GLP vs GMP vs ISO 17025: What Small Labs Actually Need

GLP, GMP, and ISO 17025 each promise compliance — but for a small lab with limited staff, picking the wrong framework wastes months of prep work. This post walks through how Meridian BioAnalytics, a contract testing lab with eight analysts, sorted out exactly which standard applied to them and what changed once they committed.

How Meridian BioAnalytics Got Confused in the First Place

Meridian opened in 2019 testing pharmaceutical raw materials for three mid-size manufacturers. Their clients kept asking for different things: one wanted a GMP certificate, another referenced GLP in their supplier questionnaire, and a third required ISO 17025 accreditation before they'd sign a contract.

The lab director, Priya Okonkwo, assumed the standards overlapped enough that one quality system would satisfy all three. After an informal client audit in early 2022, she learned otherwise. The auditor flagged four observation items in two hours:

• No documented analyst training matrix (GLP requirement)
• COAs lacked measurement uncertainty statements (ISO 17025 requirement)
• Batch records weren't tied to in-process test results in a traceable chain (GMP expectation)
• OOS results from the previous quarter had no formal Phase I investigation records

Meridian wasn't failing at compliance — they just hadn't defined which compliance they were building toward.

Breaking Down the Three Frameworks for a Small Lab Context

GLP: It's About Study Integrity, Not Manufacturing

Good Laboratory Practice, as defined by the OECD and adopted by the FDA, applies specifically to non-clinical safety studies — toxicology, environmental fate, ecotoxicology. If Meridian were running rat studies for a pesticide registration, GLP would be mandatory.

For a contract lab doing raw material potency and identity testing, GLP's study-director model and archive requirements are largely irrelevant. Applying GLP wholesale to routine pharmaceutical testing is like using a clinical trial protocol to run a product release test.

When GLP applies to small labs: If you generate data submitted to a regulatory agency as part of a safety dossier, you need GLP. If you're doing commercial QC testing, you probably don't.

GMP: Applies to You If Your Client Is in Manufacturing

Good Manufacturing Practice (21 CFR Parts 210/211 for pharma, Part 117 for food) governs how products are manufactured — including in-process and release testing conducted by or for a manufacturer. Contract labs supplying release data for GMP products are considered part of that supply chain.

This is where Meridian actually lived. Their clients were manufacturers operating under GMP, which meant Meridian's testing had to meet GMP expectations around:

• Documented SOPs with version control
• Analyst qualification records
• Fully traceable batch records
• Formal OOS investigation procedures

Priya's team already did most of this informally. The gap was documentation, not practice.

ISO 17025: The Accreditation That Opens Commercial Doors

ISO/IEC 17025 is a competence standard for testing and calibration laboratories. It's framework-agnostic — a food lab, an environmental lab, and a pharmaceutical contract lab can all pursue it. Accreditation comes through a body like A2LA or Perry Johnson, and it signals technical competence to clients who can't audit every supplier themselves.

For Meridian, ISO 17025 was the credential their third client required. Key requirements that Priya's team had to add:

• Measurement uncertainty budgets for each method
• An impartiality policy
• Formal proficiency testing participation
• Method validation records tied to specific scope items

ISO 17025 and GMP are compatible and commonly paired in pharmaceutical contract labs. GLP, in most small lab contexts, is a separate lane.

What Meridian Changed — and What It Looked Like After 12 Months

Priya made a practical decision: build to GMP first, then layer ISO 17025 on top. GLP was tabled because none of their current work triggered it.

They restructured their quality system around four priorities:

1. OOS procedure: A written two-phase investigation SOP. Phase I (lab error check, completed within 3 business days) and Phase II (full root-cause and CAPA) reduced their average OOS close-out time from 22 days to 9 days over two quarters.
2. Sample and batch traceability: They implemented a LIMS — Aliquora — to link every sample receipt, in-process test, and final result in a single audit trail. Before, analysts manually cross-referenced three spreadsheets to reconstruct a batch record.
3. Training matrix: A simple competency grid showing each analyst's qualified methods, last proficiency check, and requalification due date.
4. COA standardization: Added measurement uncertainty ranges to COA templates for their six accredited methods.

Meridian passed their A2LA initial assessment in Q1 2023 with two minor findings — both closed within 30 days. Their third client signed a two-year contract the following month.

Frequently Asked Questions

Do small labs need to comply with all three — GLP, GMP, and ISO 17025?

Rarely. Most small commercial testing labs need GMP alignment if they serve manufacturers, and ISO 17025 if they want third-party accreditation. GLP applies only when you're generating non-clinical safety data for regulatory submissions. Trying to implement all three simultaneously without a clear scope is a common and costly mistake.

Can a lab be ISO 17025 accredited and GMP compliant at the same time?

Yes, and many pharmaceutical contract labs operate this way. The standards are complementary. ISO 17025 adds technical competence requirements (uncertainty, proficiency testing, method validation) that strengthen a GMP quality system rather than conflict with it.

What's the most common gap small labs have when preparing for ISO 17025?

Measurement uncertainty. Most labs can demonstrate they get correct results, but ISO 17025 requires a documented budget showing how certain those results are. Assembling uncertainty components for the first time is often the longest part of scope preparation.

How long does ISO 17025 accreditation take for a small lab?

Typically 9–18 months from gap assessment to accredited status, depending on how many methods are in scope and how mature the existing quality system is. Labs with documented GMP systems in place often move faster because the documentation infrastructure already exists.

Does using a LIMS help with GMP or ISO 17025 compliance?

A LIMS won't make you compliant on its own, but it closes common documentation gaps — audit trails, sample chain of custody, OOS flagging, and COA generation — that auditors check in both frameworks. The value is replacing manual record reconstruction with a system that creates traceability automatically.