ISO/IEC 17025 vs ISO 9001: What Your Auditor Actually Wants to See on a Calibration Certificate

The mix-up that costs people audit time

Walk into a hundred QA conversations and you will hear the two standards used interchangeably. They are not interchangeable. They sit on opposite sides of the bench.

ISO/IEC 17025 is the international standard for the competence of testing and calibration laboratories. When a lab is accredited to 17025 by an accreditation body (in Singapore, that is SAC-SINGLAS), an independent assessor has audited that lab's methods, equipment, traceability chain, and uncertainty budgets, and confirmed it is technically competent to produce the numbers it puts on a certificate.

ISO 9001 is the standard for a quality management system. It is the one your company is most likely certified to. It governs how you run processes, control documents, handle non-conformances, and, in clause 7.1.5, how you control your monitoring and measuring resources.

So the question "do I need 17025 or 9001?" usually has the same answer: you are certified to 9001, and to satisfy it, you send your equipment to a lab accredited to 17025.

What clause 7.1.5 actually asks of you

This is the clause your auditor opens. In plain English, it requires that where measurement is used to verify conformity, your measuring equipment must be:

• Calibrated or verified at defined intervals, against measurement standards traceable to international or national standards;
• Identified so its calibration status is known;
• Safeguarded against adjustments that would invalidate the calibration; and
• Supported by retained records as documented evidence.

Notice what it does not say: it does not say "use a 17025 lab." In principle you could maintain your own in-house traceability and uncertainty estimates. In practice, almost nobody wants to defend that to an auditor when an accredited certificate does the job in one document. The accreditation body has already verified the traceability and competence, so your auditor accepts it and moves on.

The five things an auditor scans a certificate for

When a certificate lands on the audit table, the trained eye is checking that the result is both traceable and competent. Here is the checklist that decides whether you get a tick or a finding.

The two that get missed most

Measurement uncertainty. A reading without an uncertainty is half a result. You cannot honestly say a gauge passed your ±2% tolerance if you do not know whether the calibration itself carries ±0.5% or ±3%. Accredited 17025 certificates state the uncertainty for exactly this reason, and the absence of one is a classic finding waiting to happen.

Traceability. "Traceable" is not a marketing word; it is an unbroken chain of comparisons, each with its own uncertainty, that links your instrument back to a national standard. In Singapore that anchor is the National Metrology Centre (NMC). A certificate that asserts a value but cannot show the chain behind it is the thing clause 7.1.5 is designed to catch.

Calibration vs verification, and why auditors prefer the data

A calibration reports the actual relationship between your instrument's reading and the reference, with uncertainty, so you can decide if it is fit for your tolerance. A verification simply states pass or fail against a fixed specification. Both have a place, but the measured-value calibration is what gives you (and your auditor), the freedom to make the tolerance call yourselves rather than inheriting someone else's pass/fail line.

Risk-based thinking and how it applies to your calibration programme

ISO 9001:2015 introduced risk-based thinking as a thread running through the whole standard, not just a single clause, and it applies directly to how you manage measuring equipment under 7.1.5. In practice this means your calibration programme should reflect the actual risk each instrument poses to product or service conformity, not treat every instrument identically. A pressure gauge controlling a safety-critical process parameter genuinely warrants tighter accuracy class, shorter interval, and more rigorous out-of-tolerance response than a general indicating gauge whose reading never feeds a conformity decision. Auditors trained on the 2015 revision increasingly expect to see this risk differentiation reflected in your calibration plan, not a flat, undifferentiated interval and accuracy requirement applied uniformly across every instrument regardless of its actual role. Documenting the risk rationale behind your calibration plan, even briefly, for each instrument category is one of the more effective ways to demonstrate genuine ownership of clause 7.1.5 rather than a box-ticking compliance exercise.

What happens during an actual audit walk-through

Understanding the mechanics of how an auditor actually works through this clause helps demystify what can otherwise feel like an arbitrary inspection. A typical ISO 9001 auditor will select a sample of instruments from your calibration register, often weighted toward those used in critical processes, and trace each one three ways: from the physical instrument on the floor to its identification and calibration status label, from that label to the corresponding certificate in your records, and from the certificate back to the register entry showing when it is next due. Any break in that three-way trace, an instrument with no visible calibration status label, a certificate that cannot be located, or a register entry that does not match the instrument's actual location, becomes a finding regardless of whether the underlying calibration itself was technically sound. This is why record-keeping discipline matters as much as the calibration quality itself: a perfectly calibrated instrument with disorganised supporting records will still generate an audit finding, because the auditor cannot verify what they cannot trace.

How other sector standards layer on top of 17025 and 9001

Most sector-specific quality standards used in Singapore do not replace ISO 9001's clause 7.1.5 requirement, they add to it. ISO 13485 (medical devices) carries an equivalent measurement traceability requirement under its own clause 7.6, with auditors typically scrutinising calibration records more closely given the direct link to patient safety. IATF 16949 (automotive) requires not just traceable calibration but often a documented measurement system analysis (Gauge R&R) demonstrating the measurement process itself, not just the instrument, is fit for purpose, a distinct exercise that sits alongside, not instead of, the underlying instrument calibration. AS9100 (aerospace) generally expects tighter documentation of the full calibration history and often requires calibration providers to appear on an approved supplier list maintained by the aerospace customer. In every case, the underlying evidence an auditor wants is the same as clause 7.1.5: traceability, stated uncertainty, and a competent, ideally accredited, source. Sector standards raise the bar on documentation rigour around that evidence; they do not change what the evidence fundamentally needs to be.

Can you maintain calibration in-house instead of using an accredited lab?

Technically, yes, and it is worth being honest about what that actually requires rather than dismissing it outright. ISO 9001 clause 7.1.5 does not mandate an accredited external laboratory; it requires traceable calibration with stated uncertainty and documented control. A company with the resources to maintain its own reference standards (themselves periodically calibrated by an accredited lab further up the chain), a controlled environment, competent staff, and a documented uncertainty budget for its own measurement processes can, in principle, satisfy the clause internally. In practice, very few Singapore SMEs find this economical: the fixed cost of maintaining reference standards, environmental control, and the specialist competence to calculate uncertainty budgets correctly usually exceeds the cost of simply outsourcing to an accredited lab, unless calibration volume is very high. Where in-house calibration is genuinely justified (high-volume production measurement systems, for instance), the internal reference standards themselves still need periodic external calibration from an accredited source, so outsourcing rarely disappears entirely; it just moves up one level in the chain.

Common non-conformances we see traced back to this exact confusion

Three patterns recur often enough to be worth naming directly. The first is a company treating an instrument manufacturer's factory calibration certificate, issued at the point of sale, as sufficient for ongoing ISO 9001 compliance years later, without any subsequent recalibration; the factory certificate proves the instrument's condition on one date only, not its condition now. The second is a company using a genuinely calibrated instrument but retaining only a pass/fail verification record rather than the underlying calibration data with stated uncertainty, then being unable to demonstrate the instrument was actually fit for the specific tolerance it was controlling. The third, and the one clause 7.1.5 audits catch most often, is an interval extended informally, "we've always done 24 months," with no documented as-found drift history to justify it; auditors are trained to ask for the evidence behind an extended interval, not just accept that the extension has been in place for years without challenge.

Surveillance audits versus certification audits: does scrutiny differ?

It is worth understanding how calibration evidence is actually reviewed across the different stages of an ISO 9001 certification cycle, since the scrutiny is not uniform. An initial certification audit typically involves a fuller review of the calibration programme's structure: the register, the interval-setting methodology, and a broader sample of instruments and certificates, since the auditor is establishing a baseline understanding of how the whole system works. Subsequent annual surveillance audits usually sample a smaller, often different, subset of instruments each year, meaning a calibration gap in one instrument category might genuinely go unsampled for a cycle or two, which is precisely why relying on "we haven't been flagged for it" as evidence a calibration programme is sound is a false comfort; a gap not yet sampled is not the same as a gap that does not exist. The full three-year recertification audit typically returns to a more comprehensive review comparable to the original certification audit. Understanding this rhythm helps explain why some organisations run for a year or two with quietly degrading calibration discipline before a recertification audit finally surfaces it, and why internal self-audits of the calibration register between external audits are a genuinely useful practice rather than an unnecessary duplication of the certification body's own review.

Multi-site consistency: a real, practical challenge

Organisations operating more than one facility under a single ISO 9001 certificate face a specific calibration management challenge worth naming directly: maintaining a consistent standard of calibration practice, provider selection, and record-keeping discipline across sites that may have grown up with different local habits, different calibration providers, and different levels of rigour in how clause 7.1.5 has historically been interpreted locally. A Singapore headquarters with strong calibration discipline and a regional site with looser practice, perhaps using a locally convenient but unaccredited provider, or maintaining a paper-only register nobody has audited in years, is a genuine and common finding pattern in multi-site certifications. The practical fix is a centrally owned calibration policy that defines the minimum standard (accreditation requirement, register content, interval-setting methodology) applied consistently across every site, with periodic internal cross-site audits specifically checking that local practice has not quietly drifted from the documented policy, rather than assuming policy compliance because the policy document itself exists and was distributed once at rollout.

A practical audit-preparation checklist

Before your next ISO 9001 surveillance or certification audit, pull your calibration register and check five things for every quality-critical instrument on it. First, is every certificate accredited (or, if not, is there a documented and justified reason it is not)? Second, does every certificate state measurement uncertainty, not just a pass/fail? Third, does the traceability statement name a specific national metrology institute, not a vague "traceable to national standards" claim? Fourth, is every instrument's calibration currently within its defined interval, with no overdue items sitting quietly in the register? Fifth, where an interval has been extended beyond a standard default, is the justification documented with reference to actual as-found data, not just informal practice? A calibration register that passes all five checks converts what is often an auditor's favourite finding into a section of the audit that closes in minutes.

The role of internal audit in catching this before the external auditor does

A well-run internal audit programme, a genuine ISO 9001 requirement in its own right under clause 9.2, is the practical mechanism that should catch calibration-related gaps before an external certification body ever sees them, yet calibration records are frequently under-sampled in internal audits compared to process and documentation controls that feel more central to day-to-day operations. An internal auditor reviewing calibration should apply the same five-point check an external auditor would: accreditation status, stated uncertainty, named traceability institute, current interval status, and documented interval-extension justification, across a genuinely representative sample of the calibration register, not just the instruments that happen to be convenient to check. Organisations that treat calibration record review as a routine, scheduled component of their internal audit programme, rather than an afterthought squeezed in if time allows, consistently walk into external audits with fewer calibration-related findings, simply because the same gaps an external auditor would find have already been caught and closed internally first.

A final, honest note on what accreditation cannot fix

It is worth closing with an honest caveat rather than overselling accreditation as a cure-all: an accredited certificate solves the traceability and competence evidence problem, but it does not solve poor internal calibration management on its own. An organisation can hold a drawer full of perfectly accredited certificates and still fail an ISO 9001 audit if the interval tracking is disorganised, if certificates are not reconciled against the actual instrument population, or if nobody has reviewed whether the stated uncertainty is actually adequate for the tolerance being controlled. Accreditation is the foundation the rest of a defensible calibration programme is built on, not a substitute for the internal discipline (the register, the interval justification, the internal audit) that this guide has covered throughout. The two work together: accredited certificates provide credible external evidence, and a well-managed internal system is what actually puts that evidence to use.

Where Unitest fits

Unitest Instruments is a SAC-SINGLAS accredited calibration laboratory (ISO/IEC 17025, accreditation no. LA-2023-0845-C). Every certificate states the measurement uncertainty and is traceable to Singapore's National Metrology Centre through the SI. The two elements auditors most often find missing elsewhere. The certificates are written to be accepted in ISO 9001 audits, across eight calibration disciplines and for instruments from Fluke, Hioki, Yokogawa, Druck and others. The point is simple: the certificate should close the finding, not open one.