Applicable framework
The assessment hierarchy begins with the primary standard and includes applicable normative, regulatory, scheme-owner and ISCB documents. When requirements conflict, ISCB will identify the controlling criterion before assessment.
- ISO 20387:2018 remains the published primary standard at this issue date and is under revision; ISCB will communicate transition arrangements after a replacement is published.
- ISO/IEC 17011:2017 governs ISCB's accreditation process and decisions.
- Ethical, consent, privacy, biosafety, biosecurity, transport and jurisdiction-specific requirements remain applicable.
Core organisational requirements
Legal status and responsibility
The applicant must be a legally identifiable entity, or a defined part of one, that can be held responsible for its conformity-assessment activities, contractual obligations and decisions.
Impartiality and independence
Identify, analyse, evaluate, treat, monitor and record risks to impartiality. Commercial, financial, ownership, relationship, consultancy and self-review threats must be controlled continuously.
Confidentiality and information security
Protect confidential information, personal data, intellectual property, examination or scheme security and electronic records. Disclosures must be legally authorised and appropriately communicated.
Organisation and governance
Define authority, responsibilities, reporting lines, committees and safeguards. Technical work, review and decisions must be assigned to competent and appropriately independent functions.
Competence and resources
Set competence criteria for every role affecting accredited activities; evaluate, authorise, monitor and periodically re-evaluate personnel. Control facilities, equipment, software and externally provided resources.
Controlled operations
Accept work only after confirming capability and scope. Use controlled methods and records, handle deviations, review outputs and ensure decisions are traceable to adequate objective evidence.
Management system
Maintain document and record control, risk and opportunity processes, complaints, appeals, nonconforming work, corrective action, internal audit, management review and continual improvement.
Accreditation claims
Claims, certificates, symbols and references to accreditation must be accurate, limited to the granted scope and changed immediately when accreditation is suspended, reduced, withdrawn or expires.
Service-specific technical requirements
- Define the scope by types of biological material and associated data, lifecycle activities, methods, storage conditions, locations and intended uses.
- Establish governance for access, consent or lawful authority, confidentiality, custodianship, material transfer and permitted use.
- Control acquisition, collection, transport, receipt, preparation, preservation, storage, retrieval, distribution and disposal with complete chain of custody.
- Define and verify critical quality attributes, quality-control methods, acceptance criteria and fitness for intended purpose.
- Qualify and monitor facilities, environmental conditions, equipment, alarms, backup systems, information systems and disaster-recovery arrangements.
- Manage traceability, data integrity, inventory reconciliation, nonconforming outputs, excursions and communication with depositors and users.
Minimum application and readiness evidence
Submit current, approved documents and representative implementation records. Templates without operational evidence are not sufficient.
Assessment, decision and continued accreditation
Application and scope review
ISCB reviews legal identity, requested scope, locations, resources, readiness and applicable criteria before quotation and assessment planning. Acceptance of an application is not a promise of accreditation.
Assessment
Assessment may include document review, office or remote assessment, on-site technical assessment, witnessing, interviews, vertical and horizontal record tracing, and evaluation of representative activities. The mix depends on scope and risk.
Nonconformities and decision
The applicant must determine causes, correct the specific issue, implement proportionate corrective action and provide evidence of effectiveness within the notified period. Accreditation decisions are made independently from assessment and only for demonstrated competence.
Maintenance
Accredited bodies must remain competent, comply with surveillance and reassessment, notify significant changes without delay, cooperate with witnessing and record access, address complaints and nonconformities, and control all accreditation claims.
Principal references
- ISO 20387:2018
- ISO/IEC 17011:2017
- Applicable ethical, privacy, biosafety and transport requirements
- Relevant ISO and ILAC biobanking publications
Document editions and external publications can change. The edition stated in the accreditation agreement, transition notice or other formal ISCB communication controls the assessment. Applicants should verify current editions before use.