If you have been asked for "ISO 17025 certification", the person asking almost certainly means NATA accreditation. It is worth getting this right before you spend money, because the two things are procured differently, assessed differently, and issued by different kinds of body.
Nathan ISO Consulting works with Australian testing and calibration laboratories preparing for initial NATA accreditation, extending an existing scope, or recovering from a difficult assessment. We build the quality system, do the technical work behind measurement uncertainty and method validation, and sit with your team through assessment.
Your scope of accreditation is the product
This is the part laboratories underestimate. NATA does not accredit you in general. It accredits you for specified tests or calibrations, using specified methods, within specified ranges, at specified sites. That scope is published, and your customers can read it.
Everything downstream follows from it. Get the scope too narrow and you will be back applying for an extension within a year. Get it too wide and you are validating methods you do not sell and maintaining equipment you do not need. Write it imprecisely and you end up with a scope that technically excludes the work your largest client sends you.
We spend real time on scope definition before anything else starts. It is the cheapest hour in the whole project and the one most consultants skip.
The five technical areas NATA will test hardest
1. Measurement uncertainty
Every accredited laboratory must be able to evaluate and, where relevant, report measurement uncertainty for the work in its scope. Assessors do not accept an uncertainty budget that appeared from a spreadsheet nobody can explain. They want the contributing components identified, the method documented, and someone in the laboratory able to walk through it.
2. Metrological traceability
Results must be traceable to the International System of Units, ordinarily through calibrations delivered by an accredited calibration laboratory or by a national metrology institute. In Australia that chain commonly runs through the National Measurement Institute. Gaps in the traceability chain are among the most common findings raised.
3. Method validation and verification
Standard methods used within their stated scope need verification that your laboratory can perform them competently. Non-standard, laboratory-developed or modified methods need full validation. The distinction matters because the evidence burden is very different, and laboratories frequently misclassify their own methods in the direction that requires less work.
4. Proficiency testing and interlaboratory comparison
NATA expects participation in proficiency testing appropriate to your scope, with results evaluated and acted on. A PT result outside acceptance limits is not itself a problem. Having no documented investigation of it is.
5. Reporting, including decision rules
Where you make statements of conformity, the 2017 edition requires you to document the decision rule applied and to communicate it. Reports must be unambiguous about what is covered by accreditation and what is not, which is exactly where NATA's application criteria have been tightening in recent years.
Where Australian law and regulation require accredited testing
NATA accreditation is voluntary in the abstract. In practice a great deal of Australian testing is only useful if it is accredited, because the recipient will not accept it otherwise.
NATA also issues discipline-specific application documents that sit alongside ISO/IEC 17025 and are updated periodically. We track the ones applying to your fields, because a criteria change you did not notice becomes a finding at your next assessment.
The road to accreditation
NATA assessment is a longer road than management system certification, and the timeline below reflects that honestly.
How Nathan ISO Consulting assists
Laboratory work needs two different kinds of help at once, and most consultancies only offer one. A quality system consultant who cannot discuss an uncertainty budget is of limited use to a calibration laboratory. A metrologist who has never written a management review agenda is of limited use at assessment.
What we do differently
We write the scope before we write anything else
A surprising number of laboratory projects begin with documentation and arrive at scope late. That sequence produces systems that cover the wrong work. We start where the money is.
We build uncertainty budgets with your staff, not for them
An uncertainty budget your technical officer cannot explain will fail at assessment regardless of how well it is calculated. We build them in the laboratory, with the people who will have to defend them.
We classify your methods honestly
Calling a modified method a standard method reduces work now and creates a major finding later. We will tell you when validation is required even when you would rather it was not.
We track NATA criteria changes for your fields
The application documents that sit alongside the standard are updated periodically, and reporting requirements in particular have been tightening. A criteria change you did not notice becomes a finding at your next surveillance.
We know where our expertise ends
If your project needs specialist metrology, a particular analytical technique, or forensic discipline experience beyond our team, we will say so and help you find it rather than improvising.
Laboratories we support, and where
Australian laboratories cluster by industry rather than by population, so our coverage follows the work.
Questions laboratory managers ask us
Is it ISO 17025 certification or NATA accreditation?
Accreditation. In Australia laboratories are accredited against ISO/IEC 17025:2017 by NATA, not certified by a management system certification body. The word certification is widely used informally, but a certificate from a certification body will not let you issue NATA-endorsed reports.
Can a JAS-ANZ accredited certification body accredit our laboratory?
No. JAS-ANZ accredits certification bodies for management system standards. Laboratory accreditation in Australia is NATA's function. If a provider offers you an ISO 17025 certificate quickly and cheaply, that is a strong signal to stop and check.
How long does NATA accreditation take?
Six to twelve months is realistic for initial accreditation, depending on scope breadth and how much technical work is already in place. The technical elements, particularly uncertainty budgets and method validation, are the long pole rather than the documentation.
Do we need to hold ISO 9001 as well?
No. ISO/IEC 17025 contains its own management system requirements, and clause 8 offers two options for meeting them. Laboratories inside larger certified organisations often align the two, but ISO 9001 is not a prerequisite for accreditation.
What happens if we get a proficiency testing result outside acceptance limits?
On its own, not much. Assessors expect occasional outliers. What they look for is a documented investigation, a determination of cause, and evidence of action taken. An unexplained outlier with no investigation record is the finding, not the outlier itself.
Can we add tests to our scope later?
Yes. Scope extensions are a normal part of laboratory life and can usually be handled without disturbing existing accreditation. Planning likely extensions during initial scope definition makes them considerably cheaper when the time comes.
Which states and regions do you cover?
All of them. Our laboratory work spans Perth and the Western Australian goldfields and Pilbara, Sydney, Melbourne, Brisbane, Adelaide, Canberra, Hobart, Darwin, and industrial regional centres including Gladstone, Townsville, Newcastle and Mount Isa.
Our last assessment went badly. Can you help us recover?
Yes, and it is a meaningful part of our work. Recovery projects start with an honest read of the assessment report to separate genuine technical deficiencies from documentation problems, because the two need very different responses and timelines.
Talk to us about your scope
Send us your current or intended scope of accreditation and a list of your methods. That tells us more in ten minutes than a discovery call does in an hour.
| The distinction in one paragraph Management system standards like ISO 9001 are certified by certification bodies accredited by JAS-ANZ. ISO/IEC 17025 works differently. Laboratories are accredited, not certified, and in Australia that accreditation comes from NATA, the National Association of Testing Authorities. A laboratory holding a certificate from a management system certification body does not hold NATA accreditation, and its reports cannot be NATA endorsed. |
|---|
| Item | Detail |
|---|---|
| Standard | ISO/IEC 17025:2017 (AS ISO/IEC 17025) |
| Accreditation body in Australia | NATA |
| What you receive | Accreditation with a defined scope, not a certificate |
| International recognition | ILAC Mutual Recognition Arrangement, via APAC |
| Typical preparation time | 6–12 months to assessment, depending on scope |
| Ongoing | Surveillance and reassessment on a defined cycle |
| Context | Why accredited testing is required in practice |
|---|---|
| National Construction Code and state building laws | Evidence of suitability for building products and materials commonly requires test reports from accredited laboratories |
| Environmental licences and EPA reporting | State environmental regulators generally require NATA-endorsed reports for compliance monitoring and discharge testing |
| Food safety and the FSANZ Food Standards Code | Verification testing supporting food safety programs is expected to come from accredited laboratories |
| National Measurement Act 1960 | Legal metrology and trade measurement obligations rely on traceable, accredited calibration |
| Workplace exposure monitoring under WHS laws | Occupational hygiene sampling and analysis supporting exposure standards is expected to be accredited |
| Forensic and legal proceedings | Courts and prosecuting authorities expect accredited testing, with specific NATA criteria applying to forensic disciplines |
| Water quality and drinking water guidelines | Utilities and health regulators require accredited analysis for compliance monitoring |
| Milestone | What it involves | Typical duration |
|---|---|---|
| Scope definition | Deciding exactly which tests, methods, ranges and sites you will seek accreditation for | 2–4 weeks |
| Gap assessment | Your current practice measured against ISO/IEC 17025:2017 and the NATA criteria applying to your fields | 3–4 weeks |
| Quality system build | Management system documentation, impartiality and confidentiality arrangements, risk-based thinking, records structure | 6–10 weeks |
| Technical work | Uncertainty budgets, method validation and verification, traceability chain, equipment records, PT enrolment | 8–16 weeks |
| Competence framework | Authorisation of personnel, training records, ongoing monitoring of performance | 3–5 weeks |
| Internal audit and review | Full internal audit against the standard and the criteria, findings closed, management review completed | 3–4 weeks |
| NATA application | Application lodged, documentation submitted, assessment scheduled | Scheduling dependent |
| Assessment and follow-up | On-site assessment by lead and technical assessors, followed by corrective action and closure | 6–12 weeks |
| Service | What we deliver |
|---|---|
| Scope development | The wording of your scope of accreditation, tested against the work you actually sell and the work you intend to sell next |
| Gap assessment | Assessment against ISO/IEC 17025:2017 and the NATA application criteria specific to your fields of testing |
| Quality management system | Documentation, impartiality and confidentiality arrangements, risk and opportunity framework, document and records control |
| Measurement uncertainty | Uncertainty budgets built with your technical staff so someone in the laboratory can defend them at assessment |
| Method validation and verification | Validation plans, protocols and reports, with the standard-versus-non-standard classification done correctly |
| Traceability review | The calibration chain mapped end to end, gaps identified, and calibration suppliers assessed |
| Proficiency testing strategy | PT program matched to your scope, with the evaluation and investigation process that assessors look for |
| Personnel competence | Authorisation framework, training records, and ongoing monitoring arrangements |
| Reporting and decision rules | Report templates, conformity statements, decision rule documentation and endorsement rules |
| Internal audit | Full technical and system audit conducted the way a NATA assessor would conduct it |
| Assessment support | We attend the assessment, and we manage corrective actions through to closure |
| Scope extensions | Adding new tests, methods or sites to an existing accreditation without disturbing what already works |
| Laboratory type | Where we typically work |
|---|---|
| Mining and mineral assay | Perth, Kalgoorlie, Port Hedland, Karratha, Townsville, Mount Isa, Kalgoorlie–Boulder goldfields |
| Environmental and water testing | Sydney, Melbourne, Brisbane, Newcastle, Adelaide, Gladstone, Darwin |
| Construction materials testing | All capital cities plus infrastructure corridors including Western Sydney, South East Queensland and Melbourne's growth areas |
| Calibration laboratories | Sydney, Melbourne, Brisbane, Perth, Adelaide, Geelong, Wollongong |
| Food and agricultural testing | Melbourne, Brisbane, Adelaide, Toowoomba, Shepparton, Griffith, Tamworth |
| Oil, fuel and lubricant analysis | Perth, Karratha, Gladstone, Brisbane, Darwin |
| Occupational hygiene and workplace monitoring | All capital cities and major industrial regions |
| Forensic and legal testing | Capital cities, under NATA's discipline-specific criteria |
| University and research laboratories | Sydney, Melbourne, Brisbane, Canberra, Adelaide, Perth, Hobart |
FAQ'S
Annex A of the 2022 edition contains 93 controls grouped into four themes: organisational, people, physical and technological. This replaced the 2013 structure of 114 controls across 14 domains. Content still citing 114 controls is out of date.
For Australian and international procurement, ISO 27001 is generally more recognised, and it is a certifiable standard rather than an attestation report. SOC 2 carries more weight with US enterprise buyers. Companies selling into both markets frequently hold both.
Partially. The Essential Eight is a set of specific technical mitigations, while ISO 27001 is a broader management system. Many Essential Eight controls map to Annex A, but neither substitutes for the other. Commonwealth-facing suppliers are often asked for both.
It supports compliance with Australian Privacy Principle 11 by demonstrating reasonable security steps, but it is not a privacy standard. For privacy management specifically, ISO/IEC 27701:2025 is the applicable standard and can now be certified independently.
Yes, and it is a common and legitimate approach for SaaS companies. The scope statement on your certificate must accurately describe what is covered, and prospective customers will read it, so scope it to what you can genuinely evidence.
They serve different purposes. IRAP assesses a specific system against the Information Security Manual for handling Australian Government data. ISO 27001 certifies your organisational management system. Government suppliers commonly need IRAP; commercial buyers commonly ask for ISO 27001.
All capital cities and major regional centres, including Sydney, Melbourne, Brisbane, Perth, Adelaide, Canberra, Hobart and Darwin. Most of an ISO 27001 project runs remotely, with on-site attendance where physical security controls or data centres need assessment in person.
Typically 16 to 28 weeks. Control implementation is the longest phase because it involves real technical change rather than documentation. Organisations with mature security practices already in place can move considerably faster.
Talk to our ISO 27001 team
If a customer questionnaire or tender triggered this, send it to us. Reading the actual requirement is faster than guessing at scope, and occasionally it turns out you need something narrower than full certification.





















0
Projects
0
Services
0
Clients Serving
0
Countries Serving