How to share evidence safely in a remote accreditation assessment

IAF MD 4 is the IAF mandatory document on using information and communication technology (ICT) in conformity assessment; the current edition, MD 4:2025, has applied since 30 January 2026. It was written for certification, validation and verification, applies to accreditation bodies too, and says it may be considered alongside other conformity assessment standards. The provisions that matter to a laboratory sharing evidence:

TÜRKAK published its Remote Audit Guide on 8 May 2020, during the COVID-19 pandemic, so that surveillance and renewal assessments could continue remotely. Its main requests to accredited bodies:

• The body to be audited remotely signs form F705-001 (Remote Audit Information Declaration and Commitment) and uploads it to the TÜRKAK e-Portal; the process follows procedure P705 for remote audits.
• Records are kept ready in electronic, shareable form; records requested by the audit team are uploaded to the e-Portal under the audit's "Remote Audit Records" heading.
• The list of records for laboratories includes records showing that the laboratory information management system is configured and validated in line with the standard and legal requirements, and records of confidentiality activities.
• A test connection with TÜRKAK's file officer takes place no later than one day before the audit; witnessing is done by live video, video recording, interview or document review.
• The decision to record the audit in sound and video lies with TÜRKAK, under the confidentiality requirements; screenshots the audit team takes for its report are deleted once the process is complete.

The guide dates from 2020. Confirm the method, the tool and the way evidence will be shared with your TÜRKAK file officer before the assessment.

The evidence to share follows the clauses in your accreditation scope. The record list TÜRKAK's guide gives for laboratories maps to ISO/IEC 17025 like this:

The assessor may pick one of the sample reports and trace the records behind it; this technique is called a vertical audit. Keep sample reports openable together with the related authorization, calibration and control records.

Least privilege means the assessor sees only the evidence within the assessment's scope, and only for the period it covers. KVKK Article 4 requires personal data to be relevant, limited and proportionate to its purpose; ISO/IEC 17025 §4.2 treats customer information as confidential. In practice:

• Put only the evidence for clauses in scope into the shared area.
• Set the record period to fit the assessment, for example the time since the last assessment.
• In a multi-site laboratory, open only the site being assessed.
• Open customer names and file downloads only when the assessment needs them.
• Give the assessor personal, time-limited access instead of a shared laboratory account; only then is every view tied to a person.

When the link and the password travel by different routes, opening the access means capturing both channels. A single e-mail sent to the wrong person then carries only half of what is needed.

• Send the link by e-mail and the password by phone or in person.
• Keep the password out of the e-mail thread; a forwarded thread carries everything in it.
• If you can, add a third step: a one-time code sent to the assessor's e-mail ties the access to that person's mailbox.
• Use a route where the link and password can be viewed only at the moment they are created; a password that can be shown again later is also a copy held inside the laboratory.

Access covers the days of the assessment and closes when the assessment ends. Setting the time limit up front means closing the access never depends on someone remembering to do it.

• Grant access with a start and an end; a folder shared without an end date stays open after the assessment.
• Put a time limit on sessions too: a session that closes when idle limits what an unattended computer can show.
• If the assessment runs longer, extend the access; when it ends, close it and keep a record of that.
• If more evidence is requested after the closing meeting, open a new access with a narrow scope.

A view log lets the laboratory show which information was opened to whom, and when. KVKK Article 12 requires the data controller to take the technical and organisational measures needed to prevent unlawful access to personal data; ISO/IEC 17025 §7.11.3 requires the laboratory information management system to be protected from unauthorized access, tampering and loss.

If every record the assessor opened, every file they downloaded and every refused sign-in attempt sits in a dated log, the questions "whose personnel file was opened?" and "who was shown this customer's samples?" already have answers after the assessment. Keep the log with the assessment file.

The laboratory is the data controller sharing its staff's personal data with the accreditation body for the assessment. The data shared is mostly staff names, titles, authorizations, training and competence monitoring records; sample records also show the names of the people who did, approved and signed the work.

• Health data is a special category of personal data (KVKK Article 6). Keep the health reports in personnel files out of the shared area.
• Limit sharing to its purpose (Article 4): only the areas, sites and record period that are needed.
• Review your duty to inform (Article 10): does the privacy notice you give staff cover sharing for accreditation assessments?
• Protect customer information too (§4.2): customer names in sample and complaint records appear only where needed.
• Close the access when the assessment ends.

Contracts and privacy notices belong to the laboratory; prepare them with your legal adviser.

Preparation starts with choosing the evidence and ends with closing the access. A sample sequence:

In PureField LIMS the laboratory manager or quality manager opens chosen evidence to the assessor, read-only and time-limited, from Kalite → Akreditasyon → Değerlendirici erişimi (Quality → Accreditation → Assessor access) with Yeni erişim (New access). The rules above map to the screen like this:

At the top of every page the assessor sees their own name, that the view is read-only, and when the session and the access end. The overview area shows the laboratory, its sites, the accreditation scope lines, clause evidence notes and, for the clauses in scope, the ISO/IEC 17025 compliance map. The map shows which screens support each clause; the conformity decision is the assessor's.