shows whether management really steers the laboratory.

Practice: Practice: Internal audits and management reviews · 3 questions

Opens Part C with the question of what makes an audit finding impossible to argue with. Covers ISO 19011:2026, the fourth edition published in May 2026, replacing the 2018 edition, as guidance rather than requirements. Explains the chain of audit criteria, audit evidence, audit findings and audit conclusions, and the three types of audit: the internal audit as first party and the accreditation assessment as third party. Covers the seven principles of auditing, with quick checks: a finding based on lunchtime talk breaks the evidence-based approach, and a section supervisor who is the auditor's sister puts independence at stake, so the auditor changes. It ends with a recap and three practice questions.

What you will be able to do

• Explain the chain from audit criteria to audit conclusions
• Apply the seven principles of auditing to laboratory audits
• Keep independence by not auditing your own work

Why it matters

Findings built on criteria and verified evidence are ones laboratory managers cannot dismiss.

Practice: Practice: Audit concepts and principles · 3 questions

Starts with last year's internal audit plan at Meridian, which sent the auditor to the wrong place, for the wrong time, with the wrong questions. Covers a risk-based programme that considers importance, changes and previous results, gives priority to higher risk and weaker performance, and uses vertical, horizontal and witnessing audits across tests, calibrations and sites. Explains defining each audit's objectives, a scope that names its sites, and criteria with clause titles. Shows an audit plan that puts the riskiest work first, and a checklist that builds questions from the standard and the laboratory's own procedures, with time left for following trails later in the day or programme. It ends with a recap and three practice questions.

What you will be able to do

• Build a risk-based audit programme across tests, calibrations and sites
• Define audit objectives, scope and criteria with clause titles
• Write an audit plan and checklist from the standard and procedures

Why it matters

Planning from risk spends the most audit time where a wrong result would hurt most.

Practice: Practice: Planning the audit programme, plan, checklist · 3 questions

Opens in microbiology at Meridian, where an internal auditor walks straight in with no opening meeting and could himself contaminate a sample. Covers the opening meeting: agreeing the plan, introducing the team and confirming the audit can run, where short is fine but skipped is not. Explains following each room's rules on site, keeping hands off unless explicitly permitted, even when competent to use the equipment, and not becoming a source of contamination, using remote methods where they fit. Covers witnessing the normal work of tests and calibrations, interviewing the people who do it, and the human side of auditing, behaving so that analysts trust the auditor. It ends with a recap and three practice questions.

What you will be able to do

• Run a short, effective opening meeting
• Witness tests and calibrations without affecting the work
• Interview analysts in ways that keep them giving accurate information

Why it matters

Working carefully at the bench protects both the samples and the trust that makes people talk.

Practice: Practice: Conducting the audit, I opening, site, witnessing · 3 questions

Opens with the course promise: following a reported result all the way back to its raw data, and the question of how many steps lie between a number on a report and its measurement. Covers investigating to the depth necessary, following the trail from answer to record to next question, and stopping when the sample is sufficient. Explains verifying information until it is complete, correct, consistent and current, sampling records by judgement or statistics sized to the risk, open questions to explore and closed ones to confirm, and noting exactly what was seen. Shows tracing one Meridian result end to end through people, samples, equipment and checks, and replacing a question that suggests its answer. It ends with a recap and three practice questions.

What you will be able to do

• Verify information before treating it as audit evidence
• Sample records by judgement or statistics, sized to the risk
• Trace a reported result back to its raw data

Why it matters

Tracing one result to its raw data tests every part of the laboratory system in a single audit trail.

Practice: Practice: Conducting the audit, II evidence and one result · 3 questions

Opens with the question of whether a finding stays in the report if the laboratory manager disagrees. Covers what a finding is: under clause 6.4.8 of the guidance, audit evidence evaluated against criteria, showing conformity or nonconformity. Explains writing a nonconformity that names the criteria, the evidence and why the criteria are not met, with grading criteria defined and communicated, using a Meridian example where two worksheets show no checker. Covers a closing meeting with no surprises, a complete, accurate, concise and clear audit report to relevant management, and follow-up that verifies both completion and effectiveness of corrective action without undue delay. It ends with a recap and three practice questions.

What you will be able to do

• Write a nonconformity that names criteria, evidence and the gap
• Grade findings against defined criteria
• Run a closing meeting and verify follow-up for effectiveness

Why it matters

A finding as good as its evidence is one the laboratory will act on, not argue about.

Practice: Practice: Findings, closing, reporting and follow-up · 3 questions

Opens with the question of whether an audit should start with the laboratory's procedure or the standard: with the standard, and the laboratory's own requirements beside it. Walks through an effective internal audit step by step, from building the checklist from the standard and the area's methods, procedures and risks, to going to the bench, witnessing a test or calibration, tracing one result back to raw data, writing clear findings and following them up until actions work. Sets up a practice audit at Meridian, gives advice to start small and soon, recaps the whole course in three lines, and leads into the practice exercises and the final exam.

What you will be able to do

• Start an audit from the standard and the laboratory's own requirements
• Carry out each step of an effective laboratory internal audit
• Apply the whole method in a practice audit

Why it matters

Auditing from requirements to the bench to findings is how every reported result can be trusted.

Practice: Practice: An effective internal audit, end to end · 3 questions