How to Choose an ISO/IEC 17025 Analytical Testing Lab in India

Choosing an ISO/IEC 17025 analytical testing lab comes down to four checks: the accreditation is current and issued by a recognised accreditation body, the accredited scope actually covers your tests and sample types, the laboratory's data integrity controls would stand up to regulatory scrutiny, and it has the method validation skills and instruments your work needs. A certificate on the wall answers only the first of these. This guide shows QC, QA and regulatory teams in India and elsewhere how to check the other three before sending a single sample.

What ISO/IEC 17025 accreditation actually covers

ISO/IEC 17025:2017 (third edition, published November 2017 and last confirmed by ISO in 2023) sets requirements for the competence, impartiality and consistent operation of testing and calibration laboratories. It is a standard for technical competence, which is what separates it from ISO 9001. ISO 9001 certification says an organisation runs a managed quality system. ISO/IEC 17025 accreditation says an independent assessor has checked that the laboratory can produce valid results for specific tests.

The clauses that matter most when you are buying pharmaceutical testing are listed below.

How to read an accreditation scope

Every accredited laboratory has a scope of accreditation, a schedule attached to its certificate. Ask for the full schedule, not just the certificate page, and check:

• Validity. The certificate number, issue date and expiry date, and whether the status is current on the accreditation body's own website.
• The accreditation body. It should be a signatory to the ILAC Mutual Recognition Arrangement, so that the accreditation is recognised outside the country. In India the national body for testing laboratories is NABL, which accredits to ISO/IEC 17025 and is an ILAC and APAC MRA signatory.
• Product and matrix. "Drug substances" does not automatically cover finished products, and "drug products" may not cover excipients or packaging materials.
• Test and technique. Assay and related substances by HPLC, residual solvents by GC, water content and so on, each listed with its method reference.
• Range and limits. Some scopes state a measurement range or limit of quantitation. A nitrosamine test at nanogram level is a different capability from a 0.1% impurity test.

A worked example

Suppose you need related substances by HPLC and a nitrosamine screen by LC-MS/MS on a tablet. A laboratory's scope lists "drug substances: assay and related substances by HPLC" and nothing for LC-MS. It can legitimately call itself ISO/IEC 17025 accredited, yet neither of your tests falls inside its scope. That does not make the laboratory unsuitable, but you now know you must qualify those methods through your own vendor assessment rather than lean on accreditation. Ask how the report will distinguish results inside and outside the accredited scope.

Data integrity and 21 CFR Part 11

If your results go into a dossier for the US, Europe or India, the contract laboratory's records become part of your evidence. US FDA's final guidance Data Integrity and Compliance With Drug CGMP (December 2018) expects data to be attributable, legible, contemporaneously recorded, original or a true copy, and accurate (ALCOA). Several of its points apply directly to contract laboratories:

• Unique logins. When credentials are shared, actions cannot be attributed to an individual. Each analyst and reviewer needs their own account on chromatography and spectroscopy software.
• Change-log review. Review frequency should follow the frequency required for the underlying data, or be set by risk assessment. Ask whether the electronic change logs are reviewed before results are reported.
• Dynamic records. A printout does not preserve a dynamic electronic record. The guidance uses FT-IR spectral files as an example: the electronic file, not the paper, is the original record.
• No testing into compliance. Running actual samples as "trial" or equilibration injections is a violative practice. System suitability should use a standard preparation.

21 CFR Part 11 itself covers electronic records and signatures (effective 20 August 1997). FDA's 2003 Scope and Application guidance narrowed enforcement of some provisions, but controls such as limiting system access to authorised individuals, operational, authority and device checks, training, accountability for electronic signatures and control of system documentation remain enforced. When a laboratory says its systems are "Part 11 compliant", ask what that means in practice: which software, how user roles are configured, whether electronic change logs (who changed what, and when) are switched on and locked, and how raw data are backed up and archived.

Methods: validation, verification and transfer

Clause 7.2 of ISO/IEC 17025 requires a laboratory to verify that it can properly perform standard methods before using them, and to validate non-standard and laboratory-developed methods. For pharmaceutical work this maps onto familiar practice:

• Pharmacopoeial methods (IP, BP, Ph. Eur., USP) need verification under actual conditions of use: specificity with your formulation, system suitability and, for impurities, sensitivity at the reporting level.
• In-house or client methods need validation against ICH Q2(R2), adopted by ICH on 1 November 2023, covering specificity, range, accuracy and precision as appropriate to the procedure.
• Methods transferred from your site need an agreed transfer protocol with pre-set acceptance criteria, typically comparing results on the same batches.

Ask to see an anonymised validation report. A competent laboratory will show a protocol written before the work, raw data references, and a clear conclusion against acceptance criteria. Our guide to HPLC method validation under ICH Q2(R2) lists the parameters and typical acceptance criteria you should expect to see.

Instrumentation and technical depth

Match the laboratory's instruments to your problem, not just to your specification. Routine release testing may need only HPLC and GC, but impurity investigations need identification tools as well.

Instrument qualification matters as much as instrument lists. USP general chapter <1058> describes a lifecycle approach to analytical instrument qualification; ask for the qualification and calibration status of the specific instruments that will run your samples. For identification work, check that the laboratory has in-house access to LC-MS and NMR, because outsourcing those steps adds handovers and delays.

Questions to ask, and red flags

Use this list during your vendor qualification call or questionnaire:

1. Can you share the full scope of accreditation, and which of our tests fall inside it?
2. Which accreditation body issued it, and is it an ILAC MRA signatory?
3. Which chromatography and spectroscopy data systems do you use, and how are user roles and electronic change logs configured?
4. How are electronic raw data backed up, archived and retrieved, and for how long are they retained?
5. How do you handle an out-of-specification result: who is informed, when, and what does the investigation report contain?
6. Will compendial methods be verified, or in-house methods validated, before our samples are tested? Can we approve the protocol?
7. Which reference standards will you use, and how is their traceability documented?
8. Do you take part in proficiency testing or interlaboratory comparisons for these tests?
9. Who reviews data independently before a report is signed?
10. Can we visit the laboratory and see the instruments and systems that will be used?

Red flags

• Reluctance to share the scope schedule, or a scope that does not match the claims made in sales material.
• Reports issued as unsigned PDFs with no reference to raw data, method or standard lot.
• Shared analyst logins, or electronic change logs that are "available but not enabled".
• Results that never fail, retests without documented investigation, or pressure to accept a "pass" without chromatograms.
• Quotations that skip method verification for a pharmacopoeial method being applied to a new formulation.

How SDS Labs can help

SDS Labs is an independent analytical testing and R&D laboratory in MIDC Mahape, Navi Mumbai, with a second office in Hyderabad, operating since 2010. It holds ISO/IEC 17025:2017 (certificate CM-99973/0726, valid to 08 Jul 2029) with a scope covering manufacturing and testing of impurities, raw materials, drug substances and drug products, alongside ISO 9001:2015, and generates results in line with 21 CFR Part 11 and cGMP requirements. Details are on our accreditations page.

Our analytical services cover method development, validation and routine testing on HPLC, GC, LC-MS, GC-MS, 400 MHz NMR, MS, FT-IR, XRD, TGA and DSC. To discuss your tests and whether they fall within scope, use our contact page, call +91 90295 20144 or email info@sdslabs.in.

Frequently asked questions

References

• ISO/IEC 17025:2017 General requirements for the competence of testing and calibration laboratories (ISO)
• Data Integrity and Compliance With Drug CGMP: Questions and Answers (US FDA, December 2018)
• Part 11, Electronic Records; Electronic Signatures: Scope and Application (US FDA, 2003)
• 21 CFR Part 11 Electronic Records; Electronic Signatures (eCFR)
• ICH Q2(R2) Validation of analytical procedures (EMA)
• NABL: Introduction (National Accreditation Board for Testing and Calibration Laboratories)