IATF16949 Practical Guide (12) | Internal Laboratory and External Laboratory: Scope Definition, Qualification Verification, and Audit Evidence
The customer's system auditor enters the testing room and, without looking at the equipment, requests two documents: one is your laboratory scope, and the other is the accreditation certificate and scope annex of the external laboratory to which you send samples for testing. The quality manager hands over the first document—a two-page list of 23 pieces of equipment with their names and numbers—but cannot produce the second, only saying, "That is a national-level laboratory, and we have been cooperating for over a decade."
The auditor then asks three questions: Where is the salt spray test listed in your scope document? The tensile test standard in this scope is the 2011 version, but the current effective version is 2021. Which version do you use for judgment? Does the scope of the external laboratory include the project you have entrusted to them? Unable to answer any of these questions, the auditor issues a nonconformity: the laboratory scope does not cover the actual testing projects, and the qualifications of the external laboratory have not been verified.
IATF 16949 is very specific in this area: 7.1.5.3.1 for internal laboratories and 7.1.5.3.2 for external laboratories. The common focus of these two requirements is not whether you have a laboratory, but whether you can clearly state who performed each judgment, according to which standard, and within what capability range. This article provides the essential fields for the scope document, the criteria for deciding whether to perform tests internally or externally, a checklist for verifying external laboratory qualifications, an evidence chain for audit evidence, and the writing format for corrective actions for five common nonconformities.
1. The Two Clauses Manage "Capability Boundaries," Not "Equipment Lists"
Breaking down the clauses, the requirements for internal laboratories can be summarized into six points, and failing any one of them means the requirement is not fully met:
| Requirement | Implementation Vehicle | What the Auditor Will Check |
|---|---|---|
| Clearly defined laboratory scope | Laboratory Scope document, included in the QMS documents | Whether each item in the scope clearly states "which tests/calibrations can be performed" |
| Scope includes the required inspection, testing, and calibration capabilities | Scope document + project list | Whether the actual reported projects can be found item by item in the scope |
| Adequate technical resources | Equipment inventory, site, environmental control records | Whether the equipment range and precision cover the project requirements |
| Personnel capability | Position qualifications, training, and authorization records | Whether the report signatories are on the authorized list |
| Correct and traceable methods to national/international standards | Standard list (with version year), method validation records | Whether the standards are current and effective, and whether the methods have been validated |
| Equipment calibration | Calibration plan, calibration certificate, traceability chain | Whether the certificate is within its validity period and whether the traceability institution is compliant |
The requirements for external laboratories are shorter but easier to overlook: external laboratories used for inspection, testing, or calibration must have a clearly defined laboratory scope that covers the entrusted projects and must meet one of the following criteria—there is evidence that the laboratory is accepted by the customer, or the laboratory is accredited to ISO/IEC 17025 (or an equivalent national standard).
Here is a crucial distinction: 7.1.5.3 manages the "capabilities of the testing and calibration service provider," while 7.1.5.2 manages the "calibration and traceability of measurement equipment." These two are often confused. When sending gauges for calibration, the focus is on the calibration institution's qualifications and traceability capabilities; when sending products for salt spray, metallographic, or vibration tests, the focus is on the laboratory's accreditation scope. Mixing these two can easily expose inconsistencies when the auditor asks follow-up questions.
2. First, Distinguish Between Three Types of Activities: Calibration, Testing, and Inspection
Incorrectly writing the scope document is often due to not categorizing the activities from the beginning. Although they all involve "measuring a number," the clauses and required qualifications are entirely different.
| Activity Type | Typical Example | Clause | Qualification and Evidence Requirements |
|---|---|---|---|
| Calibration / Verification | Calipers, micrometers, force sensors, thermocouples, torque wrenches | 7.1.5.2 (traceability) + 7.1.5.3.1 (internal calibration lab) | The internal calibration lab must be within the scope and have the capability to trace to national/international standards; external calibration institutions must be accredited to ISO/IEC 17025 or accepted by the customer |
| Physical and chemical property testing | Tensile, hardness, metallographic, chemical composition, coating thickness | 7.1.5.3 | Internal testing must be listed in the scope document; external testing must verify that the accreditation scope includes the project |
| Environmental and reliability testing | Salt spray, temperature cycling, humidity, vibration, drop | 7.1.5.3 | Same as above; ensure that the testing conditions (temperature, humidity, salt concentration) are within the laboratory's capability range |
| Non-destructive and destructive testing | Magnetic particle, ultrasonic, sectioning, weld joint destructive testing | 7.1.5.3 | Dual verification of personnel qualifications (such as non-destructive testing level certificates) and laboratory scope |
| Online inspection (first article, in-process, final) | Measuring outer diameter with calipers, checking hole positions with gauges | 8.6 release control | Not considered a laboratory activity, but the gauges used must be within their calibration validity period |
| Full-size and material property testing (for PPAP) | Full-size inspection report, material composition and mechanical property report | 7.1.5.3 + PPAP element requirements | The report must be traceable to the laboratory scope and equipment; external testing must be accompanied by qualification evidence |
The decision-making rule is simple: Tests conducted to prove whether a product meets requirements fall under 7.1.5.3; calibrations conducted to prove the accuracy of the gauges themselves fall under 7.1.5.2. Online inspections are not considered laboratory activities, but they are consumers of the calibration status of the gauges—incorrect calibration of gauges invalidates the conclusions of online inspections.
A practical point that is often overlooked: destructive testing (such as tensile testing of weld joints, metallographic sectioning) in many small and medium-sized enterprises is "outsourced processing + self-judgment," meaning the samples are sent out for processing, and the results are judged internally. This model still falls under external laboratory services in terms of the clauses, and both the sample processing party and the testing party must be traceable to their qualifications. It is not sufficient to leave only a handwritten data strip.
3. The "Scope" Document for Internal Laboratories: 12 Essential Elements
A qualified laboratory scope is essentially a "capability statement." Readers should be able to determine from it: whether you can perform a project, to what extent, who will do it, and based on what. It must include at least 12 elements:
| No. | Element | Filling Requirements | Typical Consequences of Missing |
|---|---|---|---|
| 1 | Laboratory name and location | Consistent with the organizational structure, list separately for multiple sites | Customer on-site audit cannot find the corresponding site |
| 2 | Responsible person and report signatory authorization | Named, including backup personnel | Report signatories are not on the authorized list |
| 3 | Covered product/parts range | Described by product family or part number segment | New products directly use old ranges, reports exceed boundaries |
| 4 | List of testing/calibration projects | Listed item by item, avoid vague terms like "physical and chemical testing" | Scope cannot be matched item by item with reports |
| 5 | Standards and methods cited for each project | Standard number + version year (e.g., GB/T 228.1-2021) | Using obsolete standards for judgment, or no validation records |
| 6 | Measurement range/precision | For example, 10～500 kN, precision ±0.5% | Accepting projects beyond the measurement range, data invalid |
| 7 | Measurement uncertainty (if applicable) | Relationship with the judgment limit | No basis for critical value judgment |
| 8 | Major equipment and serial numbers | Consistent with equipment inventory and calibration certificates | Scope not updated after equipment replacement |
| 9 | Authorized operators | Name + project + authorization date | Unauthorized operation, personnel capability unverifiable |
| 10 | Environmental condition requirements | Temperature and humidity, cleanliness, vibration limits | Environmental control failure, results not reproducible |
| 11 | Version, effective date, and change record | Record each change, recover old versions | Two versions coexist on-site, inconsistent judgment criteria |
| 12 | Statement of subcontracted/external projects | Clearly state which projects are not done internally and where they are sent | Customer mistakenly believes all projects are self-inspected |
The scope document can be written in a single table, with each item corresponding to the others, avoiding adjectives:
| Project | Standard and Method (Version) | Measurement Range/Conditions | Major Equipment Serial Number | Authorized Personnel |
|---|---|---|---|---|
| Room temperature tensile test | GB/T 228.1-2021 | 10～300 kN, Rm 200～1200 MPa | WD-01 | Zhang, Li |
| Neutral salt spray test | GB/T 10125-2021 | 35℃, 5% NaCl, 24～480 h | YW-02 | Wang |
| Rockwell hardness | GB/T 230.1-2018 | HRC 20～70 | YD-03 | Zhang |
| Coating thickness (metallographic method) | GB/T 6462-2005 | 2～50 μm | JP-01 | Li |
| (External) vibration test | — | See external laboratory list EX-04 | — | — |
Three criteria for validating this document:
- Each item in the scope must be demonstrable on-site. The auditor randomly selects a row and requests to see the equipment, personnel, standard text, and a historical report within 30 minutes. If it cannot be demonstrated, the row is considered fictitious.
- Standards must include the version year, and obsolete standards must be automatically removed. It is recommended to verify the effectiveness of standards annually, listing transition items for projects where new versions have been released but not yet implemented, along with planned transition dates.
- Internal reports must not be issued for projects outside the scope. There are only two options: send the project to a qualified external laboratory or obtain written customer approval (some customers allow the organization to test and validate under specific conditions).
Ten self-check questions for the scope document, to be reviewed before internal audits:
- Does the product range cover all mass-produced items over the past three years?
- Can the project list in the scope document be matched item by item with all reports from the past 12 months?
- Are there any projects in the reports that cannot be found in the scope?
- Are all standards current and effective versions?
- Does the measurement range cover the maximum and minimum specifications?
- Are all key equipment within their calibration validity period?
- Is the authorized signatory list consistent with the actual signatories?
- Are environmental monitoring records continuous (especially for temperature and humidity sensitive projects)?
- Is the qualification archive for external projects complete?
- Are the version and change records complete?
4. Decision Sequence for Internal or External Testing: Four Thresholds
Defining the scope is not just a technical issue but also a trade-off between cost and response speed. It is recommended to follow a fixed sequence of four thresholds, which cannot be reversed:
| Sequence | Threshold | Judgment Question | Action for Non-Compliance |
|---|---|---|---|
| First | Qualification | Does the project require specific qualifications (ISO/IEC 17025 accreditation, non-destructive testing personnel levels, customer-specified laboratories)? | If internal qualifications are lacking, send externally; do not self-substitute "equivalent" qualifications |
| Second | Capability | Do the equipment range, precision, and environmental conditions cover the product requirements? Is the ratio of measurement uncertainty to tolerance acceptable? | If capability is insufficient, send externally or invest in equipment; do not use "increased sampling" to cover up |
| Third | Timeliness | Does the testing cycle match the production rhythm and problem response time? | Prioritize key characteristics and daily inspections for internal processing |
| Fourth | Cost | Single-piece testing cost × annual frequency vs. equipment depreciation + personnel + calibration maintenance | If external costs are consistently higher and frequency is stable, consider internalization |
A quantifiable criterion in the second threshold: the ratio of measurement uncertainty to specification tolerance, the industry standard is to control it within 1/5, and it should not exceed 1/3. If the ratio is too large, even if the equipment "can measure," the judgment conclusion is unreliable—critical items will be repeatedly misjudged, ultimately leading to "different inspection conclusions for the same product." In such cases, the correct action is to change the method or the equipment, not to have the inspector "measure multiple times and take the average."
A hard rule in the first threshold that must be written into the process: If the customer specifies a laboratory, it cannot be replaced. Some original equipment manufacturers (OEMs) provide a list of accredited laboratories or specify institutions in the Customer Specific Requirements (CSR). In such cases, "better qualifications" or "lower prices" are not valid reasons for replacement; written customer approval must be obtained, and the approval record must be archived with the project, not just left in someone's email.
5. Qualification Verification for External Laboratories: Three Checks and One Archive
Managing external laboratories often involves "building a list of qualified suppliers and renewing it annually," which is not sufficient in terms of the clauses. Verification must be thorough:
First, check the certificate's validity. Review the accreditation certificate number, accrediting body, accreditation criteria (ISO/IEC 17025 or equivalent national standard), validity period, and accreditation status (valid, suspended, revoked). If the certificate is expired or the status is abnormal, subsequent reports are not considered evidence. The accrediting body can be a national accrediting body or an international body accepted by the customer, but not a "capability certificate issued by an association."
Second, check the scope annex and project details. This is the most easily overlooked step. The certificate body only states that "the laboratory is accredited to ISO/IEC 17025," and the specific capabilities are listed in the scope annex. Verification must be done item by item: project name, standard number, standard version, measurement range/precision, matrix or product category. Common mismatches include: the standard version has been updated, but the laboratory annex still lists the old version; the project names are similar but the methods are different (e.g., "salt spray" vs. "cyclic corrosion"); the measurement range does not include the required specifications (e.g., the laboratory only tests up to 200 kN, but the required range is 350 kN).
Third, check customer specifications and CSR requirements. If there is a specified list, follow it; if not, confirm whether the customer accepts ISO/IEC 17025 accredited laboratories and record the CSR clause number in the project archive.
One archive to keep: a readily accessible record. Each external laboratory's archive should include at least six items: a scanned copy of the accreditation certificate, the scope annex (covering the entrusted projects), the most recent verification date and verifier, a list of entrusted projects and reports, records of qualification changes or suspensions, and a statement of subcontracting (if the external laboratory subcontracts projects, prior written notification and approval are required).
A verification checklist for external laboratories, with ten items to check. Any "non-pass" item will result in the suspension of the laboratory:
| No. | Verification Item | Judgment |
|---|---|---|
| 1 | Accreditation certificate is valid, accreditation criteria are ISO/IEC 17025 or equivalent | Pass / Fail |
| 2 | Accreditation status is normal (not suspended, revoked, or reduced scope) | Pass / Fail |
| 3 | Scope annex includes the current entrusted project | Pass / Fail |
| 4 | Standards listed in the annex match the basis for judgment | Pass / Fail |
| 5 | Measurement range/precision covers the required specifications | Pass / Fail |
| 6 | Customer-specified or customer-accepted (with written basis) | Pass / Fail |
| 7 | Report format includes the basis for judgment, method, and uncertainty (if applicable) | Pass / Fail |
| 8 | Subcontracting is explained in writing and approved | Pass / Fail |
| 9 | Notification mechanism for qualification changes is agreed upon | Pass / Fail |
| 10 | Reports are traceable to batches/part numbers | Pass / Fail |
6. Audit On-Site: How to Link Five Evidence Chains
Nonconformities in the laboratory section are rarely due to the absence of documents but more often because the documents, equipment, personnel, and reports do not align. The auditor is essentially linking evidence chains, and preparing these chains in advance will prevent on-site passivity.
| Evidence Chain | Starting Point | Path | Endpoint | Symptoms of a Broken Chain |
|---|---|---|---|---|
| Scope chain | A specific row in the scope document | The standard and range for the project | Corresponding reports from the past 12 months | Report projects not found in the scope |
| Equipment chain | Equipment inventory serial number | Calibration certificate and traceability institution qualifications | Reports issued by the equipment | Report dates fall outside the calibration validity period |
| Personnel chain | Authorized personnel list | Training and capability confirmation records | Report signature page | Signatories not on the authorized list |
| Method chain | Standard list (with version year) | Method validation/confirmation records | Methods cited in the report | Citing obsolete versions or no validation records |
| External chain | External laboratory archive | Certificate + scope annex | External reports | Report projects exceed the accreditation scope |
Eight things to check before an audit, which can be completed in 30 minutes:
- Randomly select three recent reports and verify whether the scope, equipment, personnel, and methods are consistent.
- Check the calibration validity period of three key pieces of equipment.
- Verify the current effectiveness of the standard list.
- Check whether the qualification archives for external projects are complete.
- Check whether environmental monitoring records are continuous (especially for temperature and humidity sensitive projects).
- Check whether changes in authorized signatories have been updated in the scope document.
- Check whether there are any internal reports for projects outside the scope.
- Check whether the nonconformities identified in the last internal or external audit related to the laboratory have been closed.
7. Five Common Nonconformities: Fact Description and Corrective Action Writing
The more specific the nonconformity is written, the less likely the corrective action will go off track. The following five categories are the most frequent in automotive industry audits, and the fact description should use the "time + object + evidence + clause" format to avoid vague statements like "laboratory management is not standardized."
| Nonconformity Fact (Example) | Root Cause Direction | Corrective Action | Verification Evidence |
|---|---|---|---|
| Review 14 salt spray test reports from March to August 2026. The laboratory scope document only lists "physical and chemical testing" without specifying the salt spray project and standard version. The scope does not cover the actual projects conducted. | The scope document was compiled based on the equipment list, not the projects | Re-compile the scope document, adding the project, standard version, range, equipment, and authorized personnel; establish a monthly reconciliation of "reports to scope" | New version of the scope document + reconciliation records + results of two consecutive months of reconciliation |
| Review the tensile testing machine WD-01. The most recent calibration date is November 2025, with a 12-month calibration cycle. Six reports from January 2026 onwards fall outside the calibration validity period. | No expiration warning in the calibration plan, separate equipment and calibration records | Establish a 30-day warning before calibration expiration; verify the calibration status of the equipment before issuing reports | Warning list + pre-report calibration verification records |
| The "Metal Materials Tensile Testing Part 1" standard cited is the 2011 version, while the current effective version is 2021. The method validation records still use the old version. | Annual standard effectiveness verification not included in the plan | Establish an annual standard effectiveness verification; perform method comparison validation for version changes | Standard list (including current versions) + method comparison report |
| The external laboratory for vibration testing does not have the required product category in its scope annex, and the qualification was not verified before the project was entrusted. | External laboratories are only reviewed annually as qualified suppliers, not at the project level | Re-verify each project and replace non-compliant laboratories; establish a project-level verification form | Verification form + new laboratory qualification archive |
| Three internal laboratory operators have no authorization records, and the report signatories do not match the job descriptions. | Personnel authorization not updated with job changes | Re-verify capabilities and issue written authorization; limit report signing to authorized personnel | Authorization letter + capability confirmation records (including blind sample comparison results) |
The common point in corrective actions: Each must establish a mechanism to ensure it will not happen again, not just to complete the current document. Completing the document can close the current nonconformity but will not prevent it from recurring.
8. Key Implementation Points and Common Errors
Several points that are most effective in implementation:
- Write the scope document by project, not by equipment. Equipment supports capability but does not define it. Customers and auditors are concerned with whether you can perform a project, not how many machines you have.
- Reconcile the scope and reports monthly. Compare the project names in the current month's reports with the scope document item by item. Projects that are not in the scope should either be added or the reasons for exceeding the scope should be investigated. This step can prevent most laboratory nonconformities.
- Use the same judgment criteria for internal and external laboratories. The standard version, measurement range, and judgment criteria must be consistent for internal and external testing; otherwise, the same batch of products will have two sets of conclusions.
- Separately manage calibration and testing, but unify the traceability chain. Calibration manages equipment, testing manages products, and both chains ultimately point to "data traceable to national or international standards."
- Customer-specified laboratories are a red line. Replacement requires written customer approval, and the approval record must be archived with the project, not just left in someone's email.
Common errors are often concentrated in five areas:
- Writing the laboratory scope as an equipment list.
- Standards in the scope do not include the version year, leading to all standards becoming obsolete upon version change.
- Only checking if the external laboratory is "accredited" without verifying the scope annex.
- Treating online inspections as laboratory activities, causing the scope document to expand indefinitely.
- Subcontracting without notification, leading to reports from "laboratories of laboratories" and a broken traceability chain at the last step.
The laboratory requirements, while appearing to be the most technical and dry section in the QMS documents, actually determine the credibility of all inspection data. A clear scope document tells everyone "where our judgment capabilities end"; thorough qualification verification adds a seal of approval to every external report. Robust laboratory management is not about having the newest equipment or the thickest certificates, but about being able to trace any report from two years ago back to the standards, equipment, personnel, and qualifications.
Clearly define capability boundaries, and thorough qualification verification supports data credibility
Knowledge code: 15.1.1
Version: v20261009
Author: QTank QTank is dedicated to providing systematic professional knowledge, methodologies, and practical tools for quality management practitioners, helping companies continuously improve their quality capabilities.