How to set up a calibration program, step by step

A calibration program is the documented system that decides which measuring equipment needs calibration, to what accuracy, how often and by whom, how each item’s status is shown, what happens when one fails, and how all of it is recorded. Setting one up comes down to nine steps: define the scope, build a master list, set requirements and risk classes, set intervals and procedures, choose who calibrates, review and release equipment, handle out-of-tolerance results, keep records, and review the program. Software can run parts of it, but software is a tool, not the program.

What a calibration program is

Two primary sources use the term directly. ISO/IEC 17025 requires a laboratory to set up a calibration programme and to revisit and change it whenever that is needed to keep its calibration status trustworthy (clause 6.4.7, as summarized by PJLA and A2LA G149). The US drug CGMP regulations are more specific: instruments, apparatus, gauges and recorders must be calibrated at suitable intervals under an established written program that contains specific directions, schedules, limits for accuracy and precision, and provisions for remedial action, and equipment that does not meet its specifications must not be used (21 CFR 211.160(b)(4)). Automatic, mechanical and electronic equipment, computers included, must also be calibrated, inspected or checked under a written program, with written records (21 CFR 211.68(a)).

ISO 9001 never says “calibration program”, but clause 7.1.5 asks for its parts: fit-for-purpose monitoring and measuring resources with documented evidence, and, when traceability is needed, calibration or verification at specified intervals or before use, status identification, protection against adjustment or damage, and a review of earlier results when equipment is found unfit (ISO 9001 APG guidance; N1286; PJR, ISO9000-WP-9; details and confidence in our ISO 9001 clause 7.1.5 guide). ISO 9001:2026 was published on September 16, 2026; as far as the official change summaries show, it does not change clause 7.1.5 in substance (see the same guide). For medical devices, ISO 13485 clause 7.6 requires documented procedures for controlling monitoring and measuring equipment, and MDSAP auditors accept a general program policy plus more specific procedures for individual equipment (MDSAP Audit Approach, Task 14, p. 108). FDA inspects that clause under the Quality Management System Regulation since February 2, 2026 (21 CFR 820; FDA CP 7382.850).

ISO 10012, the standard for measurement management systems, describes the core of a program in its definition of metrological confirmation: calibration or verification, any adjustment or repair and recalibration, comparison with the equipment’s metrological requirements, and any sealing or labelling (ISO 10012:2026, 3.22). Its 2026 edition is a requirements standard (Quality management — Requirements for measurement management systems), but adopting it is voluntary: ISO 9001 does not require it. Its auditing guidance asks auditors to confirm, as far as appropriate, a metrological confirmation system along the lines of ISO 10012, proportionate to the measurements made; that is guidance for auditors, not an ISO 9001 requirement (APG, Monitoring and measuring resources).

The calibration program at a glance

A program has two parts. Five decisions you make once (and revisit when products, processes or results change), and a cycle that every item goes through at each due date. The equipment record sits underneath both.

The rest of this guide follows the nine steps in order. Each step links to a detailed guide where we have one.

Step 1: Decide what needs calibration

Not every instrument needs calibration. The deciding factor is how it is used. The ISO 9001 auditing guidance gives the example of a pressure gauge that can be a mere indicator, a monitoring resource or a measuring instrument depending on the job it does, and the intended use sets the level of control, including whether it needs calibration or verification at all (APG, Monitoring and measuring resources). NASA’s metrology standard excludes uses where quantitative accuracy doesn’t matter, such as “indication only” or “reference only” equipment, like a fuel or battery gauge (NASA-STD-8739.12A, §1.2.3 and Appendix A).

For each item, ask:

• Is it used to accept or reject product, or to release a batch? In scope.
• Does it protect people, equipment or the environment, or support a regulatory or contractual claim? In scope. NASA’s list of functions that require calibrated equipment is a useful model for your own criteria (NASA-STD-8739.12A, Appendix A).
• Is its reading used to correct or calculate another result? In scope, even if nobody reads it directly. ISO/IEC 17025 names equipment used for corrections (for example, a temperature reading) and for calculations (clause 6.4.6, as summarized by PJLA).
• Does it only show that something is on, running or roughly in range? Usually out of scope. Mark it as such so no one mistakes it for calibrated equipment.

Remember that “measuring equipment” is broader than gauges: it includes software, measurement standards, reference materials and auxiliary apparatus (ISO 9000 definition, quoted in the APG guidance). ISO 13485 makes the starting point explicit: the organization decides what monitoring and measurement it needs to demonstrate conformity, and which equipment it needs for that (clause 7.6; MDSAP Task 13).

Decide now how you treat employee-owned tools and customer or supplier equipment used on your site. If personal tools are used to accept product, they need the same control as company tools.

Step 2: Build the master list and identify every item

The master list (also called the equipment register or gage list) is the first thing auditors ask for, and the backbone of everything else. The most complete free model for its fields is the list of equipment records in ISO/IEC 17025 (clause 6.4.13, summarized by PJLA and A2LA G149): identity including software and firmware version, manufacturer, model and serial number or unique ID, location, calibration dates and results, adjustments, acceptance criteria, due date or interval, maintenance plan, and any damage or repair. The standard doesn’t require all of it to sit in one place. Only labs must follow 17025, but the list works for any program.

Here is one row of a master list for the digital pressure gauge from our example calibration certificate. All values are fictitious.

Identification. Each item needs a unique ID that ties it to its record, and its calibration status must be visible to users. ISO 9001 asks for equipment to be identified so that its status can be determined (clause 7.1.5.2). ISO/IEC 17025 accepts a label, a code or another form of identification, as long as users can readily see the status (clause 6.4.8, as summarized by PJLA). A sticker is the usual answer, but ISO 9001 does not require one (PJR, ISO9000-WP-9). Use status labels for “calibrated”, “limited calibration”, “out of service” and “no calibration required”. Our label generator makes them.

Step 3: Set measurement requirements and classify by risk

A calibration result means nothing until you know what you are comparing it to. For each item, write down the accuracy you need: the tolerance (or maximum permissible error) over the range you use. The drug CGMP rule requires limits for accuracy and precision in the written program (21 CFR 211.160(b)(4)). MDSAP auditors expect accuracy and precision to be defined during planning when they affect the validity of results (MDSAP Task 13, p. 107), and ISO/IEC 17025 requires equipment capable of the accuracy or uncertainty a valid result needs (clause 6.4.5).

Two things to keep in mind:

• The equipment requirement is not the product tolerance. ISO 10012 notes that the metrological requirements for equipment are usually different from the product requirements (ISO 10012:2026, 3.22, note). A gauge used to check a ±0.05 mm feature needs a much smaller error than ±0.05 mm.
• The calibration’s uncertainty has to be small compared with your tolerance. The test uncertainty ratio (TUR) is a quick check. Use our TUR calculator and see measurement uncertainty for the background.

Risk classes turn one program into the right amount of control per item. No free standard defines classes, but classifying measurements by criticality is long-established practice: NASA’s metrology guidelines include a section on measurement classifications (NASA RP-1342, §3.2.3), and ISPE publishes a GAMP good practice guide on risk-based calibration management for the pharmaceutical industry. A simple scheme looks like this. It is an example, not a requirement:

Step 4: Set intervals and write procedures

Intervals. No system standard sets a fixed interval: ISO 9001 and ISO 13485 ask for calibration at specified intervals or before use, and ISO/IEC 17025 for a program that is reviewed and adjusted. A fixed interval applies only when a regulation, contract, product standard or test method sets one. A common starting point is the manufacturer’s recommendation, adjusted with experience and a documented justification (MDSAP Task 13, p. 107). PJLA adds that risk should be considered when choosing intervals (on 17025 clause 6.4.7). ILAC G24 describes the methods for adjusting them. Our calibration intervals guide covers the initial interval, the five ILAC G24 methods and how to defend a change.

Procedures. The written program needs specific directions (21 CFR 211.160(b)(4)). MDSAP auditors accept a general program procedure plus more specific procedures for calibrating and controlling individual equipment (MDSAP Task 14, p. 108). In practice, that means two layers:

1. A program procedure (one document): scope and exclusions, responsibilities, risk classes, how intervals are set and changed, how certificates are reviewed, the out-of-tolerance process, labels, records and software.
2. Calibration procedures for each equipment type: test points, reference standards, environmental conditions, acceptance criteria, what to record. NIST publishes free calibration procedures and good-practice documents for mass, volume and length that are good models (NIST OWM Laboratory Metrology).

See how to write a calibration procedure.

Step 5: Choose who calibrates: in-house, external lab, or both

Whoever does the work, the results must be traceable. ISO 9001 asks for calibration against standards traceable to international or national measurement standards, and, if none exist, a record of the basis used (clause 7.1.5.2 a). Traceability is a property of a result, not of a lab, and “NIST traceable” on a certificate proves nothing on its own: NIST doesn’t certify the traceability of results it didn’t produce (NIST traceability policy).

External labs. The ISO 9001 auditing guidance treats calibration by a lab accredited by an ILAC MRA signatory (now the Global ACI MRA) for that quantity (or by a national metrology institute under the CIPM MRA), with the accreditation symbol on the certificate, as demonstrating traceability, and asks auditors to check that accredited labs are used as far as possible (APG, Measurement Traceability). Requirements tighten by sector:

• Medical devices: when a supplier calibrates, your supplier controls apply, so you must be able to show the work is done competently (ISO 13485 7.6; MDSAP Task 14).
• Automotive: external labs must be accredited to ISO/IEC 17025 by an ILAC MRA signatory (now the Global ACI MRA), with the accreditation body’s mark on the certificate. If no accredited lab exists for the equipment, you need evidence that the lab meets the internal-lab requirements (IATF 16949 clause 7.1.5.3.2; IATF SI 10 and FAQ 14).

Put your requirements on the purchase order: the provider’s capability must cover the range and accuracy of your equipment, and the order should name the standard the provider must meet (a NASA requirement that works anywhere: NASA-STD-8739.12A, §4.4.1). Add what you need for the rest of the program: your tolerance, as-found and as-left data, the decision rule for pass/fail statements (Global ACI-TECH-1-002, formerly ILAC G8), and immediate notice of any out-of-tolerance result.

In-house calibration. Many organizations use a hybrid: reference standards (gauge blocks, master rings, a reference thermometer) are calibrated by an accredited lab, and everyday gauges are calibrated in-house against them. That works when the method, uncertainty and competence are documented. A2LA’s policy for accredited labs that calibrate their own equipment lists what that evidence looks like and is a good model for anyone (A2LA P102; A2LA G149). Under IATF 16949, an internal laboratory needs a defined scope in the quality system (clause 7.1.5.3.1), and in-line measuring and test equipment does not count as an internal laboratory (IATF FAQ 7).

Step 6: Review, release and protect equipment

When equipment comes back, the program decides whether it goes back into use. ISO/IEC 17025 requires equipment to be checked against its requirements before it is first used or goes back into use (clause 6.4.4), and ILAC G24 recommends checking calibration and intermediate-check results against predetermined limits before approving the equipment for further use (§4.10).

1. Review the certificate against your requirements, not only the lab’s “pass”. Our certificate review guide has a field-by-field method and a printable checklist.
2. Apply corrections. If the calibration gives reference values or correction factors, update and apply them wherever they are used (ISO/IEC 17025, 6.4.11).
3. Update the record with dates, results, adjustments, acceptance criteria and the next due date (ISO/IEC 17025, 6.4.13).
4. Label and release.

Between calibrations, the program has to protect the result:

• Protection. Protect equipment from adjustment, damage or wear that would undermine its calibration status (ISO 9001 7.1.5.2 c). Labs must also prevent unintended adjustments and have handling and storage procedures (ISO/IEC 17025 6.4.12 and 6.4.3). Store gauges so they can’t knock against each other, and seal adjustment points.
• Out of service. Pull equipment from use when it has been overloaded or mishandled, gives doubtful results, is defective or is outside its requirements. Isolate it or mark it clearly until it is shown to work, and check the effect on earlier results (ISO/IEC 17025, 6.4.9).
• Intermediate checks. Where confidence needs it, check equipment between calibrations with a defined procedure (ISO/IEC 17025, 6.4.10), and base how often on risk (PJLA). A quick check against a reference before use is the cheapest protection a shop has.

Step 7: Handle out-of-tolerance results

An as-found result outside the tolerance means the instrument may have been giving wrong readings since its last good calibration. Adjusting it fixes the instrument, not your past results. ISO 13485 requires you to assess and record the validity of previous results and to act on the equipment and any affected product, with the effect on product assessed based on risk (clause 7.6; MDSAP Tasks 13–14, pp. 107–108). The drug CGMP rule requires remedial action in the written program (21 CFR 211.160(b)(4)), and ISO 9001 expects a similar review when equipment is found unfit (clause 7.1.5.2).

The program procedure should define who opens the assessment, how far back to look, how you trace where the item was used, and how the result feeds back into the interval. Our out-of-tolerance guide walks through the seven steps with a worked example.

Step 8: Keep records: spreadsheet or calibration software?

What to keep. ISO 9001 requires documented information as evidence that monitoring and measuring resources are fit for purpose (clause 7.1.5.1; N1286). The drug CGMP rule requires written records of calibration checks and inspections (21 CFR 211.68(a)). Use the ISO/IEC 17025 equipment-record fields from step 2 as your template. How long to keep them depends on your quality system, regulations and customers; no general figure applies to every sector. See calibration records and logs for what each record should contain.

Spreadsheet or software? Both can run a program. A spreadsheet works for a small inventory if it is controlled: one owner, protected cells, a change log, backups, and certificates filed by asset ID. Software starts to pay off when you need automatic recall notices, an audit trail, many users or sites, or links between each item, its certificates and the work it was used on. Whichever you choose, check these regulatory points:

• Medical devices: software used in the quality system, commercial software included, must be validated for its intended use, with predetermined acceptance criteria. For off-the-shelf software you don’t need to review code, but you must confirm it does what you need (ISO 13485 4.1.6 and 7.6; MDSAP Task 15, p. 109).
• FDA-regulated records: 21 CFR Part 11 applies to records in electronic form that FDA regulations require you to keep (§11.1(b)). Calibration records required by Part 211 or the QMSR, kept in software, fall in its scope.
• Drug manufacturing: computer systems need controls so only authorized people change records, with input and output checks and backups (21 CFR 211.68(b)).
• ISO 9001 has no explicit software-validation requirement, although your records must still be reliable.

Our comparison of calibration management software covers what to look for, including free options.

Step 9: Review and improve the program

ISO/IEC 17025 requires the calibration program to be reviewed and adjusted as needed (clause 6.4.7). Name one person who owns the program, define who may calibrate, review and release equipment, and keep training records for them. ISO/IEC 17025 has personnel requirements (clause 6.2) that A2LA applies to in-house calibrations (A2LA G149).

Review the program at least once a year with data:

• End-of-period reliability (EOPR): the share of items found in tolerance at calibration. NASA accepts an observed EOPR of 92–95 % or higher, depending on how many like calibrations it is based on, as one way to show that false-accept risk stays within the 2 % limit of ANSI/NCSL Z540.3 (NASA-STD-8739.12A, §4.3, Table 1). Whatever target you choose, a low in-tolerance rate for an equipment type points to intervals that are too long (see calibration intervals).
• Overdue items, out-of-tolerance rate, turnaround time and open impact assessments are common program metrics. Set your own targets: no standard gives one.
• Changes: new products, tighter tolerances, new sites or new customer requirements may move items between risk classes.

What each standard requires

Requirements differ by sector. For paid standards we describe requirements in our own words, based on the free guidance cited. Detailed pages: ISO 9001 7.1.5, ISO/IEC 17025, ISO 10012.

Inherited a messy program? Start here

Taking over a paper-based program with gaps a few weeks before an audit is a common situation. Don’t try to fix everything at once. Work in this order, so the measurements that matter most are covered first:

1. 1

   Find everything

   Walk the site and collect every measuring device, including personal tools, spares in drawers and equipment at suppliers. List what you find, even without records.

2. 2

   Decide the scope of each item

   Use the step 1 questions. Label indication-only items so they stop looking like calibrated equipment.

3. 3

   Give everything an ID and a row in the master list

   One unique ID per item, linked to whatever records already exist.

4. 4

   Triage by risk

   Items that accept product but are overdue or have no traceable record come first: calibrate them or take them out of use.

   Overdue and used on product: calibrate now; if found out of tolerance, assess the impact

5. 5

   Get your reference standards calibrated

   Gauge blocks, masters and reference instruments go to an accredited lab first, because every in-house calibration depends on them.

6. 6

   Write the program procedure

   A short document: scope, responsibilities, risk classes, intervals, certificate review, out-of-tolerance, labels, records. Then the calibration procedures for your main equipment types.

7. 7

   Set intervals and a schedule

   Start from manufacturer recommendations. Spread due dates across the year so the workload and downtime stay manageable.

8. 8

   Run the first cycle, then review

   Review every certificate, label every item, and after a year use the as-found data to adjust intervals.

Then check the program against this list before the audit:

Common myths

In this section

• Calibration intervals: how often to calibrate

  No standard says 12 months. How to set an initial calibration interval, adjust it with the five ILAC G24 methods and a reliability target (EOPR), and defend it to an auditor.

• How to write a calibration procedure (with an example and template)

  What a calibration procedure must contain, section by section: scope, reference standards, test points, acceptance criteria, as-found and as-left, environment, uncertainty and ISO/IEC 17025 method validation. With an annotated example and a printable checklist.

• How to read and review a calibration certificate

  A field-by-field guide to calibration certificates, with an annotated example, how to judge uncertainty and pass/fail statements, red flags, and a printable review checklist.

• Out of tolerance: what to do when a calibration fails

  A step-by-step out-of-tolerance impact assessment: confirm the result, set the look-back window, correct past readings, decide on product, with an example report and template.

• Calibration records: what to keep, how long, and a free template

  What a calibration record must contain, how it differs from a certificate and a master list, how long to keep it under each standard, with an annotated example and a printable template.