ASF Standards · Laboratory · Standard 1
Standard 1 — Governance & Document Control
Criteria in this standard
1.1 — Named Accountable Person
1.2 — Document Control: One Current Version
1.3 — Document Approval Before Use
1.4 — Risk Register, Reviewed on a Schedule
1.5 — Retention Schedule Matches Legal Minimum
1.2 — Document Control: One Current Version
1.3 — Document Approval Before Use
1.4 — Risk Register, Reviewed on a Schedule
1.5 — Retention Schedule Matches Legal Minimum
1.1
Named Accountable Person
Non-Negotiable
A named individual — the Laboratory Director or an equivalent role — holds documented, final accountability for the quality management system. The name is current, not a vacant title inherited from a predecessor. Financial accountability is named separately, even where the same person holds both roles, and a brief, genuine statement of mission and values exists for the laboratory.
In plain terms: One real person, currently employed, is clearly on the hook if the quality system fails — not a job title nobody updated after the last person left.
| Facility category | Standalone lab | Hospital lab | Clinic lab |
|---|---|---|---|
| Applicability | Full | Full | Full |
Why this matters
When something goes wrong — a wrong result reaches a clinician, an inspection finds a gap, a complaint arrives — the first question is always “who owns this?” If the honest answer is “whoever happens to pick it up,” accountability has already failed. Laboratories commonly carry a Director title on the organizational chart for someone who left months or years ago, because updating the chart felt less urgent than keeping the lab running. The gap is invisible until the moment it matters most.
What good looks like
- A current staff member holds the role, verifiable against actual payroll or employment records.
- That person has documented authority to halt unsafe testing.
- Frontline staff can correctly name this person without hesitation.
Common failure modes
- The named Director left the organization; the title was never reassigned.
- Authority exists on paper but has never actually been exercised.
- Staff give different answers when asked who is accountable.
Worked example
In practice
A 15-staff clinical laboratory attached to a mid-sized private clinic.
BeforeThe organizational chart listed Dr. Beridze as Laboratory Director. Dr. Beridze had left for another position fourteen months earlier. The deputy had been running the lab day-to-day but had never been formally appointed, and had no documented authority to halt testing if something went wrong.
ActionManagement formally appointed the deputy as Acting Laboratory Director, issued a signed appointment letter specifying the scope of authority including the right to halt unsafe testing, updated the organizational chart, and briefed all staff directly in a team meeting.
AfterThe Monitor asked three staff members at random who was accountable for the quality system. All three named the same person correctly and described her authority accurately. Criterion verified.
If you are starting from zero — do this first
- Check who is actually named as Director on your current organizational chart.
- Confirm that person is still employed in that role today.
- If not, formally appoint whoever is actually running the lab, in writing, with explicit authority stated.
- Tell your staff directly — don’t assume the chart update is enough.
The most common mistake: Updating the organizational chart but never actually telling staff, who continue naming the previous person months later when asked.
Self-assessment questions
1. Is there a named, current Laboratory Director or equivalent, not a title left over from someone who has since left? — Verified against actual employment records, not an organizational chart that hasn’t been updated.
Evidence: Current employment record, signed appointment letter
Evidence: Current employment record, signed appointment letter
2. Does that person hold documented authority to stop unsafe testing or release of results? — Authority on paper only is not authority.
Evidence: Signed delegation of authority document
Evidence: Signed delegation of authority document
3. Can staff correctly name this person if asked directly? — If frontline staff don’t know who it is, the accountability is not functioning in practice.
Evidence: Staff interview during survey
Evidence: Staff interview during survey
4. Is financial accountability named separately from quality-system accountability, even if held by the same person? — A distinct, named responsibility, not assumed to be covered by the Director role alone.
Evidence: Governance role documentation
Evidence: Governance role documentation
5. Does a brief, genuine statement of mission and values exist, specific to this laboratory? — A real, specific statement, not an absence of one on the assumption a lab doesn’t need it.
Evidence: Mission/values statement
Evidence: Mission/values statement
Common reasons for a PARTIAL answer
- A deputy has been running the lab for months without formal appointment. — Functioning informally is not the same as documented accountability.
- Authority is assumed rather than written down. — “Of course she could stop testing if needed” is not a substitute for a signed document.
Implementation plan
| When | What |
|---|---|
| Week 1 | Verify who is actually, currently accountable versus who is named on paper. |
| Week 2 | Issue or update the formal appointment letter with explicit authority. |
| Week 3 | Brief all staff directly and update the organizational chart. |
| Ongoing | Review this appointment whenever the role changes hands. |
How the Monitor verifies this
| Method | What | Detail |
|---|---|---|
| DOCUMENT | Appointment record check | Reviews the current appointment letter and cross-checks the name against actual payroll or HR records. |
| ASK | Random staff interview | Asks two or three staff members, separately, who is accountable for the quality system, without prompting. |
Evidence base
International Organization for Standardization. ISO 15189:2022, Medical laboratories — Requirements for quality and competence, Clause 5.2 (Laboratory Director). Geneva: ISO; 2022.
Clinical and Laboratory Standards Institute. GP26-A4: Application of a Quality Management System Model for Laboratory Services. Wayne (PA): CLSI; 2011.
1.2
Document Control: One Current Version
Non-Negotiable
Every controlled policy, procedure, and SOP exists in exactly one current, identifiable version at the bench. Superseded versions are removed from use, not merely marked obsolete while remaining accessible.
In plain terms: The SOP taped next to the analyzer is always the real, current one — never an old printout someone forgot to remove.
| Facility category | Standalone lab | Hospital lab | Clinic lab |
|---|---|---|---|
| Applicability | Full | Full | Full |
Why this matters
A superseded SOP left at the bench is not a harmless historical artifact — it is a live instruction a tired or rushed technician can and will follow by mistake. Document control failures are rarely dramatic; they are a folder with three versions of the same procedure, no date distinguishing them, and no way to know at a glance which one is actually in force. The fix is unglamorous and entirely preventable.
What good looks like
- One current version per document, clearly dated and version-numbered.
- Superseded copies physically removed, not left nearby “for reference.”
- A single master register lists every controlled document’s current version.
Common failure modes
- An old printout left in a binder because reprinting felt unnecessary.
- Multiple section heads keeping their own partial document lists.
- A version marked “obsolete” but still sitting on the shelf.
Worked example
In practice
A hematology section with two analyzers and a shared SOP binder.
BeforeThe binder at Analyzer 1 held a 2023 SOP. The binder at Analyzer 2, three meters away, held a revised 2025 version with a corrected calibration step. Neither technician knew the other binder existed.
ActionThe Director consolidated to one master binder location, removed the outdated copy entirely, created a single master document register listing every SOP’s current version, and required sign-off confirming the old copy’s removal.
AfterThe Monitor selected the hematology SOP at random and verified it matched the master register’s stated current version, with no superseded copy found anywhere in the section. Criterion verified.
If you are starting from zero — do this first
- Walk every bench and photograph every SOP currently posted or in a binder.
- Compare each against your master list — do the versions match?
- Physically remove anything that doesn’t match, on the spot.
- Build one master register if none exists yet.
The most common mistake: Marking an old version “obsolete” with a stamp but leaving it in the same binder, where it still gets read under time pressure.
Self-assessment questions
1. Pick any SOP at random at the bench — is it the current version, verifiable against the master document register? — Spot-checked, not taken on the laboratory’s word.
Evidence: Master document register, bench inspection
Evidence: Master document register, bench inspection
2. Are superseded versions physically or digitally removed from the work area, not just labeled “obsolete”? — A marked-obsolete copy still on the shelf gets used under pressure.
Evidence: Bench inspection
Evidence: Bench inspection
3. Is there a single master document register that lists every controlled document and its current version? — Not several partial lists kept by different section heads.
Evidence: Master document register
Evidence: Master document register
Common reasons for a PARTIAL answer
- Each section keeps its own list, none of them complete. — Fragmented ownership is the most common root cause.
- Digital and printed versions have drifted out of sync. — An updated digital file with an un-updated printout still in use.
Implementation plan
| When | What |
|---|---|
| Week 1 | Inventory every controlled document currently in use across every bench. |
| Week 2 | Build or consolidate a single master register. |
| Week 3 | Remove every superseded copy found during the walk-through. |
| Ongoing | Require physical removal of old versions as part of every document revision process. |
How the Monitor verifies this
| Method | What | Detail |
|---|---|---|
| OBSERVE | Bench spot-check | Selects a document at random bench locations and compares it against the master register. |
| DOCUMENT | Register review | Confirms a single, complete master register exists covering all controlled documents. |
Evidence base
International Organization for Standardization. ISO 15189:2022, Medical laboratories — Requirements for quality and competence, Clause 8.3. Geneva: ISO; 2022.
Clinical and Laboratory Standards Institute. QMS02-A6: Quality Management System: Development and Management of Laboratory Documents. Wayne (PA): CLSI; 2013.
1.3
Document Approval Before Use
Non-Negotiable
No policy, procedure, or SOP is used at the bench before it has been formally reviewed and approved by the accountable person or their documented delegate.
In plain terms: Nobody starts using a new procedure the day they write it — it gets a real sign-off first, by someone with the authority to give one.
| Facility category | Standalone lab | Hospital lab | Clinic lab |
|---|---|---|---|
| Applicability | Full | Full | Full |
Why this matters
A procedure written by a competent technologist is not automatically a safe one — a second, accountable set of eyes catches errors, omissions, and conflicts with other procedures that the original author, close to their own work, may miss. Skipping approval to save time at the moment of writing almost always costs more time later, when a flawed procedure has already been followed by several staff members before anyone notices.
What good looks like
- Every document shows a named approver and approval date before its effective date.
- Delegation of approval authority, where used, is itself documented.
- Approval records are retrievable on request for any document.
Common failure modes
- A new SOP is used immediately “while we wait for formal sign-off.”
- Informal delegation — “she usually approves these” — with nothing written down.
- Approval records exist somewhere but can’t be quickly located.
Worked example
In practice
A microbiology section adopting a new specimen-handling SOP.
BeforeA senior technologist drafted an updated SOP and began training colleagues on it the same week, before the Director had reviewed it. The draft contained an error in incubation time that went unnoticed for three weeks.
ActionThe Director instituted a rule: no SOP trains or goes into use until a dated, signed approval exists. A simple approval log was created, checked before any new training session.
AfterThe Monitor selected a recently introduced SOP and found a signed approval dated six days before the first recorded training session. Criterion verified.
If you are starting from zero — do this first
- Check whether your most recently introduced SOP has a dated approval signature.
- If approval is delegated, write down who holds that delegation.
- Create a simple approval log if none exists.
- Make clear to staff: no use before approval, no exceptions.
The most common mistake: Treating approval as a formality to complete “soon” while the procedure is already in active use.
Self-assessment questions
1. Does every controlled document show a named approver and approval date before its effective date? — Not a document in active use with no visible sign-off.
Evidence: Approval log, signed document header
Evidence: Approval log, signed document header
2. Where approval is delegated, is the delegation itself documented and current? — An informal “they usually handle it” is not a documented delegation.
Evidence: Delegation of authority record
Evidence: Delegation of authority record
3. Can the laboratory produce the approval record for any document the Monitor selects at random? — On request, not after a delay to “find it.”
Evidence: Approval log, retrievable on request
Evidence: Approval log, retrievable on request
Common reasons for a PARTIAL answer
- Verbal approval was given but never recorded in writing. — A real conversation that nonetheless leaves no retrievable record.
- Training began before the approval was finalized. — Enthusiasm to roll out an improvement outpacing the control process meant to protect against error.
Implementation plan
| When | What |
|---|---|
| Week 1 | Audit recent SOP introductions for a documented approval date. |
| Week 2 | Create or formalize a simple approval log. |
| Week 3 | Brief staff that no new procedure trains before logged approval. |
| Ongoing | Check the approval log as a standing step before any new training session. |
How the Monitor verifies this
| Method | What | Detail |
|---|---|---|
| DOCUMENT | Approval record check | Selects a document at random and verifies a dated approval exists before its effective or first-use date. |
Evidence base
International Organization for Standardization. ISO 15189:2022, Medical laboratories — Requirements for quality and competence, Clause 8.3.2. Geneva: ISO; 2022.
1.4
Risk Register, Reviewed on a Schedule
Core
A risk register identifies specific risks to result accuracy and patient safety across the specimen pathway, with a named owner and review date for each entry, reviewed on a fixed schedule rather than only after an incident.
In plain terms: The lab keeps a real, specific list of what could go wrong and who’s responsible for watching it — checked on purpose, not only after something already has.
| Facility category | Standalone lab | Hospital lab | Clinic lab |
|---|---|---|---|
| Applicability | Full | Full | Full |
Why this matters
Most laboratories can describe their risks accurately when asked directly, in conversation. Far fewer have that knowledge written down, owned, and checked on a schedule. The gap between “we know about that” and “it’s on the register, someone’s named, and it gets reviewed every quarter” is exactly where risks that were once understood quietly drift out of anyone’s active attention.
What good looks like
- Specific, named risks — not generic entries applicable anywhere.
- Each entry has a named owner, not the Director by default on everything.
- Review happens on a genuine fixed schedule, verifiable by dates.
Common failure modes
- A register exists but hasn’t been opened since it was created.
- Entries like “human error” with no further specificity.
- Risks only get added after something has already gone wrong.
Worked example
In practice
A laboratory preparing for its first external review in two years.
BeforeA risk register existed from an initial setup exercise eighteen months earlier. It had never been reopened. Several listed risks had since been resolved; several new, real risks — a recently added point-of-care testing site, a new courier route — weren’t on it at all.
ActionThe Director assigned named owners to each entry, added the two missing recent risks, scheduled quarterly review meetings on the calendar, and retired resolved entries with a dated note rather than deleting them silently.
AfterThe Monitor reviewed the register and found entries specific to the laboratory’s actual operations, each with a named owner and a review date within the past quarter. Criterion verified.
If you are starting from zero — do this first
- List five actual risks specific to your own specimen pathway — not generic ones.
- Assign a real, named owner to each.
- Put a recurring review date on the calendar now, not “eventually.”
- Review once, for real, before claiming this is in place.
The most common mistake: Creating a thorough risk register once, during a specific project, and never opening it again afterward.
Self-assessment questions
1. Does the risk register name specific risks — not generic entries like “human error” with no detail? — Vague entries that could apply to any laboratory anywhere are not genuine risk identification.
Evidence: Risk register
Evidence: Risk register
2. Does each entry have a named owner responsible for it? — A risk with no owner does not get managed.
Evidence: Risk register with owner field
Evidence: Risk register with owner field
3. Is the register reviewed on a fixed schedule, verifiable by actual review dates, not only reactively after something goes wrong? — A register untouched for over a year despite a stated quarterly cycle fails this.
Evidence: Review meeting minutes or log
Evidence: Review meeting minutes or log
Common reasons for a PARTIAL answer
- The register was built once for an audit and never revisited. — A one-time exercise rather than a living document.
- Review happens but isn’t documented. — An informal conversation leaves no verifiable trace.
Implementation plan
| When | What |
|---|---|
| Week 1 | Review and update the existing register, or build one if none exists. |
| Week 2 | Assign named owners to every entry. |
| Week 3 | Schedule the first formal review meeting, recurring quarterly. |
| Ongoing | Hold the scheduled review every quarter without exception. |
How the Monitor verifies this
| Method | What | Detail |
|---|---|---|
| DOCUMENT | Register and minutes review | Examines the register’s specificity and checks review dates against meeting minutes or equivalent records. |
Evidence base
International Organization for Standardization. ISO 15189:2022, Medical laboratories — Requirements for quality and competence, Clause 5.6 (Risk Management). Geneva: ISO; 2022.
International Organization for Standardization. ISO 31000:2018, Risk management — Guidelines. Geneva: ISO; 2018.
1.5
Retention Schedule Matches Legal Minimum
Core
A documented retention schedule states how long each record type — patient results, quality control data, equipment maintenance logs, competence records — is kept, and meets or exceeds the applicable national legal minimum.
In plain terms: The lab knows, in writing, exactly how long it must keep each type of record — and actually keeps them that long, provably.
| Facility category | Standalone lab | Hospital lab | Clinic lab |
|---|---|---|---|
| Applicability | Full | Full | Full |
Why this matters
Retention gaps rarely surface during ordinary operation — they surface years later, when a patient, a legal proceeding, or a regulator asks for a record that should still exist and doesn’t. Patient result retention tends to be well understood; equipment maintenance history and staff competence records are the specific categories most often discarded too early, simply because nobody wrote down that they needed the same discipline.
What good looks like
- A written schedule names every major record type, not just patient results.
- Each period meets or exceeds the current national legal minimum.
- A record from several years back can actually be retrieved on request.
Common failure modes
- Equipment logs discarded after a shorter, informal period.
- Retention periods based on outdated legal assumptions, never rechecked.
- Records technically retained but practically unretrievable.
Worked example
In practice
A laboratory responding to a legal records request four years after a specific test.
BeforePatient result retention was well documented at ten years. Equipment maintenance logs, however, were being cleared after three years as an informal practice nobody had ever written down or checked against the actual legal requirement, which was seven years.
ActionThe Director reviewed current national requirements for every record category, wrote a complete retention schedule covering all of them, and corrected equipment log retention going forward, flagging the gap for the records already improperly discarded.
AfterThe Monitor requested a four-year-old equipment maintenance record and the laboratory retrieved it within minutes. Criterion verified.
If you are starting from zero — do this first
- List every record type the laboratory generates.
- Look up the actual current legal minimum for each, don’t assume.
- Write the schedule down, don’t leave it as informal practice.
- Test retrieval of one old record from each category.
The most common mistake: Assuming equipment and competence records need less protection than patient results, when legal minimums often apply to them too.
Self-assessment questions
1. Does a written retention schedule exist covering every major record type, not just patient results? — Equipment and competence records are frequently the gap.
Evidence: Written retention schedule
Evidence: Written retention schedule
2. Does each retention period meet or exceed the national legal minimum for that record type? — Checked against the actual current law, not an assumption carried over from years ago.
Evidence: Legal reference cited in the schedule
Evidence: Legal reference cited in the schedule
3. Can the laboratory retrieve a record from several years back within the stated retention period, not just recent ones? — A retention policy that exists on paper but fails in practice when records are actually needed.
Evidence: Retrieval test during survey
Evidence: Retrieval test during survey
Common reasons for a PARTIAL answer
- The schedule exists but was never checked against current law. — Legal minimums can change; a schedule set once and never revisited may be outdated.
- Old records exist but can’t be found quickly. — Retained in principle, but storage and indexing make real retrieval impractical.
Implementation plan
| When | What |
|---|---|
| Week 1 | Inventory every record type and current informal retention practice. |
| Week 2 | Check each against the actual current national legal minimum. |
| Week 3 | Write the formal schedule and correct any gaps found. |
| Ongoing | Recheck legal minimums whenever national regulation changes. |
How the Monitor verifies this
| Method | What | Detail |
|---|---|---|
| DOCUMENT | Schedule and legal cross-check | Reviews the written schedule against the laboratory’s cited legal basis for each record type. |
| ASK | Retrieval test | Requests a specific older record and times how long genuine retrieval takes. |
Evidence base
International Organization for Standardization. ISO 15189:2022, Medical laboratories — Requirements for quality and competence, Clause 8.4. Geneva: ISO; 2022.