Lab Compliant Testing Guide for Employers and Organizations
TL;DR:
- Verifying laboratory compliance involves confirming CLIA, ISO/IEC 17025, and SAMHSA or CAP accreditation before testing.
- Employers must review scope documents, chain-of-custody procedures, and proficiency testing results to ensure defensible sample testing.
Lab compliant testing means ordering from a laboratory that holds a current, verifiable CLIA certificate, ISO/IEC 17025 accreditation with a matching scope document, and documented chain-of-custody procedures that satisfy SAMHSA or CAP requirements for your specific test type. For U.S. employers, the single most important first step is confirming all three before a sample is ever collected. A lab that cannot produce these documents on request is not a compliant partner, regardless of what its website claims.
Immediate verification checklist:
- Current CLIA certificate number, verifiable on the CMS CLIA registry
- ISO/IEC 17025 scope document naming your exact test method and sample matrix
- SAMHSA certification or CAP accreditation for federally regulated or forensic drug testing
- Tamper-evident chain-of-custody forms with documented handoffs at every transfer point
Red flags to stop a purchase immediately:
- Lab cannot produce a current scope document or certificate number
- Vague or evasive answers about method validation for your specific matrix
- Refusal to share raw data or proficiency testing results
- Routine subcontracting without disclosing the subcontractor’s own accreditation
Pro Tip: Request the lab’s scope document, not just the certificate. A certificate number confirms registration; the scope document confirms the lab is actually accredited for your test.
Table of Contents
- What do CLIA, ISO 17025, SAMHSA, and CAP actually require?
- What operational controls make a lab’s results defensible?
- How do you evaluate and qualify a testing lab before ordering?
- How should compliant sample collection and chain-of-custody work?
- How do employers keep a testing program audit-ready over time?
- When is an at-home screen enough, and when do you need lab confirmation?
- How do you independently verify CLIA and ISO accreditation status?
- What should a compliant lab’s incident reporting process look like?
- What biosafety and safety protocols should a compliant lab follow?
- How should a compliant lab handle and dispose of hazardous samples?
- Key Takeaways
- The compliance mistake most employers make
- Countrywidetesting makes certified lab testing straightforward
- Authoritative registries and primary sources
What do CLIA, ISO 17025, SAMHSA, and CAP actually require?
Understanding these frameworks helps you read certificates correctly, not just collect them.
CLIA regulates all U.S. facilities testing human specimens. Administered by CMS, the certificate level determines which tests a lab may perform and how rigorous its inspection schedule is. As of 2026, all CLIA certification and survey fees must be paid online through the CMS system. A lab performing high-complexity testing under a waived certificate is operating outside its permitted scope.
ISO/IEC 17025 accreditation is scope-specific. A laboratory accredited for urine drug screening is not automatically accredited for oral fluid or hair testing. Always verify the scope document names your exact method, the current standard edition, and the sample matrix you are submitting.
In the U.S., credible ISO/IEC 17025 accreditation is typically granted by A2LA, NVLAP, or PJLA, all of which are signatories to international mutual recognition arrangements. SAMHSA certification applies specifically to federal workplace drug testing programs and is required when results may be used in legal or disciplinary proceedings. CAP accreditation adds a peer-inspection layer on top of CLIA and is widely recognized as a higher-tier quality signal for clinical laboratories.
What operational controls make a lab’s results defensible?
Accreditation is the credential. The Quality Management System is the engine behind it.
A compliant lab maintains documented SOPs with version control, management review cycles, and internal audits. Every procedure change goes through change control before implementation. Data integrity must meet ALCOA+ standards: records are attributable, legible, contemporaneous, original, and accurate, plus complete, consistent, confidential, and available.
Method validation is where many labs fall short. A lab may list a method in its catalog but lack validation data for your specific matrix. Ask for limits of detection (LOD), limits of quantitation (LOQ), accuracy, precision, linearity, and matrix interference notes. ISO/IEC 17025 requires proficiency testing participation for every accredited method, and gaps in PT coverage are a common compliance deficiency in accreditation assessments.
Equipment calibration follows a risk-based schedule with regular periodic verification for critical instruments, including after repair or relocation. Environmental controls, including temperature and humidity monitoring in storage and testing areas, must be logged continuously with documented out-of-range responses.
Pro Tip: Ask the lab for its most recent PT summary for the specific analyte you are testing. A lab that participates in PT but performs poorly on your analyte is a compliance risk even if its certificate is current.
How do you evaluate and qualify a testing lab before ordering?
Treat lab selection as a regulatory strategy decision, not a procurement checkbox.
| Evaluation Dimension | What to Request |
|---|---|
| Accreditation and scope | Current CLIA certificate + ISO/IEC 17025 scope document |
| Approved methods and matrices | Method validation summary for your specific sample type |
| Turnaround time and confirmation | Standard TAT, expedited options, GC-MS/LC-MS confirmation policy |
| Chain-of-custody and raw data | Sample CoC form, raw data access policy, retention period |
| Proficiency testing | PT participation records for your analyte |
| Pricing and billing | Per-test pricing, volume discounts, invoicing terms |
| Support and documentation | Responsiveness to compliance document requests |
Verify accreditation scope directly on the accreditation body’s public registry, not from a PDF the lab supplies. A lab-supplied certificate may be outdated or cover a narrower scope than the lab implies.
- Confirm the exact standard edition and analyte are named in the scope.
- Ask whether any portion of your testing is subcontracted, and request the subcontractor’s own accreditation.
- Request a sample Certificate of Analysis and confirm it includes method references, detection limits, and analyst signatures.
- Ask how nonconforming results are communicated and documented.
Labs that refuse to provide raw data or method validation summaries should be excluded from your approved supplier list without exception.
How should compliant sample collection and chain-of-custody work?
A broken chain of custody can render a result legally inadmissible, regardless of how accurate the analytical work was.
Per SAMHSA’s urine collection guidance: any gap in documented custody, an undocumented temperature excursion, or a missing handoff signature can disqualify a result in a legal or disciplinary proceeding.
- Assign a unique sample ID at collection and record it on the CoC form.
- Seal the specimen in tamper-evident packaging immediately after collection.
- Document every custody transfer with a signature, printed name, date, and time.
- Maintain required temperature conditions during transport and log any deviations.
- Record accessioning at the lab, including condition on receipt and any seal integrity issues.
- Retain samples per the lab’s documented retention and disposal policy.
Confirmatory testing using GC-MS or LC-MS is triggered by a positive or inconclusive presumptive screen. The lab must have a documented retest policy that specifies the trigger criteria, the confirmatory method, and how results are reported. For workplace or legal use, confirmatory testing is not optional.
Pro Tip: For any test that may support a disciplinary or legal action, require observed collection and electronic timestamped accessioning. Paper-only CoC systems are a litigation risk.
How do employers keep a testing program audit-ready over time?
Procurement is a one-time event. Compliance is an ongoing program.
Build an approved supplier list that includes each lab’s current accreditation scope, requalification date, and PT monitoring status. Schedule requalification reviews at least annually, or immediately after any accreditation change, PT failure, or significant turnaround-time deviation. Workplace testing programs that treat lab selection as a one-off purchase consistently face audit findings that could have been avoided with a simple annual review.
A role-based training matrix documents who is trained on which SOPs, the training date, the SOP version in effect at training, and the competency assessment result. Link training records to SOP versions so an auditor can trace any result back to a qualified analyst working under a current procedure. Retraining is required after method changes, extended absences, or nonconformance events.
- Retain CoC forms, test reports, and raw data for the period required by applicable regulations and your own policy.
- Conduct internal audits at least annually, rotating auditors for independence.
- Run mock inspections that challenge data integrity, CoC traceability, and method performance records.
- Review injury prevention and safety training records alongside lab compliance documentation during audits.
When is an at-home screen enough, and when do you need lab confirmation?
The answer depends on what you plan to do with the result.
Rapid immunoassay screens, including point-of-care urine cups and oral fluid tests, are presumptive. They are useful for initial screening but cannot support a termination, legal action, or federal compliance report on their own. A positive presumptive result must be confirmed by GC-MS or LC-MS at an accredited laboratory before any adverse employment action is taken.
Use a rapid screen when:
- You need a quick, cost-effective initial pass for a large group
- The result is negative and no further action is required
- Your policy permits screening-only decisions for non-safety-sensitive roles
Require lab-based confirmatory testing when:
- The result will support a disciplinary or termination decision
- The testing is required under a federal program (DOT, NRC, DOD)
- The result may be challenged in arbitration or court
- The collection must be observed to preserve admissibility
How do you independently verify CLIA and ISO accreditation status?
Never rely solely on documents the lab provides. Use the primary registries.
| Registry | What It Confirms | URL |
|---|---|---|
| CMS CLIA Registry | Certificate number, level, expiration, and survey status | cms.gov |
| A2LA Public Directory | ISO/IEC 17025 scope, accredited methods, and matrices | a2la.org |
| NVLAP Lab Directory | Scope and accreditation status for NVLAP-accredited labs | nist.gov/nvlap |
| PJLA Accredited Labs | ISO/IEC 17025 scope for PJLA-accredited labs | pjlabs.com |
| SAMHSA Certified Labs | Federally certified labs for workplace drug testing | samhsa.gov |
- Go to the CMS CLIA registry and search by lab name or certificate number. Match the certificate level to the complexity of tests you are ordering.
- Download the lab’s scope document directly from A2LA, NVLAP, or PJLA. Confirm your exact analyte, method name, standard edition, and sample matrix are listed.
- Check that the accrediting body is a signatory to the Global Accreditation Cooperation mutual recognition arrangement if results need international acceptance.
- For federally regulated testing, cross-reference the SAMHSA certified lab list to confirm the lab’s current certification status.
Pro Tip: Screenshot the registry entry with the date visible. This creates a contemporaneous verification record you can produce during an audit.
What should a compliant lab’s incident reporting process look like?
When something goes wrong in a compliant lab, the response is documented, traceable, and closed out with verified corrective action.
A compliant lab’s nonconforming event management process begins with immediate identification and quarantine of the affected samples or results. The event is logged with a unique identifier, a description of the deviation, and the analyst or process involved. Root cause analysis follows, and a corrective action plan is assigned with an owner and a due date.
Labs must maintain Chemical Hygiene Plans, waste manifests, and documented training tied to SOPs. Corrective actions are verified for effectiveness before the event is closed. Recurring findings trigger a preventive action review. As an employer, ask to see a sample CAPA record during qualification. A lab that cannot produce one has a documentation gap.
What biosafety and safety protocols should a compliant lab follow?
Biosafety level (BSL) classification determines the containment requirements for the biological materials a lab handles. Most drug and alcohol testing laboratories operate at BSL-1 or BSL-2, which covers urine, oral fluid, and blood specimens. BSL-2 labs require restricted access during procedures, face protection, and documented decontamination protocols.
OSHA’s chemical hygiene standard requires a written Chemical Hygiene Plan covering hazard identification, exposure controls, and emergency procedures. Staff must be trained on the CHP before working with hazardous materials, and training records must be retained. Environmental monitoring for temperature, humidity, and ventilation is part of the facility’s ongoing safety program.
How should a compliant lab handle and dispose of hazardous samples?
Specimen disposal is a regulated activity, not an afterthought.
Biological specimens are classified as regulated medical waste under most state rules and must be disposed of through licensed medical waste contractors. Sharps go into puncture-resistant containers. Chemical waste, including reagents and solvents, requires segregation by hazard class and disposal under EPA Resource Conservation and Recovery Act rules. Labs must maintain waste manifests documenting the type, quantity, and disposal method for each waste stream.
Retention periods for samples vary by test type and regulatory program. SAMHSA-regulated specimens have specific retention requirements. After the retention period, disposal must follow the lab’s documented destruction policy, with a record of the destruction date and method.
Key Takeaways
A compliant lab testing program requires verified CLIA registration, a scope-matched ISO/IEC 17025 accreditation, documented chain-of-custody, and ongoing supplier governance, not just a one-time certificate check.
| Point | Details |
|---|---|
| Verify CLIA and ISO scope first | Confirm certificate level and scope document before ordering any test. |
| Request method validation data | Ask for LOD, LOQ, accuracy, and matrix-specific validation for your sample type. |
| Confirm chain-of-custody process | Tamper-evident seals and timestamped handoffs are required for legally admissible results. |
| Schedule annual supplier requalification | Review accreditation scope, PT results, and TAT performance at least once per year. |
| Countrywidetesting as a compliant partner | Countrywidetesting connects employers with SAMHSA, CLIA, ISO, and CAP-compliant lab services for workplace and legal testing. |
The compliance mistake most employers make
Most procurement errors in lab testing come from treating accreditation as a binary: either a lab has it or it doesn’t. The reality is more specific. A lab can hold a valid ISO/IEC 17025 certificate and still be the wrong choice for your test because its scope doesn’t cover your matrix, its PT participation has gaps for your analyte, or its chain-of-custody process doesn’t meet SAMHSA standards for federally regulated programs.
The employers who avoid audit findings and legal challenges are the ones who treat lab selection as a living supplier governance program. They request scope documents annually, not just at onboarding. They track PT results. They run mock CoC audits. They know which tests require confirmatory GC-MS and which rapid screens are sufficient for their policy. That discipline is not complicated, but it does require treating compliance as an operational process rather than a paperwork exercise. A drug testing compliance checklist is a starting point, not a finish line.
Countrywidetesting makes certified lab testing straightforward
Countrywidetesting partners with laboratories that hold SAMHSA certification, CLIA registration, ISO/IEC 17025 accreditation, and CAP accreditation, so you are not left verifying credentials on your own. Whether you need urine drug testing, oral fluid screening, or custom lab panels for a federal or employer program, the platform gives you direct access to certified testing with documented chain-of-custody built in.
Employers and organizations can order lab testing services directly online or request an enterprise quote for volume programs. Every order is processed through accredited partner labs that meet the regulatory standards this guide covers. If you are ready to move from checklist to action, start your order at Countrywidetesting today.
Authoritative registries and primary sources
Use these primary sources to verify any lab’s credentials independently. Never rely solely on documents a lab supplies.
- CMS CLIA Registry: The authoritative source for CLIA certificate status, level, and survey history for all U.S. clinical labs.
- CDC CLIA Program: Background on CLIA regulations, waived testing guidance, and free training resources including the OneLab REACH platform.
- A2LA (a2la.org): Searchable public directory of ISO/IEC 17025 accredited labs with downloadable scope documents.
- NVLAP (nist.gov/nvlap): National Voluntary Laboratory Accreditation Program directory for NVLAP-accredited labs and their scopes.
- PJLA (pjlabs.com): Perry Johnson Laboratory Accreditation public registry for ISO/IEC 17025 scopes.
- SAMHSA Certified Lab List: Required reference for federally regulated workplace drug testing programs.
- CAP (cap.org): College of American Pathologists accreditation search for CAP-accredited laboratories.
- FDA (fda.gov): CLIA test categorization database, GLP guidance, and data integrity expectations under ALCOA+.
- Global Accreditation Cooperation (iaf.nu): Successor to ILAC’s mutual recognition arrangement as of January 2026; confirms whether an accreditation body’s certificates are internationally recognized.
Always check the accreditor’s public register directly. A lab-supplied PDF cannot tell you whether accreditation has lapsed, been suspended, or been narrowed since the document was printed.