WhatsApp contact icon for Nathan ISO Consulting
WhatsApp contact icon for Nathan ISO Consulting

If you have been asked for "ISO 17025 certification", the person asking almost certainly means NATA accreditation. It is worth getting this right before you spend money, because the two things are procured differently, assessed differently, and issued by different kinds of body.

Nathan ISO Consulting works with Australian testing and calibration laboratories preparing for initial NATA accreditation, extending an existing scope, or recovering from a difficult assessment. We build the quality system, do the technical work behind measurement uncertainty and method validation, and sit with your team through assessment.

Your scope of accreditation is the product

This is the part laboratories underestimate. NATA does not accredit you in general. It accredits you for specified tests or calibrations, using specified methods, within specified ranges, at specified sites. That scope is published, and your customers can read it.

Everything downstream follows from it. Get the scope too narrow and you will be back applying for an extension within a year. Get it too wide and you are validating methods you do not sell and maintaining equipment you do not need. Write it imprecisely and you end up with a scope that technically excludes the work your largest client sends you.

We spend real time on scope definition before anything else starts. It is the cheapest hour in the whole project and the one most consultants skip.

The five technical areas NATA will test hardest

1. Measurement uncertainty

Every accredited laboratory must be able to evaluate and, where relevant, report measurement uncertainty for the work in its scope. Assessors do not accept an uncertainty budget that appeared from a spreadsheet nobody can explain. They want the contributing components identified, the method documented, and someone in the laboratory able to walk through it.

2. Metrological traceability

Results must be traceable to the International System of Units, ordinarily through calibrations delivered by an accredited calibration laboratory or by a national metrology institute. In Australia that chain commonly runs through the National Measurement Institute. Gaps in the traceability chain are among the most common findings raised.

3. Method validation and verification

Standard methods used within their stated scope need verification that your laboratory can perform them competently. Non-standard, laboratory-developed or modified methods need full validation. The distinction matters because the evidence burden is very different, and laboratories frequently misclassify their own methods in the direction that requires less work.

4. Proficiency testing and interlaboratory comparison

NATA expects participation in proficiency testing appropriate to your scope, with results evaluated and acted on. A PT result outside acceptance limits is not itself a problem. Having no documented investigation of it is.

5. Reporting, including decision rules

Where you make statements of conformity, the 2017 edition requires you to document the decision rule applied and to communicate it. Reports must be unambiguous about what is covered by accreditation and what is not, which is exactly where NATA's application criteria have been tightening in recent years.

Where Australian law and regulation require accredited testing

NATA accreditation is voluntary in the abstract. In practice a great deal of Australian testing is only useful if it is accredited, because the recipient will not accept it otherwise.

NATA also issues discipline-specific application documents that sit alongside ISO/IEC 17025 and are updated periodically. We track the ones applying to your fields, because a criteria change you did not notice becomes a finding at your next assessment.

The road to accreditation

NATA assessment is a longer road than management system certification, and the timeline below reflects that honestly.

How Nathan ISO Consulting assists

Laboratory work needs two different kinds of help at once, and most consultancies only offer one. A quality system consultant who cannot discuss an uncertainty budget is of limited use to a calibration laboratory. A metrologist who has never written a management review agenda is of limited use at assessment.

What we do differently

We write the scope before we write anything else

A surprising number of laboratory projects begin with documentation and arrive at scope late. That sequence produces systems that cover the wrong work. We start where the money is.

We build uncertainty budgets with your staff, not for them

An uncertainty budget your technical officer cannot explain will fail at assessment regardless of how well it is calculated. We build them in the laboratory, with the people who will have to defend them.

We classify your methods honestly

Calling a modified method a standard method reduces work now and creates a major finding later. We will tell you when validation is required even when you would rather it was not.

We track NATA criteria changes for your fields

The application documents that sit alongside the standard are updated periodically, and reporting requirements in particular have been tightening. A criteria change you did not notice becomes a finding at your next surveillance.

We know where our expertise ends

If your project needs specialist metrology, a particular analytical technique, or forensic discipline experience beyond our team, we will say so and help you find it rather than improvising.

Laboratories we support, and where

Australian laboratories cluster by industry rather than by population, so our coverage follows the work.

Questions laboratory managers ask us

Is it ISO 17025 certification or NATA accreditation?

Accreditation. In Australia laboratories are accredited against ISO/IEC 17025:2017 by NATA, not certified by a management system certification body. The word certification is widely used informally, but a certificate from a certification body will not let you issue NATA-endorsed reports.

Can a JAS-ANZ accredited certification body accredit our laboratory?

No. JAS-ANZ accredits certification bodies for management system standards. Laboratory accreditation in Australia is NATA's function. If a provider offers you an ISO 17025 certificate quickly and cheaply, that is a strong signal to stop and check.

How long does NATA accreditation take?

Six to twelve months is realistic for initial accreditation, depending on scope breadth and how much technical work is already in place. The technical elements, particularly uncertainty budgets and method validation, are the long pole rather than the documentation.

Do we need to hold ISO 9001 as well?

No. ISO/IEC 17025 contains its own management system requirements, and clause 8 offers two options for meeting them. Laboratories inside larger certified organisations often align the two, but ISO 9001 is not a prerequisite for accreditation.

What happens if we get a proficiency testing result outside acceptance limits?

On its own, not much. Assessors expect occasional outliers. What they look for is a documented investigation, a determination of cause, and evidence of action taken. An unexplained outlier with no investigation record is the finding, not the outlier itself.

Can we add tests to our scope later?

Yes. Scope extensions are a normal part of laboratory life and can usually be handled without disturbing existing accreditation. Planning likely extensions during initial scope definition makes them considerably cheaper when the time comes.

Which states and regions do you cover?

All of them. Our laboratory work spans Perth and the Western Australian goldfields and Pilbara, Sydney, Melbourne, Brisbane, Adelaide, Canberra, Hobart, Darwin, and industrial regional centres including Gladstone, Townsville, Newcastle and Mount Isa.

Our last assessment went badly. Can you help us recover?

Yes, and it is a meaningful part of our work. Recovery projects start with an honest read of the assessment report to separate genuine technical deficiencies from documentation problems, because the two need very different responses and timelines.

Talk to us about your scope

Send us your current or intended scope of accreditation and a list of your methods. That tells us more in ten minutes than a discovery call does in an hour.

The distinction in one paragraph Management system standards like ISO 9001 are certified by certification bodies accredited by JAS-ANZ. ISO/IEC 17025 works differently. Laboratories are accredited, not certified, and in Australia that accreditation comes from NATA, the National Association of Testing Authorities. A laboratory holding a certificate from a management system certification body does not hold NATA accreditation, and its reports cannot be NATA endorsed.
ItemDetail
StandardISO/IEC 17025:2017 (AS ISO/IEC 17025)
Accreditation body in AustraliaNATA
What you receiveAccreditation with a defined scope, not a certificate
International recognitionILAC Mutual Recognition Arrangement, via APAC
Typical preparation time6–12 months to assessment, depending on scope
OngoingSurveillance and reassessment on a defined cycle
ContextWhy accredited testing is required in practice
National Construction Code and state building lawsEvidence of suitability for building products and materials commonly requires test reports from accredited laboratories
Environmental licences and EPA reportingState environmental regulators generally require NATA-endorsed reports for compliance monitoring and discharge testing
Food safety and the FSANZ Food Standards CodeVerification testing supporting food safety programs is expected to come from accredited laboratories
National Measurement Act 1960Legal metrology and trade measurement obligations rely on traceable, accredited calibration
Workplace exposure monitoring under WHS lawsOccupational hygiene sampling and analysis supporting exposure standards is expected to be accredited
Forensic and legal proceedingsCourts and prosecuting authorities expect accredited testing, with specific NATA criteria applying to forensic disciplines
Water quality and drinking water guidelinesUtilities and health regulators require accredited analysis for compliance monitoring
MilestoneWhat it involvesTypical duration
Scope definitionDeciding exactly which tests, methods, ranges and sites you will seek accreditation for2–4 weeks
Gap assessmentYour current practice measured against ISO/IEC 17025:2017 and the NATA criteria applying to your fields3–4 weeks
Quality system buildManagement system documentation, impartiality and confidentiality arrangements, risk-based thinking, records structure6–10 weeks
Technical workUncertainty budgets, method validation and verification, traceability chain, equipment records, PT enrolment8–16 weeks
Competence frameworkAuthorisation of personnel, training records, ongoing monitoring of performance3–5 weeks
Internal audit and reviewFull internal audit against the standard and the criteria, findings closed, management review completed3–4 weeks
NATA applicationApplication lodged, documentation submitted, assessment scheduledScheduling dependent
Assessment and follow-upOn-site assessment by lead and technical assessors, followed by corrective action and closure6–12 weeks
ServiceWhat we deliver
Scope developmentThe wording of your scope of accreditation, tested against the work you actually sell and the work you intend to sell next
Gap assessmentAssessment against ISO/IEC 17025:2017 and the NATA application criteria specific to your fields of testing
Quality management systemDocumentation, impartiality and confidentiality arrangements, risk and opportunity framework, document and records control
Measurement uncertaintyUncertainty budgets built with your technical staff so someone in the laboratory can defend them at assessment
Method validation and verificationValidation plans, protocols and reports, with the standard-versus-non-standard classification done correctly
Traceability reviewThe calibration chain mapped end to end, gaps identified, and calibration suppliers assessed
Proficiency testing strategyPT program matched to your scope, with the evaluation and investigation process that assessors look for
Personnel competenceAuthorisation framework, training records, and ongoing monitoring arrangements
Reporting and decision rulesReport templates, conformity statements, decision rule documentation and endorsement rules
Internal auditFull technical and system audit conducted the way a NATA assessor would conduct it
Assessment supportWe attend the assessment, and we manage corrective actions through to closure
Scope extensionsAdding new tests, methods or sites to an existing accreditation without disturbing what already works
Laboratory typeWhere we typically work
Mining and mineral assayPerth, Kalgoorlie, Port Hedland, Karratha, Townsville, Mount Isa, Kalgoorlie–Boulder goldfields
Environmental and water testingSydney, Melbourne, Brisbane, Newcastle, Adelaide, Gladstone, Darwin
Construction materials testingAll capital cities plus infrastructure corridors including Western Sydney, South East Queensland and Melbourne's growth areas
Calibration laboratoriesSydney, Melbourne, Brisbane, Perth, Adelaide, Geelong, Wollongong
Food and agricultural testingMelbourne, Brisbane, Adelaide, Toowoomba, Shepparton, Griffith, Tamworth
Oil, fuel and lubricant analysisPerth, Karratha, Gladstone, Brisbane, Darwin
Occupational hygiene and workplace monitoringAll capital cities and major industrial regions
Forensic and legal testingCapital cities, under NATA's discipline-specific criteria
University and research laboratoriesSydney, Melbourne, Brisbane, Canberra, Adelaide, Perth, Hobart

FAQ'S

Annex A of the 2022 edition contains 93 controls grouped into four themes: organisational, people, physical and technological. This replaced the 2013 structure of 114 controls across 14 domains. Content still citing 114 controls is out of date.

For Australian and international procurement, ISO 27001 is generally more recognised, and it is a certifiable standard rather than an attestation report. SOC 2 carries more weight with US enterprise buyers. Companies selling into both markets frequently hold both.

Partially. The Essential Eight is a set of specific technical mitigations, while ISO 27001 is a broader management system. Many Essential Eight controls map to Annex A, but neither substitutes for the other. Commonwealth-facing suppliers are often asked for both.

It supports compliance with Australian Privacy Principle 11 by demonstrating reasonable security steps, but it is not a privacy standard. For privacy management specifically, ISO/IEC 27701:2025 is the applicable standard and can now be certified independently.

Yes, and it is a common and legitimate approach for SaaS companies. The scope statement on your certificate must accurately describe what is covered, and prospective customers will read it, so scope it to what you can genuinely evidence.

They serve different purposes. IRAP assesses a specific system against the Information Security Manual for handling Australian Government data. ISO 27001 certifies your organisational management system. Government suppliers commonly need IRAP; commercial buyers commonly ask for ISO 27001.

All capital cities and major regional centres, including Sydney, Melbourne, Brisbane, Perth, Adelaide, Canberra, Hobart and Darwin. Most of an ISO 27001 project runs remotely, with on-site attendance where physical security controls or data centres need assessment in person.

Typically 16 to 28 weeks. Control implementation is the longest phase because it involves real technical change rather than documentation. Organisations with mature security practices already in place can move considerably faster.

Talk to our ISO 27001 team

If a customer questionnaire or tender triggered this, send it to us. Reading the actual requirement is faster than guessing at scope, and occasionally it turns out you need something narrower than full certification.

CONTACT
Reach out to us for any inquiries, collaborations,
or just to say hello!

Contact information for Nathan ISO Consulting

CLIENTELE
Our Valuable Client

WHEN NUMBERS MATTER
Empowering Insights into our Business Performance