ISO 22367:2026—Risk Management in the Medical Laboratory
The CAP has 30 liaisons to various organizations who attend scientific meetings or designate others to do so. They report to the Standards Committee, which reports to the Council on Scientific Affairs. We periodically publish bits of what the CAP’s outbound liaisons hear and see in their liaison roles.
William J. Castellani, MD
August 2026—The CAP introduced in its 2025 accreditation checklist edition GEN.20315 Risk Management, which says the laboratory’s quality management system uses a prospective risk management process. That process includes identification, control, and monitoring of risks throughout the laboratory.
As laboratories consider what approach to take to comply with the new GEN.20315 requirement, the revised ISO 22367:2026 standard would be a useful resource. This revision of the first edition of the document was based on specific risks identified in the ISO 15189:2022 standard, which parallel requirements in the CAP checklists and is equally applicable to the checklist requirements. The prior edition of ISO 22367, from 2020, was explained in a “Shorts on Standards” published in CAP TODAY in May 2020 (https://bit.ly/CT_0520-SoS). The focus here is what the revision has addressed based on the current consideration of how medical laboratories can address risks.
The important concept in the standard is that risk is based on the potential for harm. Although a major focus is harm to the patient, the standard also applies to harm to employees, caregivers, and the organization. Recognition is given not only to the limitations of addressing harm, especially through risk-benefit assessment, but also how mitigating one risk might increase the likelihood of other risks.
Current recognition is that preventive action can and should be dealt with by risk management. What this standard does is recognize that risk management can be approached in three ways: prospective risk management, management of foreseeable risks, and reactive risk management. Prospective risk management is structured and anticipatory, lending itself to preventive action. Reactive risk management is immediate and corrective, and it may lead to further evaluation using the prospective model if felt necessary. Foreseeable risks represent known issues that can and will arise and need to be addressed according to the specific situation that the instance represents; it provides guidance for reacting to these known risks when they arise. These approaches are described further in the document with extensive, informative appendices (annexes) to provide guidance for using the risk management concepts in this document.
To quote from the introduction of ISO 22367:2026, “While this document is intended for use throughout the currently recognized medical laboratory disciplines, it can effectively be applied to other healthcare services. . . . The use of this document facilitates cooperation between medical laboratories and other healthcare services, assists in the exchange of information, and in the harmonization of methods and procedures.”
Dr. Castellani, formerly of Penn State Hershey College of Medicine, is a member of the CAP ISO 15189 Committee. He was the CAP liaison to the ISO workgroup responsible for the ISO 22367 document and was project leader for its revision.