understanding iso 17025 clause 8.4 - control of records
Why Records Matter – Evidence, Traceability and Technical Defensibility
Clause 8.4 is one of the most critical clauses in ISO/IEC 17025 because it governs the evidence that proves the laboratory actually follows its documented procedures. Records are the evidence of the management system. They show what was done, who did it, when it was done, how it was done, what equipment was used, what conditions existed and what results were produced. Without controlled records, the laboratory cannot demonstrate technical validity or defend its results.
Records provide evidence. They show that procedures were followed, equipment was controlled, conditions were monitored and results were produced correctly. Clause 8.4 ensures that records are accurate, complete and protected throughout their lifecycle.
Records provide traceability. They link activities to personnel, equipment, methods, dates, conditions and decisions. Traceability is essential for competence, impartiality and reliable results. Clause 8.4 ensures that records are identifiable, dated and linked to the activity they represent.
Records provide defensibility. They allow the laboratory to defend its results during audits, investigations, disputes or legal challenges. Clause 8.4 ensures that records withstand scrutiny — they must be legible, indelible and complete.
The core principle: Records are not paperwork — they are proof. Clause 8.4 ensures that the laboratory’s evidence is controlled, traceable and aligned with accreditation expectations.
Types of Records – Technical, Managerial and System‑Level Evidence
Clause 8.4 requires laboratories to control all records that demonstrate implementation of the management system and technical processes. These records fall into three major categories: technical records, managerial records and system‑level records. Each category provides essential evidence of competence, impartiality and consistent operations.
Technical Records – Evidence of Testing and Calibration Activities
Technical records include:
- Raw data
- Calculations
- Instrument outputs
- Observations
- Environmental conditions
- Sampling information
- Equipment identifiers
- Personnel identifiers
- Amendments and corrections
Technical records show how results were produced. They must be complete, legible, traceable and protected.
Managerial Records – Oversight and Competence Evidence
Managerial records include:
- Training records
- Authorisations
- Competence assessments
- Internal audits
- Management reviews
- Resource allocation decisions
These records show how management ensures competence, oversight and continual improvement.
System‑Level Records – Quality System Evidence
System‑level records include:
- Risk assessments
- Corrective actions
- Improvement actions
- Complaints
- Non-conforming work investigations
- Document control logs
These records show how the management system functions and evolves.
Clause 8.4 ensures that all records — regardless of type — are controlled with the same discipline. Together, they form the laboratory’s evidence base.
Record Requirements – Legibility, Traceability and Completeness
Clause 8.4 defines strict requirements for how records must be created, maintained and protected. These requirements ensure that records withstand scrutiny and provide reliable evidence of implementation.
Records must be:
- Legible – readable without ambiguity
- Indelible – permanent and not erasable
- Complete – containing all required information
- Dated – showing when the activity occurred
- Identifiable – linked to the activity, equipment and personnel
- Traceable – showing how results were produced
- Amended correctly – with original information still visible
- Protected – from loss, damage or unauthorised access
Clause 8.4 emphasises that records must never be altered in a way that obscures original information. Corrections must be made in a controlled manner — typically by striking through the incorrect entry, adding the correct information, and including name, surname and date. Electronic records must show audit trails.
Records must be created at the time of the activity — not later. Delayed record creation introduces risk, inconsistency and doubt. Clause 8.4 ensures that records reflect actual operations, not reconstructed memories.
A disciplined record‑creation environment strengthens reliability, protects impartiality and supports audit preparedness. Clause 8.4 ensures that records are accurate, complete and defensible.
Storage, Protection and Retrieval – Safeguarding Evidence
Clause 8.4 requires laboratories to store and protect records in a way that ensures their integrity, security and availability. Records must be safeguarded throughout their entire lifecycle — from creation to retention to eventual disposal.
Records must be:
- Stored securely
- Protected from loss or damage
- Protected from unauthorised access
- Backed up (for electronic records)
- Retained for defined periods
- Retrievable when needed
- Accessible to authorised personnel
- Protected through controlled systems
Storage protects records from physical damage, environmental conditions, accidental loss and unauthorised access. Protection ensures that records remain accurate, complete and secure. Retrieval ensures that records can be accessed quickly during audits, investigations or client queries.
Electronic records require additional controls:
- Secure servers
- Access permissions
- Audit trails
- Backup systems
- Disaster recovery plans
Clause 8.4 ensures that records are not only created correctly — they are protected correctly. A controlled record‑storage environment strengthens reliability, protects impartiality and supports accreditation preparedness.
Technician and Management Responsibilities – Evidence Creation and Oversight
Technicians and management play critical roles in ensuring that records are created, controlled and protected. Clause 8.4 emphasises that record control is not the responsibility of one person — it is shared across the laboratory.
Technician Responsibilities
Technicians must:
- Create records at the time of the activity
- Ensure records are legible, complete and indelible
- Use controlled templates and forms
- Record conditions, equipment and identifiers accurately
- Make corrections in a controlled manner
- Protect records from damage or loss
- Report missing or unclear records
- Support audits with complete evidence
Technicians are the frontline creators of evidence. Their discipline determines whether records are accurate and defensible.
Management Responsibilities
Management must:
- Define record‑control procedures
- Ensure records are stored and protected
- Maintain retention schedules
- Review records during audits and management reviews
- Provide training and resources
- Ensure alignment with actual operations
- Maintain electronic record systems
- Lead continual improvement
Management provides the oversight that keeps record control structured, secure and effective.
Together, technicians and management form the control structure that protects traceability, reliability and credibility. Clause 8.4 ensures that record control is owned, implemented and strengthened at every level.
Evidence Integrity, Traceability and Record Discipline
Records are the laboratory’s evidence base — the proof that its management system and technical processes are actually implemented. Clause 8.4 ensures that every observation, measurement, calculation, decision and action is captured, protected and traceable.
Why Records Matter – Evidence, Traceability and Technical Defensibility
Clause 8.4 ensures that records show what was done, who did it, when it was done, how it was done, what equipment was used and what conditions existed. Records provide evidence of implementation, traceability of activities and defensibility of results.
Types of Records – Technical, Managerial and System‑Level Evidence
Technical records capture raw data, calculations, instrument outputs and environmental conditions. Managerial records show training, authorisations, audits and reviews. System‑level records capture risks, corrective actions, complaints and nonconforming work.
Record Requirements – Legibility, Traceability and Completeness
Clause 8.4 requires records to be legible, indelible, complete, dated, identifiable and traceable. Corrections must never obscure original information. Electronic records must show audit trails. Records must be created at the time of the activity — not later.
Storage, Protection and Retrieval – Safeguarding Evidence
Records must be stored securely, protected from loss or damage, backed up, retrievable and accessible to authorised personnel. Clause 8.4 requires controlled storage environments, secure electronic systems, access permissions, backup strategies and retention schedules. Protection ensures integrity; retrieval ensures readiness.
Technician and Management Responsibilities – Evidence Creation and Oversight
Technicians create records daily — their discipline determines whether evidence is accurate, complete and defensible. Management ensures records are controlled, protected, reviewed and retained according to defined rules. Together, they form the evidence‑control structure that protects traceability, reliability and credibility.
Records are the laboratory’s memory — and controlled records create trustworthy laboratories.