Approving a calibration supplier and keeping an approved supplier list

Why a calibration lab is not an ordinary supplier

Most external providers only have to meet a purchase requirement. A calibration lab does two jobs at once. Both of them sit inside your quality system.

First, it is an external provider. ISO 9001:2015 clause 8.4.1 requires you to determine and apply criteria for evaluating, selecting, monitoring the performance of and re-evaluating external providers. It also requires records of those activities and of any necessary actions arising from them. That is four separate activities, not one. Approving a lab in 2021 covers the first two. Monitoring and re-evaluation are the two left undone. Those are the two an auditor will ask you to show evidence for.

Second, it is a link in your traceability chain. When your instrument comes back with a certificate, the validity of every measurement you make with that instrument rests on the work that lab did. Sending the gauge out does not move that obligation off your system. It adds a supplier control obligation on top of it.

That dual role has a practical consequence. Ordinary supplier control asks whether the goods arrived on time and conformed. Calibration supplier control also asks whether the lab was technically capable of the specific measurement you bought. It asks that at the range you use, to an uncertainty small enough for your tolerance. A lab can be reliable commercially and still be the wrong lab for your torque wrench.

• What metrological traceability actually proves
• What each standard requires for calibration

What the standards actually require, and what they do not

This is where most published advice overstates the case. It is worth being exact.

ISO 9001 does not require an approved supplier list. The words do not appear in the standard. Clause 8.4.1 requires you to set criteria for evaluating, selecting, monitoring and re-evaluating external providers. It then requires you to apply those criteria and keep the records. The criteria are the part auditors ask for first. A list is simply the ordinary way people hold the records.

ISO 9001 also does not require your calibration lab to be accredited. Its traceability rule applies where traceability is a requirement, or where you judge it essential to confidence in your results. Where it applies, the equipment has to be calibrated or verified against measurement standards traceable to international or national measurement standards. The standard also tells you to take the effectiveness of the provider's own controls into consideration when you decide how much control to apply. Accreditation is the strongest evidence available. It only carries that weight for work sitting on the lab's published scope. It is not named as a requirement.

Aerospace is stricter. AS9100D clause 8.4.1.1 requires a register of external providers that records approval status and the scope of that approval. It also requires you to define the process, the responsibility and the authority for deciding approval status and for changing it. The status examples in the standard are approved, conditional and disapproved. The scope examples are product type and process family. Listing a lab as simply approved, with no scope, leaves out a required element of the register.

Automotive is the strictest. IATF 16949 names calibration services explicitly in the scope of supplier control. Its external laboratory clause requires the lab to have a defined scope covering the service you buy. The lab must then either be accredited to ISO/IEC 17025 or a national equivalent with that service inside the accreditation scope, or be documented as acceptable to your customer. Where accreditation is the route, the certificate or report has to carry the mark of a national accreditation body. A narrow route also allows the equipment manufacturer to calibrate its own equipment when no qualified lab is available.

Medical devices sit in between. ISO 13485 uses its purchasing clause rather than the ISO 9001 numbering. It requires selection and control criteria proportionate to the risk associated with the medical device. It does not require accreditation either. It requires you to justify and record your reasoning. Since 2 February 2026 the FDA's Quality Management System Regulation incorporates ISO 13485:2016 by reference. US device makers now meet the purchasing control obligation through that clause rather than through the old 21 CFR 820.50 wording.

Calibration laboratories themselves run the same loop. ISO/IEC 17025 requires a lab to have a procedure and records covering how it defines requirements for what it buys. The same procedure has to cover how it evaluates, selects, monitors and re-evaluates its own external providers, how it checks conformity before use, and what actions it takes from those evaluations. When you buy accredited calibration, part of what you are buying is a supply chain that has already run this control loop on its own reference standards.

• No standard in this group sets a re-evaluation frequency. Annual is convention, not requirement.
• No standard sets a record retention period for supplier files. That comes from your contracts, your regulator and your own retention rules.
• No standard requires an on-site audit of a calibration lab. Aerospace requires you to communicate any such activity you intend to perform.
• None of them define the phrase NIST traceable. It is purchase order and certificate language rather than a defined term. On its own it proves nothing. What you have to be able to evidence is metrological traceability, and NIST publishes its own policy on what a claim of traceability to NIST should be able to show.

• Requirements by standard
• Accredited versus certified

Write the requirement before you request quotes

Most of the pain in calibration purchasing comes from buying an undefined service. The certificate arrives, it is missing something you needed, and by then the instrument is back in use.

Every standard in this area asks you to communicate requirements to the provider before work starts. For calibration that is a short list. It belongs on the purchase order or in a standing agreement rather than in an email thread.

• The parameters, ranges and points you actually use, not the manufacturer's default point set.
• Your tolerances, if they differ from the manufacturer specification.
• Whether accredited calibration is required, named per parameter. Many labs sell an accredited service and a cheaper non-accredited one under the same brand.
• As-found data required, before any adjustment. As-left data required after adjustment or repair.
• Reported measurement uncertainty, with the coverage factor stated.
• Whether you want a statement of conformity, and under which decision rule. If you do not specify one, you inherit the lab's.
• Out-of-tolerance notification. Require the lab to report an as-found out-of-tolerance condition in writing, to a named person, within a stated number of days.
• Whether subcontracting is permitted. If it is, say whether it needs your prior approval and must be identified on the certificate.
• Adjust only with approval, if a silent adjustment would cost you your as-found evidence.
• Turnaround commitment, and the asset identifiers you want printed so the certificate names your serial numbers.
• Whether a due date may be printed on the certificate or the label. ISO/IEC 17025 says a calibration certificate or calibration label shall not carry a recommended calibration interval unless you agreed to it. The same clause lets legal regulations override that. In most cases the interval is yours to set. Tell the lab which date to print, or tell it to print none.

• What a calibration certificate must carry
• Decision rules and guard banding

The scope of accreditation is the document that matters

Accreditation produces two documents. A certificate of accreditation is one page saying the lab is accredited. A scope of accreditation is the table of what the lab is actually accredited to do. A supplier who sends you only the certificate has not answered your question.

The scope lists, for each capability, the measurand or type of instrument, the method, the measurement range with any other relevant parameters, and the measurement uncertainty. Those elements together are one calibration and measurement capability, usually shortened to CMC. The uncertainty figure is part of the CMC and not the whole of it. It only applies inside the range, method and conditions on the same line. Column headings vary by accreditation body. Some head the uncertainty column CMC. Others call it expanded uncertainty of measurement. Scanning for those three letters can make you miss it.

A genuinely accredited lab can be outside its scope for your job in more ways than most buyers expect.

• The parameter is not listed at all. Accreditation is granted per measurement, not per company.
• Your range falls outside the listed band. A row covering 0 to 55 ohms does not cover 400 ohms.
• The direction is wrong. Accredited to measure a quantity is not the same as accredited to source or simulate it.
• The site is wrong. Accreditation is issued to a facility. Certificate numbers often carry a location suffix. A multi-site company can have one accredited site and three that are not.
• On-site work is different from bench work. Field uncertainties are normally worse than the bench figure, and some scopes cover only one mode.
• The service is on the scope but the lab does not sell it commercially. Some directories flag commercial availability.
• You ordered the cheaper non-accredited tier without noticing.

• How accreditation scopes work
• US accredited calibration lab landscape

Reading a CMC, and why your job uncertainty is bigger

A CMC is the smallest uncertainty the lab can achieve when calibrating a near-ideal device under normal conditions. It is a floor, not a promise about your instrument.

Most instruments sent out for calibration are not near-ideal. The uncertainty reported on your certificate has to cover contributions from your device. So it is equal to or larger than the CMC on the scope, and it is usually larger. One firm rule follows. An accredited lab must not report an uncertainty smaller than its published CMC for that work. A reported value that lands exactly on the CMC is not a defect on its own. That happens when your device adds little and the figures round to the same number. What should make you look harder is one identical uncertainty printed across clearly different items. Ask the lab how it evaluated the contribution from your instrument.

Compare the CMC to the tolerance you will actually apply. Do it on the scope line that matches your parameter and your range. A scope lists many CMCs. It does not hold one number for the lab. Put both figures on the same basis before you judge them. Percent of reading and percent of span are not the same thing. Run the comparison at a real test point. If your acceptance limit works out to 0.1 percent of reading at that point and the matching CMC is 0.25 percent of reading, no reputation fixes that gap. The common expectation is a test uncertainty ratio of at least 4 to 1, or a documented false-accept risk analysis instead. The uncertainty printed on your certificate will be at least the CMC and usually more. A ratio that looks marginal on the scope is worse on the job.

CMC values legitimately take several forms. A single value across a range. A low to high range. A percentage of reading. A percentage plus a floor. A formula that scales with length. A table of discrete points. A single bounding value written as less than or equal to some figure across a range is normal, and the accreditation body assessed that format before it went on the scope. Do not raise that as a defect. Raise it when the number is a best case rather than a bound, such as uncertainty as low as some figure. Raise it when no coverage factor or confidence level is stated. Raise it when the value is not tied to a named parameter, range and method.

• Test uncertainty ratios and decision rules

Verify at the accreditation body, not from the emailed PDF

This whole sequence takes a few minutes per supplier. It takes more than one lookup because the US has no single register. Two bodies can also disagree about the same lab at the same address.

Note which changes get published. Suspensions and withdrawals are generally made public. A quiet reduction in scope is the change most likely to affect you and the least likely to be announced. Scopes carry their own revision dates and can be cut part way through a cycle, not only at renewal. That is a reason to re-check the live scope on a schedule rather than to rely on being notified.

1. Get the legal entity name and site address from the quote, not from the brochure. Trade names and parent brands do not carry accreditation.
2. Open the accreditation body's public directory and search for that legal entity at that address. Do not work from the PDF the supplier sent. A file tells you what was true the day it was saved. Accreditation can be suspended, withdrawn or reduced since then.
3. Check the accreditation status and the valid-to date. Read the status word carefully. Some bodies use terms like extended for an active accreditation carrying an extension, which is not a separate state.
4. Match the certificate number including any site suffix.
5. Compare the scope revision date on the directory copy against the copy you were sent. A scope can be revised and lose a row you relied on.
6. Find your parameter as an actual row. Confirm your range sits inside the listed band and the direction matches.
7. Read the uncertainty on that row against your tolerance.
8. Check the mode. If you need on-site work, the row or its footnotes must allow field service.
9. Save the evidence. Print or save the directory page and the scope with the date you retrieved them, and record who checked.

• Directory-reading traps by accreditation body

Checking the certificate when it comes back

Approving a supplier is one control. Checking the output is a separate one, and the standards treat it that way. The incoming review of a returned certificate is where supplier control and traceability meet.

Read the full certificate element list on the certificate requirements guide rather than here. The checks specific to a supplier decision are these.

• The item identification matches the asset record, by serial number.
• Measurement uncertainty is stated, in usable units, with the coverage factor.
• There is a real traceability statement, not just the phrase NIST traceable.
• As-found data is present when the unit was adjusted or repaired, if you required it.
• The accreditation symbol or a text reference to accreditation appears, if you ordered accredited work.
• Mixed reports flag the non-accredited lines. A report containing no accredited results should carry no accreditation reference anywhere, including on covering letters.
• Results obtained from an external provider are clearly identified. That is how you find out your work was subcontracted.
• Any pass or fail statement names the decision rule applied.
• The reported uncertainty is at least the CMC on the scope line matching the parameter and range actually calibrated. Compare like for like, at the same coverage factor. A value below the published CMC needs an explanation from the lab. A value sitting right on it does not.

• Certificate elements in full

What a calibration row on the approved supplier list has to carry

A generic supplier row breaks on a calibration lab, for four reasons. Certification and accreditation are different objects. Accreditation is limited to a scope that lives in a separate document with its own date. Accreditation is site-specific. And field work is a distinct activity from bench work.

So the structure that works is a parent row per supplier site, with child rows for each approved measurement area. A single flat row per company forces the over-broad entry that causes most of the damage.

Beyond the usual identity and status columns, a calibration supplier row needs these.

• Supplier legal name and the specific site performing the work, with address.
• Discipline and parameter, with the range. Torque 5 to 500 newton metres is a scope line you can check. Torque on its own is a wish.
• The tightest instrument tolerance you may send this lab, recorded per scope line you actually use. Work the planning figure from the CMC for that parameter and range and your required ratio. Treat it as a best case. The number that has to meet your ratio is the uncertainty printed on the certificate, and that is usually larger than the CMC.
• Accredited or non-accredited service, per parameter.
• On-site or field service approved, recorded separately from bench work.
• An explicit not approved for line. It is the cheapest field on the list and the one that stops the wrong purchase order.
• Accreditation body, certificate number with its site suffix, and the scope document reference with its own revision date.
• The date you verified the accreditation in the body's directory, and who checked it. This is the highest-value field most lists do not have.
• Approval status from a fixed value set, the basis for approval, the approval date and a named person who approved it.
• Your re-evaluation due date, kept as a separate column from the supplier's certificate expiry date. People merge these two and then treat an unexpired certificate as an up-to-date evaluation.
• A pointer to where the flowed-down requirements live. That means the purchase order text, the quality clauses or the service agreement.

• Free approved supplier list builder with CSV export

Using the free ASL template

Our approved supplier list builder runs entirely in your browser. Nothing is uploaded. It gives you seven editable columns per row: supplier, category, approval status, certification, certificate expiry, scope supplied and last audit. Status is a fixed set of Approved, Conditional, Disqualified and Pending. The certification column is a fixed set too. It offers ISO 9001, AS9100, IATF 16949, ISO 13485, ISO/IEC 17025 and None, and it takes one value per row.

Read the ISO/IEC 17025 entry as accreditation rather than certification. A calibration lab is accredited to 17025 by an accreditation body. It is not certified to it. That distinction decides what the row is actually worth.

It flags certificates that have expired or that expire within 90 days. It counts your suppliers by status. It lists the ones needing attention with the most overdue first, and it counts separately any supplier that has a certification recorded and no expiry date. The CSV and TSV export carries eight columns rather than the seven on screen. The extra one sits between certificate expiry and scope supplied. It holds a certificate status worked out from the expiry date you typed in. Treat that as a chase list. A scope can be cut or an accreditation suspended long before the printed date runs out.

The columns above that the builder does not have, such as approval basis, approval owner, risk tier and next review date, are ones you add in your own spreadsheet after exporting. That is deliberate. The export stays readable, and your columns are yours.

For the performance side, the supplier scorecard calculator publishes its formulas and defaults so you can see how a score is built. It was designed for goods, so translate the inputs for a lab. Certificates received stands in for lots received. Certificates returned with errors or needing reissue stands in for rejects. Instruments returned late against the promised turnaround is your delivery metric. Out-of-tolerance findings reported by the lab, against those found later by you, is worth tracking on its own.

If you would find automatic tracking of supplier accreditation certificates and scopes useful, there is a page describing what we are considering building. It is not available today. Read every line on it as intent, not as a product.

• Approved supplier list template
• Supplier scorecard calculator

Conditional approval, and making status mean something

Conditional approval is a real, recordable state, and it is where the list earns its keep. It is not a status word on its own. It is four things, and it is not conditional approval unless all four are present.

The restriction, stating what they may and may not be used for. The end date. A named owner who closes it out. And the exit evidence, meaning what must be produced to move to approved, or the row drops to suspended.

Common shapes for a calibration lab. Approved for dimensional only while a torque scope extension is assessed. Approved through a fixed date while an accreditation renewal closes. Approved for one purchase order, then review. Approved with 100 percent incoming certificate review. Approved only for work where your end customer has accepted this lab.

One more shape needs its own note. Not accredited, but audited by you, with the chain to SI and the stated uncertainty on file. Record loudly that this is not accredited calibration. The missing accreditation mark is the least of it. Nobody outside your own audit has assessed the method or the uncertainty. Your customer or your registrar can still reject the result. Automotive and aerospace flowdowns usually want accreditation or written customer acceptance instead.

The rule that makes the whole thing work is that status has to gate a purchase order rather than sit beside one. If the only consequence of conditional is a colour on a spreadsheet, it is approved with a note.

Two diagnostics. If any conditional row is older than its own condition, that is your finding. And if every row on your list says approved, the status column has never been used.

Re-evaluation, and the triggers that beat the calendar

No standard names an interval. Annual is the common default. Risk-tiered variants are widespread, with shorter cycles for sole-source or high-consequence suppliers and longer ones for low risk. Depth tiers too, from a desk review of documents through a questionnaire and a remote review up to an on-site audit.

Run the periodic re-evaluation on your own clock. Do not anchor it to the supplier's accreditation cycle, because those cycles usually run longer than a year. Then keep a separate expiry watch that fires 60 to 90 days before the accreditation expiry rather than on it. That leaves time to requalify or line up an alternative before instruments come due. A lapse discovered on the day of expiry is already a problem for anything in transit.

Tier by what the instrument controls, not by what the calibration costs. A cheap calibration on the gauge that releases product outranks an expensive one on a facilities thermometer.

Scheduled review is the floor. These force a review immediately.

• Accreditation expired, suspended, withdrawn or surrendered.
• Scope reduced, or the uncertainty values on your parameter got worse. A body can cut or partly suspend a scope at any point in the cycle, not only at renewal. Compare the new scope against the previous version. Reductions do not announce themselves.
• Change of accreditation body.
• The lab moved site, was acquired, or changed the signatory or the key technician for your discipline.
• The lab began subcontracting work it used to perform itself, or you discovered it already was.
• A certificate arrived missing a required element, or the wrong instrument was identified.
• An out-of-tolerance result reported late, or found by you rather than reported by them.
• An instrument came back and failed your own verification.
• You started buying something new from them. New parameter, wider range, tighter tolerance. The existing approval does not cover it and nothing in a normal purchase process notices.
• A long gap with no orders. Requalify before using a dormant supplier again.

When no accredited source exists

Sometimes the parameter you need is not on anyone's scope. Sometimes the only competent source is the equipment manufacturer. This is a legitimate situation and it has a defensible route through it.

Options, roughly in order of strength. Search other accreditation bodies' directories by parameter keyword rather than by lab name, since a different lab may already cover it. Split the order, sending covered parameters to the accredited lab and the uncovered one elsewhere, with the split explicit on the purchase order so the certificate marking matches. Ask the lab to extend its scope, which is real but slow. Go to the manufacturer or a national metrology institute for exotic parameters, checking what accreditation the service centre holds and for which site. Calibrate in house against traceable references with your own documented uncertainty budget, where your standard allows it. Or accept non-accredited but traceable calibration and document why.

The last route carries real work. Where accreditation is absent, the evidence you are expected to hold looks a lot like what an assessor would examine. That means method validation records, the uncertainty evaluation, traceability documentation, evidence of ongoing validity of results, personnel competence, equipment records, and facility and environmental controls. That is a substantial file, which is why this route is usually a last resort rather than a saving.

Whichever route you pick, check your own obligations first. ISO 9001 leaves the decision to you as long as you apply your own criteria and keep the records. IATF is tighter. The external lab must have the specific service in its defined scope. It must then either be accredited to ISO/IEC 17025 or a national equivalent with that service in the accreditation scope, or be documented as acceptable to your customer. The same clause carries a note for this exact case. Where no qualified laboratory is available for a given piece of equipment, the equipment manufacturer may perform the calibration. You then have to meet the controls IATF sets for an internal laboratory. Keep the evidence either way. Record what you checked and what you found, the date, the reason the gap was acceptable, and who approved it.

• Check what your standard actually allows

Diagnostics you can run on your current list today

The common failure is not a dramatic one. The list gets built for an audit. Nothing in the buying process ever reads it. It stops being true one supplier at a time while still looking finished. These checks take about twenty minutes.

1. Sort by approval date. If most rows share one date, the list was made in one sitting and has not moved.
2. Sort by re-evaluation due date. Count the rows in the past. Count the blanks. Blank is worse than overdue.
3. Count rows with any status other than approved. Zero means the status column is decorative.
4. Pull the last twelve months of calibration purchase orders and match each supplier to a row. Suppliers with no row are your shadow list.
5. Take your three highest-spend calibration suppliers. For each, open the accreditation body directory and confirm the accreditation is live, the site matches the ship-to address, and the scope covers the instruments you actually sent.
6. Check whether the certificate expiry column and the re-evaluation column ever hold different dates. If they are always equal, one is being copied into the other and no independent evaluation is happening.
7. Ask who owns the list. If the answer is a department, no one owns it.

• Rebuild the list in the free template

Where Axiospec fits

Axiospec is cloud calibration management software from CaliTech LLC. It is a documentation and workflow tool. It does not certify or accredit anyone, and it cannot make a supplier approved. The approval decision and the approved supplier list stay yours.

What it holds is the other half. That is the calibration records the supplier decision governs. Records land in a tamper-evident hash-chained ledger, with optional maker and checker approval, where the server refuses to let the person who logged a calibration approve it. When you select a standard, the fields that standard requires are marked on the calibration form and the save is blocked until they are filled. Enforcement is on by default. An admin can relax it per workspace, and a brand new workspace is exempt only until its first calibration. The one exception is the certificate itself: because it is a file upload it stays advisory in the form, though the REST API does enforce it.

There are per-instrument uncertainty budgets and built-in AIAG MSA studies. Native iOS and Android apps give you offline capture and QR scanning on every plan. A self-serve CSV and Excel import reads GAGEtrak and GAGEpack exports.

The free plan is permanent. It is not a trial. It covers 50 instruments with unlimited users. A new workspace runs on Professional for its first 45 days. After that it stays free at 50 instruments unless you move to a paid tier. Paid tiers are 59, 129 and 229 US dollars per month with unlimited users.

The two supplier tools linked from this guide, the approved supplier list builder and the supplier scorecard calculator, are free and need no account. The certificate expiry page is not a tool. It describes something we are considering building.

• Approved supplier list template
• Supplier scorecard calculator