ISO/IEC 17025 calibration lab software: a buyer's checklist

A calibration laboratory is judged by its certificates, and a certificate is only as good as the records behind it. When an assessor asks how a result was obtained, the answer has to come from the service request, the method, the equipment used and its traceability, the uncertainty budget, the decision rule and the person who authorised it — all of it retrievable, years later.

Many labs still keep those records across spreadsheets, word-processor templates and a shared drive. This checklist is for labs choosing software to replace them. It is organised around the clauses of ISO/IEC 17025:2017 that software touches most. It does not replace the standard, or your accreditation body's requirements — in India, NABL's — but it will help you ask vendors the right questions.

We are building CalibIQ, calibration lab software for NABL and ISO/IEC 17025 laboratories. It is in development, with a pilot programme open. Where it covers an item we say so; where you should check with any vendor, including us, we say that too.

1. Requests, tenders and contracts (clause 7.1)

• A service request (SRF) is recorded for every job: the customer, the items, the calibration requested, and any statement of conformity the customer wants.
• Where a pass/fail statement is requested, the decision rule is agreed with the customer at this stage and stored with the job.
• Deviations from the request are recorded and communicated to the customer.
• Each item is uniquely identified from intake to return.

2. Methods (clause 7.2)

• Every job is linked to the method used, and to the version of it in force at the time.
• Method verification and validation records are kept and can be found from the method.

3. Equipment and traceability (clauses 6.4 and 6.5)

• Every reference standard and instrument has a record: identification, calibration status, due date and its own certificate.
• Each standard is linked to the standard it was calibrated against, up to a national or international standard — a traceability chain you can show, not merely describe.
• Equipment that is out of calibration or out of service cannot quietly be used on a job.
• Intermediate checks are recorded where you perform them.

4. Measurement uncertainty (clause 7.6)

This is where spreadsheets hurt most. An uncertainty budget lists every contribution — the reference standard, resolution, repeatability, environmental effects and so on — combines them into a combined standard uncertainty, and applies a coverage factor, typically k = 2 for a coverage probability of about 95%, to give the expanded uncertainty. A copy of a spreadsheet beside each result is fragile: formulas get overwritten, versions diverge, and nobody can prove which version produced which certificate.

• Contributions, combined standard uncertainty, coverage factor and expanded uncertainty are computed and stored with each result.
• Budgets are templated per method or parameter, so the same calculation is used every time.
• Reported uncertainty can be checked against your scope of accreditation and its calibration and measurement capability (CMC).
• Changing a budget template does not silently change results already issued.

5. Technical records (clause 7.5)

• Observations are recorded at the time, with who performed the work and when.
• Environmental conditions are recorded where they affect the result.
• Amendments keep the original value alongside the change, the reason, who made it and when.
• Records can be retrieved by certificate number, item, customer or reference standard.

6. Certificates (clause 7.8)

• Certificates carry what the standard requires, including a unique identification, the customer, the item, the method, the date of calibration, the results with their measurement uncertainty and units, and who authorised the certificate.
• Statements of conformity are made against a stated decision rule, and the certificate identifies the rule applied.
• An amended certificate is a new, uniquely identified certificate that references the one it replaces.
• Certificates are generated from recorded data, not typed into a template by hand.

7. Validity, nonconforming work and corrective action (clauses 7.7, 7.10 and 8.7)

• Proficiency testing and interlaboratory comparison results are recorded and reviewed.
• Nonconforming work can be raised, linked to the affected jobs and certificates, and closed with evidence.
• Corrective actions are tracked through to verification of effectiveness.

8. The management system (clauses 8.3, 8.4, 8.8 and 8.9)

• Document control: controlled documents with versions, approval and withdrawal of obsolete copies.
• Control of records: retention periods, protection and retrieval.
• Internal audits planned, recorded and followed up.
• Management review inputs and outputs recorded, with actions tracked.

9. Data and information management (clause 7.11)

The standard asks a lab to make sure its software is fit for purpose and its data protected. Whatever you are evaluating, ask:

• Where is our data hosted, and who at the vendor can see it?
• How are backups taken, and when was a restore last tested?
• Is every user's access controlled by role, with an audit trail of changes?
• If the software serves several labs, how is each lab's data kept apart?
• Can we export all our records, in a usable format, at any time?
• How are software changes tested before they reach us?

How CalibIQ maps to this list

CalibIQ is in development and not yet deployed for customers. We are onboarding the first laboratories now: any lab can start with a 30-day free trial, and the first five pilot labs get free setup and migration of their existing instrument and certificate records. For anything on this checklist that is not in the table, ask us — we will tell you whether it exists, is planned, or is not something we do.

How to evaluate any lab software

1. Pick three real, completed jobs: one simple, one with a statement of conformity, and one that was amended.
2. Enter them in the software during the trial.
3. Compare the certificates it produces, line by line, with the ones you issued.
4. Ask your quality manager to trace one result back to a national standard using only the software.
5. Ask how you would leave: export everything, and check that it opens.

If the software cannot reproduce your own certificates, it will not help you through an assessment. Moving a lab off paper and spreadsheets is a special case of a general method, which we describe in turning a paper register into software.

Join the pilot

Ask for a CalibIQ demo or a trial on WhatsApp or at krishan.joshi@corestacktechnology.com. Send a redacted certificate and its uncertainty budget, and we will show you the same job in CalibIQ.

Frequently asked questions