Explain ISO/IEC 17025, ISO 15189, CLIA, CAP and GMP audits, and how proficiency testing works.
Why it matters
Clients, patients and regulators cannot check every result a lab produces. Instead they rely on audits and accreditation: independent checks that the lab's system produces reliable results. A lab that loses accreditation can lose its contracts or its legal right to report patient results. As a technician you will be interviewed by auditors, asked to show records, and expected to explain what you do and why. Knowing the main frameworks helps you understand why your lab's rules exist.
Audits and inspections
- Internal audits: the lab's own quality staff (or trained colleagues) check compliance with its procedures, usually on a schedule.
- External audits: by an accreditation body, a client (a supplier audit) or a certification body.
- Regulatory inspections: by a government agency, such as the US FDA for drug manufacturing.
Auditors review documents and records, watch work being done, and interview staff. A common technique is tracing: pick one reported result and follow it back to the sample receipt, the analyst's training record, the instrument's calibration, the reagent lots, the raw data and the review signatures. Gaps become findings (also called nonconformities), often graded as major or minor. The lab responds with a CAPA plan.
The main frameworks
| Framework | Applies to | What it is |
|---|---|---|
| ISO/IEC 17025 | Testing and calibration labs (environmental, food, materials, forensic, calibration) | International standard for competence, impartiality and consistent operation |
| ISO 15189 | Medical laboratories | International standard for quality and competence in medical labs |
| CLIA | US clinical labs testing human specimens | Federal regulations (42 CFR Part 493), administered by CMS |
| CAP accreditation | Clinical labs (US and international) | Peer-inspection programme using detailed checklists |
| GMP (cGMP) | Manufacturing of drugs, biologics and devices, including QC labs | Regulations such as 21 CFR Parts 210 and 211 (drugs), enforced by FDA |
| GLP | Non-clinical safety studies supporting regulatory submissions | Regulations such as 21 CFR Part 58 |
ISO/IEC 17025
ISO/IEC 17025 sets requirements for impartiality and confidentiality, staff competence, equipment and metrological traceability, method validation, measurement uncertainty, handling of samples, quality control, reporting and a management system. Accreditation is granted by national accreditation bodies (for example, A2LA and ANAB in the US), which recognise each other's results through the ILAC arrangement (https://www.ilac.org/). See ISO's overview: https://www.iso.org/ISO-IEC-17025-testing-and-calibration-laboratories.html (Checked on 2026-10-23.)
CLIA and CAP
Every US lab that tests human specimens for health assessment needs a CLIA certificate. CLIA sets requirements for personnel, QC, proficiency testing and quality systems based on test complexity: https://www.cms.gov/medicare/quality/clinical-laboratory-improvement-amendments (Checked on 2026-10-23.) CAP accreditation is a voluntary programme recognised by CMS as meeting CLIA requirements. CAP inspection teams, made up of practising lab professionals, use checklists and inspect accredited labs on a regular cycle: https://www.cap.org/laboratory-improvement/accreditation (Checked on 2026-10-23.)
GMP and GLP
GMP covers how medicines and related products are made and tested, so that every batch meets its specifications. QC labs in a GMP plant follow strict rules on data integrity, OOS investigations, equipment qualification and batch release. FDA investigators record significant observations on a Form 483 at the end of an inspection. FDA's CGMP page: https://www.fda.gov/drugs/pharmaceutical-quality-resources/current-good-manufacturing-practice-cgmp-regulations (Checked on 2026-10-23.) GLP is different: it covers how non-clinical safety studies are planned, performed, recorded and archived (21 CFR Part 58).
Proficiency testing
In proficiency testing (PT), an external provider sends the lab unknown samples, and the lab's results are compared with other labs or the known value. CLIA requires PT for many clinical tests, and ISO/IEC 17025 accreditation expects participation in PT or interlaboratory comparisons. PT samples must be tested like patient or routine samples, by the staff who normally do the test. Sending PT samples to another lab, or sharing results before the deadline, is a serious violation.
How to behave in an audit
- Answer the question asked, honestly and factually. "I don't know, but I can find out" or "That is in SOP-QC-017; I'll show you" is fine.
- Show records rather than describing them from memory.
- Never change, backdate or "tidy" records before or during an audit.
- If you notice a problem, say so: a self-identified issue with a CAPA is far better than one an auditor finds.
Common mistakes
- Thinking audits are only the quality department's business.
- Preparing for audits instead of working to the standard every day.
- Treating PT samples specially.
- Confusing GMP (product manufacturing and testing) with GLP (non-clinical safety studies).
Quick recap
- Audits are internal, external or regulatory; tracing a result end to end is a core technique.
- ISO/IEC 17025 for testing and calibration labs, ISO 15189 for medical labs.
- In the US, CLIA is the law for clinical labs; CAP accreditation is a recognised way to meet it.
- GMP governs manufacturing and QC; GLP governs non-clinical safety studies.
- Proficiency testing compares your lab with others; treat PT samples like routine work.
Try it
This lesson is quiz-only. Open the Do tab to check your understanding.