How to run a vertical audit in an ISO/IEC 17025 laboratory

The accreditation assessor uses it to compare the laboratory's written system with the work itself, and the laboratory uses the same technique in its internal audits (§8.8). A laboratory that has traced a few reports itself knows what the assessor will find in the one they pick.

A typical scene: the assessor puts a report on the table and says, "Let's trace this one back together." The quality manager pulls the approver's authorization from one binder, the calibration certificate from another, that day's control chart from a spreadsheet and the receipt form from the archive. The more scattered the records, the longer the trail takes, and every gap turns into another question.

The trail can run backwards from the report to the sample or forwards from receipt to the report; the question asked and the record requested at each step stay the same. The table below runs backwards from the report:

At every step the assessor looks for three things: who did the work, when, and whether the record was made at the time. §7.5.1 asks technical records to carry the date and the identity of the person who performed the activity and the person who checked the data, and raw observations to be recorded when they are made. Under §7.5.2 every change to a technical record traces back to the previous version, keeping the original value, the date of the change and the person who made it.

Dates are the first place where two records show whether they agree. The assessor lines the dates up and checks the order:

An instrument's calibration may be valid today; what a vertical audit asks is whether it was valid on the day of the analysis. The same question applies to the analyst's authorization and to the method version.

A sample trail brings together every record behind one report, in the order the assessor will ask for them. Before the assessment, build a few yourself:

• Pick two or three reports from different methods, different analysts and, in a multi-site laboratory, different sites; try to avoid the reports looked at in the previous assessment.
• For each report, find the record for each of the ten steps above and note where it lives: a screen, a binder or a file.
• Run the date comparisons and note any record whose calibration or authorization does not cover the analysis day.
• Work through the calculation from raw data to the reported figure once by hand; rounding and unit conversions show up here.
• If you picked an amended report, put the old and new versions side by side and check that the reason for the change is stated.
• Where the customer's name is not needed, prepare the trail without customer identity; ISO/IEC 17025 §4.2 treats customer information as confidential.
• Log any gap you find as a CAPA or an internal audit finding, so that if the assessor picks the same report you can show how it was closed.

Findings in a vertical audit appear where two records disagree. Typical examples:

The examples are derived from the clause texts. They share one thing: the answer to who, when and with which record is missing somewhere along the trail.

Plan vertical audits in the internal audit programme around reports chosen to cover the scope; §8.8 asks for internal audits at planned intervals. Write the selection into the programme rather than leaving it to chance:

• Make sure every accredited method, every analyst and every site appears in at least one vertical audit during the programme period.
• Plan horizontal and vertical audits together: in one period, review the calibration records of every instrument horizontally and trace two reports vertically.
• Turn a gap found in a vertical audit into a horizontal question: if one instrument was out of calibration, is any other instrument in the same state?
• Combine witnessing with a vertical trail: watch the analyst run the test, then trace that test's report back to receipt.

In PureField LIMS the laboratory manager or quality manager gives the accreditation assessor read-only, time-limited access to chosen evidence through Değerlendirici erişimi (assessor access). One of the evidence areas is Numune izi (dikey tetkik), the sample trail for a vertical audit (§7.4, §7.5, §7.8). On one screen the assessor sees a sample's trail from receipt to report:

• Who received the sample, and the acceptance check.
• The analyst of each analysis, and who entered, reviewed and approved the results, and when.
• The instruments used, and the results.
• Reports and electronic signatures: the meaning of the signature, the signer, the time, the method and the record digest.

If the same access also shares personnel and competence, equipment and calibration, methods and validation, measurement uncertainty, and QC and proficiency testing, the assessor opens the matching record from those lists; the rest of the trail is there. Samples appear within the record period chosen for the access. With customer identity switched off, the customer's name, the sample description and the customer reference stay hidden in the sample trail; reports appear with their number, issuer, issue time and verification code.

The rules that keep the trail consistent apply when the records are made: staff are authorized per method with an e-signature, only instruments with valid calibration can be added to an analysis, and the person who approves a result is always someone other than the person who entered it. Every record the assessor opens is written to the laboratory's audit trail as "Değerlendirici: name (organisation)".