Every NATA, NABL, and ISO/IEC 17025 assessment produces findings. Most of them are predictable. Across laboratory audits, the same five categories of non-conformance appear repeatedly — not because labs are unaware of the requirements, but because the underlying management systems make these gaps easy to overlook until an assessor points them out.
The good news is that every one of these is preventable. Each has a clear root cause, and each can be addressed with the right controls embedded into daily operations — not just chased in the weeks before an assessment.
1. Technical Records — Missing Traceability and Audit Trail
Technical records are the most consistently cited finding in laboratory assessments. The requirement under ISO/IEC 17025 Clause 7.5 is clear: results must be traceable to the method, the instrument, the operator, and the conditions at the time of testing. In practice, assessors find records that are incomplete, retrospectively filled, or missing critical links in the traceability chain.
Common issues include:
- Test results recorded without the specific instrument serial number used
- Operator identification absent or only partially recorded
- Environmental conditions not logged for methods that require them
- Amendment records that overwrite originals rather than logging the change with reason and authority
The underlying cause is almost always manual record-keeping — paper forms or spreadsheets where fields can be skipped and corrections are made by erasing rather than amending. The fix is structured digital data entry that enforces completeness before a record can be submitted, with immutable amendment trails that preserve original values alongside every correction.
2. Personnel Competency — Unauthorised or Lapsed Qualifications
Assessors check whether the personnel performing tests and calibrations are demonstrably competent — and whether that competency was current at the time the work was carried out. Two failures appear routinely: staff performing work they haven't been formally authorised for, and authorisations that have lapsed without renewal.
Both failures share the same root: competency records managed in spreadsheets or paper files that nobody actively monitors. Authorisations expire quietly. New test methods get added to scope without a corresponding review of who is qualified to perform them. When an assessor asks to see the authorisation matrix, it either doesn't exist in a usable form or shows gaps nobody noticed.
Preventing this requires a live competency matrix — one that links each authorised person to specific methods, instruments, or activities, with expiry tracking and automatic alerts when re-assessment is due. Authorisation status should be visible at the point of job assignment, so supervisors can't accidentally allocate work to someone whose qualification has lapsed.
3. Test Reports — Non-Compliance with Clause 7.8
Test and calibration reports are the primary output of an accredited laboratory, and Clause 7.8 of ISO/IEC 17025 specifies in detail what they must contain. Missing elements are among the most common findings — not because labs don't know the requirements, but because report templates drift over time, or staff produce reports manually in formats that haven't been reviewed against the current standard.
Frequently cited gaps include:
- Failure to clearly identify results obtained from external sources or subcontractors
- Unaccredited methods used without being flagged as outside the scope of accreditation
- Missing statement of conformance or non-conformance where a pass/fail determination is required
- Reports issued without a unique identifier enabling traceability back to the original job record
Report templates should be locked to the standard — with required fields enforced, accreditation scope automatically checked against the methods used, and a unique report reference generated at issuance rather than assigned manually.
4. Equipment Calibration — Overdue or Unverified Instruments
Overdue calibrations are one of the most common findings across NATA, NABL, and ISO/IEC 17025 assessments — and one of the most avoidable, because the information needed to prevent them is always available. Every instrument has a calibration due date. The failure is a management one: no system actively tracking those dates and alerting the right people when action is required.
The problem compounds when out-of-tolerance instruments aren't caught before use. An instrument recalibrated late creates a gap period where the validity of results performed with it is in question. Assessors will ask about this — and if there's no process for assessing the impact on prior results, that's a separate finding.
A proper calibration management system tracks due dates, sends automated alerts before expiry, prevents use of overdue instruments on active jobs, and triggers an impact assessment workflow when a late or out-of-tolerance calibration is recorded. This isn't complex — it just needs to be built into the system rather than managed on a spreadsheet that nobody checks.
5. Document Control — Outdated or Uncontrolled Documents in Use
Document control failures take two forms. The first is the use of outdated procedures — a previous revision of an SOP or test method still in circulation after a newer version was approved. The second is the absence of formal version control entirely: documents distributed as email attachments or shared drive files with no approval record, no revision history, and no way to confirm the version in use is the current one.
ISO/IEC 17025 Clause 8.3 requires that documents be reviewed and approved prior to issue, that the current revision status be identifiable, and that obsolete documents be removed from use. These requirements are only met in practice when the document management system makes it impossible to use an obsolete version — not just difficult, or dependent on people remembering to check.
Version-controlled document libraries with approval workflows, automatic distribution of updated versions, and clear flagging of superseded documents address all three requirements directly. When a new revision is approved, the old one should be inaccessible — not just labelled "obsolete" in a folder nobody manages.
From Findings to Prevention
What these five non-conformances share is that they're systemic — not one-off mistakes, but gaps in the management system that make failures predictable. Addressing them properly means changing the system, not just fixing the individual finding the assessor raised.
The most effective approach is to embed controls directly into the platform your team uses every day: structured record entry that enforces completeness, live competency tracking with automated alerts, locked report templates with scope verification, calibration due-date management with impact assessment workflows, and version-controlled document distribution with obsolete-version removal.
When these controls are built into the workflow rather than bolted on as separate compliance activities, they stop being things you check before an assessment and become part of how the lab operates year-round — which is precisely what auditors are looking for.