ISO 35001 Biorisk Management for Laboratories: What the Standard Requires of a Canadian Lab

Quick facts

• ISO 35001:2019 is a management system standard for laboratories and other organisations that work with, store, transport or dispose of hazardous biological materials. It defines a process to identify, assess, control and monitor biorisk rather than a set of bench procedures.
• Clause 2 of the standard reads, in full, that there are no normative references. ISO 35001 therefore does not incorporate the Canadian Biosafety Standard, the Human Pathogens and Toxins Act or any provincial instrument — the mapping between the management system and those requirements is work the facility does.
• The standard excludes laboratories that test for microorganisms or toxins in food or feedstuffs, and it excludes agricultural risk from genetically modified crops. A food microbiology laboratory, or a diagnostic laboratory running a food-and-feed panel, sits outside its scope.
• In Canada the binding requirements live in the Human Pathogens and Toxins Act and its regulations for human pathogens, and in the Health of Animals Act and regulations for terrestrial animal pathogens, with the Canadian Biosafety Standard, third edition, 2022 as the national facility standard.

Two documents describe the same laboratory and they are not interchangeable. One is a law with a licence attached to it, supported by a national standard that specifies what a containment zone must physically be and what a facility must operationally do. The other is an international management system standard that a laboratory can voluntarily adopt, integrate with its existing quality system, and be audited against. ISO 35001:2019 is the second of the two.

That difference is the reason a laboratory can hold a licence and still fail an internal review. The licence follows the legal requirements; the management system is what produces the evidence that those requirements are being met on an ordinary Tuesday, when the person who usually does the check is away. This article reads ISO 35001:2019 clause by clause, maps it against the Canadian regulatory structure a licensed laboratory already sits inside, and marks the clauses where Canadian laboratories most often have no paper.

What does ISO 35001:2019 cover, and what does it leave out?

The scope states that the document defines a process to identify, assess, control and monitor the risks associated with hazardous biological materials, and that it is applicable to any laboratory or other organization that works with, stores, transports and/or disposes of hazardous biological materials. It is intended to complement existing International Standards for laboratories. Two exclusions are stated directly: the document is not intended for laboratories that test for the presence of microorganisms and toxins in food or feedstuffs, and it is not intended for the management of risks from the use of genetically modified crops in agriculture.

The standard was prepared by ISO technical committee 212, the committee for clinical laboratory testing and in vitro diagnostic test systems, which is why its vocabulary and structure track clinical laboratory practice. Clause 2 contains no normative references at all, so there is no incorporated annex of external documents to read alongside it — unusual, and useful, because it means the standard cannot be accidentally read as a substitute for a national standard that does carry legal force.

The vocabulary in Clause 3 is where a laboratory finds out whether it is in scope. A biological agent is defined as any microbiological entity, cellular or non-cellular, naturally occurring or engineered, capable of replication or of transferring genetic material that may be able to provoke infection, allergy, toxicity or other adverse effects in humans, animals or plants, with bacteria, fungi, viruses, viroids and endo- and ectoparasites given as examples. Two notes broaden that definition considerably: for the purpose of the standard prions are regarded as biological agents, and the term engineered includes biological agents that are synthetically derived. Biological materials are defined as any material comprised of, containing, or that may contain biological agents and/or their harmful products such as toxins and allergens, with human or animal blood, secretions and tissues named, along with culture and preservation media and cell cultures. A toxin is defined as a substance produced by plants, animals, protists, fungi, bacteria or viruses which, in small or moderate amounts, produces an adverse effect in humans, animals or plants.

The consequence for a diagnostic laboratory is that the standard's reach is broader than a pathogen list. A procedure that produces a harmful product, a stored cell line, a preserved specimen and a sample that merely may contain a biological agent are all inside the definition.

How does the management system model work?

The introduction describes the system rather than the requirements. It states that the biorisk management system establishes the biorisk management principles that enable laboratories and related facilities to achieve their biosafety and biosecurity objectives; that it defines the essential components of a biorisk management system framework to be integrated into a laboratory's overall governance, strategy and planning, management, reporting processes, policies, values and culture; that it describes a comprehensive biorisk management process that mitigates biorisks, defined as biosafety and biosecurity risks; and that it provides guidance on implementation and use.

The model itself is Plan-Do-Check-Act, applied to the system and to each of its elements. The standard states that the system is built on the concept of continual improvement through a cycle of planning, implementing, reviewing and improving the processes and actions an organisation undertakes to meet its goals, and it gives the four steps explicitly: establish objectives, programmes and processes necessary to deliver results in accordance with the biorisk management policy; implement the processes as planned; monitor and measure activities and processes against the policy and objectives and report the results; and take actions to continually improve biorisk management performance. A note records that Figure 1 is adapted from ISO 45001, the occupational health and safety management system standard, which is a useful signal about how much of the internal audit, management review, corrective action and document control machinery a laboratory can carry over if it already runs a certified safety or quality system.

Part of ISO 35001:2019	Clause	What it asks a laboratory to do
Context of the organization	4.1 to 4.4	Understand the organization and its context, the needs and expectations of interested parties, and set the scope of the biorisk management system
Leadership	5.1 to 5.3	Commitment at the highest level, a policy, and assigned roles: executive management, senior management, a biorisk management committee, a biorisk management advisor, and scientific management
Planning	6.1 to 6.2	Identify and analyse hazards and threats, assess risk, mitigate risk, evaluate performance, and set objectives with a plan to reach them
Support	7.1 to 7.8	Resources and a worker health programme, competence and personnel reliability, awareness and training, communication, documented information and information security, non-employees, personal security, control of suppliers
Operation	8.1 to 8.10	Operational planning and control, commissioning and decommissioning, maintenance and calibration, physical security, biological materials inventory, good microbiological technique, clothing and personal protective equipment, decontamination and waste management, emergency response, transport of biological materials
Performance evaluation	9.1 to 9.3	Monitoring, measurement, analysis and evaluation; internal audit; management review
Improvement	10.1 to 10.3	Incident, nonconformity and corrective action; continual improvement

How does each clause map onto the Canadian regulatory structure?

A Canadian laboratory handling regulated human pathogens or toxins does not start from ISO 35001. It starts from the Human Pathogens and Toxins Act and the Human Pathogens and Toxins Regulations, which together establish a licensing regime for activities with Risk Group 2, 3 and 4 human pathogens and toxins, and from the Canadian Biosafety Standard, third edition, published by the Public Health Agency of Canada in November 2022, which is the national standard for facilities where regulated human and terrestrial animal pathogens and toxins are handled or stored. Terrestrial animal pathogens and the importation of animal pathogens are regulated jointly with the Canadian Food Inspection Agency under the Health of Animals Act and its regulations.

The standard's own structure is a matrix, and it is worth naming what each section holds because the mapping below depends on it:

Section of the Canadian Biosafety Standard	What it holds
3. Physical containment requirements	3.1 containment barrier, 3.2 access, 3.3 surface finishes and casework, 3.4 air handling, 3.5 facility and services, 3.6 essential biosafety equipment, 3.7 effluent decontamination systems
4. Operational practice requirements	4.1 biosafety program management, 4.2 training program, 4.3 personal protective equipment, 4.4 entry and exit, 4.5 work practices, 4.6 animal work considerations, 4.7 decontamination and waste management, 4.8 emergency response, 4.9 records and documentation
5. Performance and verification testing requirements	5.1 tests for all containment zones, 5.2 additional tests for select zones, 5.3 tests during commissioning and at specified intervals

Set beside that, ISO 35001 clause by clause produces a mapping that shows where the standard adds something the Canadian requirements do not specify, and where it adds nothing at all.

ISO 35001:2019 clause	Canadian instrument or CBS section that already covers it	What ISO 35001 adds
4.1 Understanding the organization and its context	Implicit in the licence application, which requires the applicant to describe activities and materials	A documented statement of context and interested parties, reviewed rather than written once
4.2 Needs and expectations of interested parties	Regulator, public health unit, ethics board, client laboratories	A defined list, so that obligations from each are tracked rather than remembered
5.3.4 Biorisk management advisor	CBS operational and biosafety program requirements; the biological safety officer role in Canadian practice	A named role with defined authority, distinct from the scientific lead
5.3.3 Biorisk management committee	Biosafety program management requirements	A standing committee with terms of reference, rather than an ad hoc meeting after an incident
6.1.1 Hazard and threat identification and analysis	Local risk assessment and the published pathogen risk assessments	A repeatable method for identifying hazards and threats, including the biosecurity threat side
6.1.2 Risk assessment	Local risk assessment	Documented methodology, criteria and review triggers
6.1.3 Risk mitigation	Containment and operational practice requirements	A documented link from each identified risk to the control that addresses it
6.1.4 Performance evaluation	Performance and verification testing	Evaluation of whether the controls actually work in operation, not only at commissioning
6.2 Biorisk management objectives and planning	Not specified as objectives	Measurable objectives with owners and dates
7.1.1 Worker health programme	Occupational health and provincial employment obligations	A defined programme linked to the biological agents in use
7.2.1 Behavioural factors and worker management	Training programme requirements	Human-factor and behavioural considerations written into competence
7.2.2 Personnel reliability measures	Biosecurity requirements for work with security sensitive biological agents	A defined reliability programme for all personnel with access, scaled to risk
7.3.1 Training	Training programme requirements	Competence assessment with records tied to task, not attendance
7.4 Communication	Internal and external reporting expectations	A defined internal and external communication plan
7.5 Documented information, 7.5.4 Information security	Records and documentation requirements; biosecurity requirements	Document control, version control and information security treated as one system
7.6 Non-employees	Visitor and contractor provisions	Contractors, students and visiting researchers inside the same competence and access rules
7.7 Personal security	Biosecurity and physical security requirements	Personnel security as a managed programme
7.8 Control of suppliers	Not specified	Supplier qualification for services and materials that affect containment
8.1 Operational planning and control	Work practices	Written criteria for what may proceed and what must stop
8.2 Commissioning and decommissioning	Commissioning and verification testing	A controlled decommissioning process, which is where laboratories have the least paper
8.3 Maintenance, control, calibration, certification and validation	Facility and equipment requirements; performance testing	Equipment criticality and calibration as one register
8.4 Physical security	Biosecurity and physical security requirements	Security as a performance-evaluated control
8.5 Biological materials inventory	Inventory and security sensitive biological agent requirements	Inventory as a live system with reconciliation
8.6 Good microbiological technique	Work practices	Technique defined as a competence, assessed rather than assumed
8.7 Clothing and personal protective equipment	Personal protective equipment requirements	Selection and use tied to the risk assessment
8.8 Decontamination and waste management	Decontamination and waste management requirements	Validation and records for the decontamination process itself
8.9 Emergency response and contingency planning	Emergency response requirements	Emergency scenarios, plan training, exercises and simulations, and contingency plans as four separate obligations
8.10 Transport of biological materials	Transport provisions	Transport security as a named sub-clause alongside transport compliance
9.1 to 9.3 Performance evaluation	Performance and verification testing	Internal audit and management review, which are the two mechanisms that keep a licence defensible between inspections
10.1 to 10.3 Improvement	Incident reporting obligations	Structured corrective action and a definition of continual improvement

The two clauses in that table with the thinnest paper in most Canadian laboratories are both in Section 9. A licence review asks whether the facility meets the standard; an internal audit asks whether the facility's own processes would have caught the problem first, and a management review asks whether someone with authority looked at the audit result and decided something. Neither is specified in the Canadian requirements in the form ISO 35001 requires, and both are what a laboratory reaches for when it has to explain an incident that a routine check could have found.

Where do ISO 35001 and Canadian biosecurity meet on personnel?

Clause 7 is the support clause, and three of its sub-clauses sit closer to Canadian biosecurity practice than the rest of the standard does. Clause 7.2.2 covers personnel reliability measures; Clause 7.7 covers personal security; and Clause 7.8 covers control of suppliers. In the Canadian framework these sit under the biosecurity half of the same problem the biosafety requirements address from the containment side, and the standard's own phrasing makes the split explicit in its introduction by defining biorisks as biosafety and biosecurity risks together.

For a diagnostic laboratory the practical consequence is that personnel reliability is not a hiring screen that happens once. Clause 7.2.1 puts behavioural factors and worker management inside competence, and Clause 7.2.2 asks for reliability measures as a defined programme. In a laboratory where access to a containment zone is granted to rotating staff, locums and visiting researchers, those two clauses are what turn an access list into an access decision.

Clause 7.6, non-employees, closes the same gap from the other side. Students, contractors, equipment service engineers and auditors who enter a containment zone are covered by whatever the facility has written down, and the standard's definition of a worker deliberately includes people performing work under various arrangements, paid or unpaid, regularly or temporarily, intermittently or seasonally, casually or on a part-time basis.

Which operations clauses carry the most weight in a licensed laboratory?

Section 8 holds ten clauses, and four of them map onto activities that carry inspections attached.

Clause 8.5, biological materials inventory, is the clause a laboratory discovers it has failed only when someone asks a specific question: how many vials, where, and who signed for the last movement. An inventory that exists as a spreadsheet updated monthly is a description of what the facility believed at the start of the month. The Canadian framework drives this from the biosecurity side, which is why inventory is one of the places where the management system and the regulatory requirement point at exactly the same artefact.

Clause 8.8, decontamination and waste management, is where a laboratory's sterilization and decontamination practice meets a records obligation. The requirement is not only that waste is decontaminated before disposal, but that the process is controlled and its results recorded. A laboratory that has adopted a validation and record-keeping routine for its waste inactivation can evidence Clause 8.8 with documents it already keeps, and the sequence is set out in how to validate laboratory waste inactivation before disposal, with the record fields in a laboratory waste inactivation records checklist.

Clause 8.10, transport of biological materials, is short and has a sub-clause on transport security of its own. The clause is named for transport of biological materials, and its sub-clause 8.10.1 is transport security — a distinction that matters when material leaves the containment zone in a vehicle rather than a courier's hands. The consumable side of that clause is the packaging sitting at the bench: a specimen bag rated to the pressure differential the transport regulations assume, with the absorbent layer that keeps a leak inside the bag rather than inside the box.

Clause 8.9, emergency response and contingency planning, is the most granular clause in the standard. It separates emergency scenarios, emergency plan training, emergency exercises and simulations, and contingency plans into four obligations. A facility with a plan document and no exercise record has satisfied one of the four.

Related reading

The regulatory split between federal instruments and professional or provincial rules is set out in who regulates sterilization monitoring, federal or provincial rules; the retention side of Clause 7.5 is covered in how long a Canadian clinic must keep sterilization records; the general management system model that ISO 35001 borrows appears in ISO 14937 and the general framework for a sterilization process; and the assurance concept behind every decontamination claim is explained in what a sterility assurance level of 10⁻⁶ means.

For the transport and containment side of Clause 8, the consumables a licensed laboratory keeps in stock are straightforward: UN3373 95 kPa specimen transport bags in the 6×9 inch size for routine submissions, a 12×15 inch UN3373 bag where bagged specimens and documentation travel together, an enzyme cleaning solution concentrate for instrument and glassware decontamination before it is validated, and sterile 100 × 15 mm petri dishes by the case for the bench work the inventory clause tracks. The laboratory consumables and sterilization supplies page gathers the lines a diagnostic laboratory orders repeatedly, and laboratories buying for more than one site can open a wholesale account for institutional pricing. If the monitoring side has to be demonstrated before a decontamination routine is signed off, the five-pack biological indicator trial is the smallest way to run that evidence.

Frequently Asked Questions

Is ISO 35001:2019 mandatory in Canada?

No. It is an international management system standard that a laboratory adopts voluntarily. What is mandatory in Canada is the licensing and containment regime for regulated human and terrestrial animal pathogens and toxins under the Human Pathogens and Toxins Act and its regulations, with the Canadian Biosafety Standard, third edition, 2022 as the national facility standard. ISO 35001 is the framework a laboratory can use to organise the evidence that those requirements are being met between inspections.

Does ISO 35001 replace the Canadian Biosafety Standard?

No, and the standard itself makes that impossible. Clause 2 of ISO 35001:2019 states that there are no normative references in the document, so nothing in the Canadian regime is incorporated into it. The two sit in different layers: the Canadian Biosafety Standard says what a facility must be and do, and ISO 35001 says how a facility organises, audits and improves the system that delivers it.

Does ISO 35001 apply to a diagnostic laboratory?

It applies to any laboratory or other organization that works with, stores, transports and/or disposes of hazardous biological materials, and its definitions of biological agent and biological materials are broad enough to capture cell cultures, culture and preservation media, human and animal blood, secretions and tissues, and prions. Two sectors are excluded by the scope: laboratories that test for microorganisms or toxins in food or feedstuffs, and the management of risks from genetically modified crops in agriculture.

What is the difference between biosafety and biosecurity under this standard?

The standard's introduction defines biorisks as biosafety and biosecurity risks and says the management system mitigates both, and its clause structure then splits the work: containment, work practice and decontamination obligations sit alongside clauses on personnel reliability, personal security, physical security, biological materials inventory and information security. A laboratory that has addressed only the containment half has addressed roughly half of the clauses in Sections 5 to 8.

How long does a laboratory need to keep biorisk records?

ISO 35001 does not set a retention period. Clause 7.5 requires documented information to be created, updated and controlled, and Clause 7.5.4 adds information security, but the number of years comes from the applicable national and provincial instruments and from the laboratory's own quality obligations. In Canadian clinical settings retention expectations run into years rather than months, and a laboratory setting its own period should be able to point to the instrument it followed.

Which ISO 35001 clause is most often undocumented in practice?

Clause 8.2, commissioning and decommissioning. Commissioning arrives with the facility project and is well documented because it has to be verified, while decommissioning happens years later, usually during a relocation or a change of premises, and is frequently handled as a facilities project rather than as a biorisk event. The clause also belongs to the group — 8.2, 8.3 and 6.1.3 together — that a laboratory needs when a containment zone changes, which is the moment a licence most often has to be re-justified.

Does ISO 35001 set requirements for the containment level of a laboratory?

No. The standard defines a management process and leaves the technical containment requirements to national and international instruments. Containment level, physical containment requirements, performance and verification testing intervals and effluent decontamination expectations come from the Canadian Biosafety Standard, and the standard's own clause on commissioning and decommissioning is about controlling the process, not about specifying the facility.

CliniEco Medical holds MDEL #35334.

Sources

1. ISO 35001:2019 — Biorisk management for laboratories and other related organisations, preview showing the foreword, introduction, scope, clause list and terms (PDF)
2. iTeh Standards catalogue record for ISO 35001:2019, including the reference to ISO/TC 212
3. ISO — ISO 35001:2019, a process to identify, assess, control and monitor risks associated with hazardous biological materials
4. Public Health Agency of Canada — Canadian Biosafety Standard, third edition, 2022, containing the physical containment, operational practice and performance and verification testing requirements
5. Public Health Agency of Canada — Canadian Biosafety Standards and Guidelines, the national framework for handling and containment of regulated pathogens and toxins
6. Public Health Agency of Canada — Canadian Biosafety Handbook, second edition, the companion guidance document to the biosafety standard
7. Human Pathogens and Toxins Act, S.C. 2009, c. 24 — full text
8. Human Pathogens and Toxins Regulations, SOR/2015-44 — full text
9. Medical Devices Regulations, SOR/98-282 — full text, including the device classification rules in Schedule 1
10. Public Health Agency of Canada — laboratory biosafety and biosecurity programme pages
11. Public Health Ontario / PIDAC — provincial guidance on cleaning, disinfection and sterilization of medical equipment and devices, 3rd edition, 2013 (PDF)
12. RCDSO — Standard of Practice: Infection Prevention and Control in the Dental Office, v3 (PDF)
13. CDC — Guideline for Disinfection and Sterilization in Healthcare Facilities, 2008
14. CSA Group — Z314.8, Decontamination of reusable medical devices
15. CliniEco Medical — laboratory consumables and sterilization supplies
16. CliniEco Medical — UN3373 95 kPa specimen transport bags, 6×9 inch, 100-pack
17. CliniEco Medical — five-pack biological indicator trial