Risk in ISO/IEC 17025:2017 – New or Not

Clause 8.5.1 of the ISO/IEC 17025:2017 standard states that “The laboratory shall consider the risks and opportunities associated with the laboratory activities in order to….”.  All laboratories consider risks and opportunities every day, but the challenge is being able to demonstrate conformance with this requirement. For example, a laboratory performing microbiological methods that rely on a colour reaction (for example, reading plates, reading Presence/Absence results, or reading Quantitrays) perform inter-analyst reading comparisons.  Why is this done?  While most laboratories may respond “Because it's a CALA requirement” the real answer is that it is to reduce the risk that a false negative or false positive result is reported because of differences in the competence of personnel.  (As an aside, you can also see that prescriptive requirements or checklists can help to mitigate risk).

Clause 8.5.2 requires that laboratories shall plan actions to address risks and opportunities, integrate and plan these actions into the management system, and evaluate the effectiveness of these actions.

In order to mitigate the risk that laboratories develop and implement expensive systems to meet clause 8.5, the note under clause 8.5.2 states that there is “no requirement for formal methods for risk management or a documented risk management process”.   However, while formal or documented risk management processes may not be required, remember that CALA still needs objective evidence that the laboratory is indeed considering risks and opportunities.

So what is your objective evidence that there is a plan in place to minimize the risk of false positives or false negatives being reported because one of the personnel misinterpreted a colour change?  There is the record of the monthly inter-technician comparison readings.  Are there others?  Very likely.   Go through your system and identify what they are, and other objective evidence you can show an assessor.

One effective way to manage the concept of “risk” is to set up a 3-column table with the headings: Risk, Probability (Low/Medium/High) and Actions.

• Start by listing the risks associated with a method or process.  Generally we tend to list the things that could go wrong, but the clause also encompasses opportunities.
• Review the list and try to determine if the risk is low, medium, or high.
• What is being done right now in your system that eliminates or mitigates this risk?
• Is there a procedure in place?
• Are there records available to demonstrate that the procedure is being effectively implemented?

This exercise is really a simplified risk register.  At the end of this exercise, you may be pleasantly surprised to see that your system is meeting Section 8.5 of the standard.  While not required by the standard, it may prove to be a good tool and starting point for the laboratory to consolidate activities around risks and opportunities, and to provide objective evidence to CALA assessors and staff.  As you get more comfortable with the concepts, you may develop other ways to demonstrate how the laboratory's system meets the requirements.

Keep in mind is that this is not a one-time exercise.  Although a good starting point, you need to think about risks and opportunities on an on-going basis.  Risk comes into play when there are changes in the laboratory including, but not limited to, changes in personnel, procedures and equipment.  The whole standard was written with a risk-based thinking approach, which is the main reason why many of the requirements are not as prescriptive as in the previous version of the standard.  Part of the challenge is recognizing that risk-based thinking can be applied when implementing any of the clauses of the standard or processes in the laboratory.

Clause 8.5.3 is simply stating that if the risk is going to have a significant impact on the validity of the test results, then the subsequent action(s) should significantly reduce the risk.  Conversely, if the risk is low, then there is no need to have all kinds of processes and procedures in place to eliminate or minimize the risk.  Keep this in mind as you complete your analysis.  The 'notes' under this clause refer to various different ways to address risk, and if you are not familiar with them, it is highly recommended that you do some more research or training on these concepts. CALA does offer training courses and webinars on risk; for a list of upcoming courses, please refer to: cala-training.myshopify.com