Chain of Custody for Analytical Samples: The Record ISO/IEC 17025 Expects

A chain-of-custody record is the documented account that a sample was in the physical possession or control of an identified person, or secured against access, at every point from collection to disposal. ASTM D4840 defines chain of custody in exactly those terms 2. ISO/IEC 17025 does not prescribe a form by that name. It requires a procedure for the transportation, receipt, handling, protection, storage, retention and disposal or return of test items; a system of unambiguous identification retained while the item is the laboratory's responsibility; recording of deviations found on receipt; and maintained, monitored and recorded storage conditions where they are specified 1. A custody form is how most laboratories meet those requirements for items that travel.

This page covers the standard and the record. It is not a sender's guide to packing or posting a sample; it describes what the record must show once the sample is moving, whoever is moving it.

What clause 7.4 requires

Clause 7.4.1 protects the interests of both the laboratory and the customer, not only the item 1. That is the reason a custody record carries signatures rather than initials alone: it records who accepted responsibility, which is what either party will need if a result is later disputed.

Custody and integrity are different claims

A complete custody record shows that nobody unaccounted-for had access to the sample. It does not show that the sample arrived in the state it left. That second claim needs evidence of condition — seal state, container integrity, temperature history — recorded at the same hand-offs. ASTM D4840 makes the point directly: custody documentation alone is not sufficient to defend data in a legal or regulatory setting, and it has to sit inside a complete data-defensibility scheme 2.

The hand-offs

Internal transfers are hand-offs. A sample moved from a reception fridge to an analyst's bench and back is a transfer of responsibility, and a gap there is as damaging as a gap in transit. Where a single custodian controls a locked store, the store's access log can stand in for per-withdrawal signatures, provided it identifies the person and the time.

Seals and tamper evidence

No carrier signs a custody form at every hub, so the record needs a different mechanism for transit: a sealed package whose seal state is recorded at closure and again at opening. WHO shipping-container guidance already specifies sealing with packaging or tamper-evident tape and a physical inspection of the container on arrival 3. The custody form borrows the same mechanism and adds the seal number.

Where the consignment is a Category B biological substance, the packing instruction already requires an itemised contents list between the secondary and outer packaging and the name and telephone number of a responsible person 4. The custody form can travel in the same position, in its own sealed pocket, so that the list and the form are reconciled at the same moment on opening.

Identification and sub-division

Clause 7.4.2 requires identification that cannot be confused physically or in records, retained while the item is the laboratory's responsibility, and able to accommodate sub-division and transfer 1. In practice that means a laboratory identifier assigned at reception and cross-referenced to the customer's identifier, never replacing it.

• Label the container body, not only the cap. Caps are swapped.
• Aliquots take the parent identifier with a suffix. The record shows the parent, the number of aliquots and each one's location.
• Never relabel over an existing label. Add, cross-reference, and record why.
• A sample split between two laboratories is two custody chains from the split onward, each referencing the other.
• Retained portions are held under the same identifier and location control as the tested portion.

The form

Rules for completing the form

1. Use permanent ink or an electronic system with an audit trail and individual log-ins.
2. Complete each transfer block at the moment of transfer, by the two people transferring. Never in advance, never afterwards from memory.
3. Record times in 24-hour format and state the time zone where the chain crosses one.
4. Strike unused lines and blank fields so nothing can be added later.
5. Correct by a single line through the entry, leaving it legible, with initials, date and reason.
6. The sender retains a copy at closure; the original travels with the samples.
7. Reconcile the container count and seal numbers at every hand-off. A discrepancy is recorded where it is found, not resolved quietly.
8. File the completed form with the test record, retrievable by both the customer identifier and the laboratory identifier.

Storage, retention and closing the chain

Retention and disposal or return are inside clause 7.4.1, not an afterthought to it 1. The retention period is agreed with the customer when the work is accepted; the storage location sits under the same monitoring as any controlled store; and the chain closes with a disposition entry stating date, method, authority and reason. A chain with no ending cannot show whether a retained portion still exists — which is the first question asked when a result is challenged.

Where chains usually break

• Goods-in signs for a box; nobody signs for its contents until the next day.
• Seal numbers applied but not written on the form.
• A courier collection with no time recorded, so transit duration cannot be established.
• Aliquots made without a record of how many, where they went or who took them.
• A form completed in one sitting at the end of the day.
• An electronic record with a shared log-in, so the person is not identified.

Electronic custody records

An electronic system meets the same requirements as paper if every entry is attributable to one person, time-stamped by the system rather than typed in, and preserved with a history of every change. ISO/IEC 17025 requires that amendments to technical records be traceable to previous versions or original observations, with the original and amended data, the date, the altered aspect and the person responsible all retained 1. That is the property to test before trusting any custody system, whatever else it offers.

Barcode scanning at hand-offs removes transcription error but moves the weak point to the label: a scan proves that a label was present, not that it was on the right container. Hybrid records — a paper form scanned into a system — keep the paper as the original unless the scan has been checked against it and the check recorded.

• Individual log-ins. No shared accounts at goods-in or reception.
• System time-stamps that users cannot edit.
• An audit trail that keeps the original entry alongside every amendment.
• Export to a readable format without the vendor's software.
• Backup and restore tested, with the test recorded.

What the record is for

A custody record earns its keep once, and late: when a result is unexpected and someone asks whether the sample tested was the sample sent, in the state it was sent. A continuous record answers yes or identifies exactly where the answer becomes uncertain. A record with gaps answers neither, and no amount of analytical quality downstream repairs it.