Risk-Based Thinking in ISO/IEC 17025:2017
A comprehensive guide to understanding and implementing risk-based thinking in testing and calibration laboratories.
Introduction
ISO/IEC 17025:2017 introduced a significant shift towards “risk-based thinking.” Unlike the previous version, which had a specific section on preventive action, the 2017 standard integrates risk management throughout the document. This guide explains what risk-based thinking means for laboratories and how to implement it effectively.
What is Risk-Based Thinking?
Risk-based thinking is a mindset that considers risk in all aspects of laboratory operations. It involves identifying potential failures and opportunities for improvement and taking action to address them.
Key Areas for Risk Assessment
The standard requires laboratories to address risks and opportunities associated with:
- Impartiality (Clause 4.1): Identify risks to impartiality on an ongoing basis. This includes risks from ownership, governance, management, personnel, shared resources, finances, contracts, etc.
- Statements of Conformity (Clause 7.8.6): When providing a statement of conformity, the decision rule employed must take into account the level of risk (such as false accept and false reject and statistical assumptions) associated with the decision rule employed.
- Nonconforming Work (Clause 7.10): Actions (including halting or repeating of work and withholding of reports) shall be based upon the risk levels established by the laboratory.
- Management System (Clause 8.5): The laboratory must consider the risks and opportunities associated with the laboratory activities in order to:
- Give assurance that the management system achieves its intended results.
- Enhance opportunities to achieve the purpose and objectives of the laboratory.
- Prevent, or reduce, undesired impacts and potential failures in the laboratory activities.
- Achieve improvement.
Implementing a Risk Management Process
While ISO/IEC 17025:2017 does not require a formal risk management process (like ISO 31000), having a structured approach is beneficial.
Step 1: Identification
Identify what could go wrong (risks) or what could go right (opportunities).
- Risks: Equipment failure, staff turnover, sample contamination, data loss.
- Opportunities: New technology, expanding scope, training staff in new methods.
Step 2: Analysis and Evaluation
Assess the likelihood and impact of each risk.
- Likelihood: How often is this likely to happen? (Rare, Unlikely, Possible, Likely, Almost Certain)
- Impact: What would be the consequence? (Insignificant, Minor, Moderate, Major, Severe)
Step 3: Treatment
Decide how to handle the risk.
- Avoid: Stop the activity that causes the risk.
- Mitigate: Take action to reduce the likelihood or impact.
- Transfer: Share the risk (e.g., insurance, outsourcing).
- Accept: Accept the risk if it is within tolerable limits.
Step 4: Monitoring and Review
Risks change over time. Regularly review your risk register and the effectiveness of your actions.
Practical Examples
| Risk Scenario | Potential Impact | Mitigation Strategy |
|---|---|---|
| Loss of key personnel | Inability to perform specific tests, loss of expertise. | Cross-training staff, documenting procedures in detail, succession planning. |
| Equipment drift | Incorrect test results, recall of reports. | More frequent intermediate checks, trend analysis of QC data. |
| Sample mix-up | Reporting results for the wrong sample. | Barcoding system, strict chain of custody procedures, automated data entry. |
Conclusion
Risk-based thinking is not just a compliance exercise; it’s a tool for better management. By proactively identifying and addressing risks, laboratories can improve the validity of their results, enhance customer satisfaction, and ensure long-term sustainability.