Search results

AS 9100 Certification Body

A certification body is an independent third-party organization that will audit your management system for the purposes of “certifying” that your QMS meets all of the requirements of a standard, such as AS9100 (however, any management system can be certified). Certification bodies differ around the world, and are accredited by what is called an accreditation body who will ensure that they are following appropriate management system audit processes.

AS I can’t really tell you for your location in the world who to choose, I would suggest searching what your national accreditation body is, then on their website they will have a listing of the certification bodies that they approve. From here you can determine which ones can certify for AS9100. Then, it is best to interview several certification bodies to find one that is best suited for your particular organization and type of aerospace industry.

When you interview some certification bodies you can use our checklist to make sure that you choose one that will best help your organization. You can find it here:  List of questions to ask an AS9100 Rev D certification body, https://info.advisera.com/9100academy/free-download/list-of-questions-to-ask-an-as9100-certification-body

Compliance review

To look for if a company is certified, you can ask it who its certification body is, and its certification number, so you can verify if the certification is in good standing.

Regarding the evaluation of its security posture, you can ask for its Statement of Applicability (which contains information about applied controls), and the latest performed certification body’s audit report (which will inform the results of the latest audit performed by the certification body).

Please note that, unless you have a contract with this company ensuring the release of the SoA and audit report, the release of these documents is a decision of the company (in this case, if they decide to release the documents, they probably will require the signing of a Nondisclosure Agreement with your company).

This article will provide you a further explanation about the Statement of Applicability:

• The importance of Statement of Applicability for ISO 27001 https://advisera.com/27001academy/knowledgebase/the-importance-of-statement-of-applicability-for-iso-27001/

Knowledge management (7.1.6)

I recommend thinking about clause 7.1.6 together with clauses 5.3 and 7.2.

Start with clause 5.3, determine which functions are relevant for your quality management system (QMS). Then, for each function determine its authorities and responsibilities.

Now, go to clause 7.2 (immediately after 7.1.6), and for each relevant function of your QMS determine if there are any competence gaps. How can you determine competence gaps? Before evaluating competence, you must determine what is required in terms of organizational knowledge for each function to perform authorities and responsibilities properly.

So, for the first part of clause 7.1.6 that is how I work, determine the knowledge required to perform a particular relevant function and include that in the job description. For example, if your organization starts onboarding a new employee what kind of training and experience must be provided to operate competently? For example, that new employee must learn to work with the company’s software, must learn company’s products codes and references, …

For the second part of clause 7.1.6 I invite you to see this answer that I wrote that also include links to articles about this topic - https://community.advisera.com/topic/iso-9001-organizational-knowledge/

Nonconformance vs Nonconformity

You are right ISO 9000:2015 does not provide a specific definition for the term "nonconformance" in its standards. However, it uses related terms like "nonconformity" and "conformity" in ISO 9001 and other quality management standards.
 
While these terms are often used interchangeably, a nonconformity is a more precise term and is the one formally used in ISO 9001 to describe instances of noncompliance with the standard's requirements. Nonconformance, on the other hand, is a broader term that can encompass various types of failures to meet quality criteria. Many times people use them to differentiate a nonconformity according to clause 8.7 from a nonconformity according to clause 10.2.

If you search the word “nonconformance” in this site, you will see that it is used very commonly by those asking questions.

Use of Correction Fluid

I have no experience in the microfinance industry, but I know of several industries, like the pharmaceutical, where correction fluid is forbidden.

Where do we use correction fluid? To correct a mistake in something written in a form, for example. But someone can also use correction fluid to change some correct information and introduce a lie. So, correction fluid can erode the quality of the information that resides in a record, something that we assume to be a faithful photograph of the reality that happened can become false.

Now, let us go to ISO 9001:2015 clause 7.5.3.1 b) and to that protected from loss of integrity. The use of correction fluid may put in question the integrity of information recorded, and records are the memory of an organization.

Combining the ISO 27001 policies into one manual

Although it is acceptable by the standard to combine all of the ISO27001 documents into one manual handbook, in most cases, it is not a good idea, because if you put all the policies and procedures into a single document this will make the reading of such a document very difficult.

Regarding version control and review, they would be performed the same way if documents are separately documented, but updated information will be consolidated in a single document.

This article will provide you a further explanation about ISMS Manual:

• Is the ISO 27001 Manual really necessary? https://advisera.com/27001academy/blog/2014/02/03/is-the-iso-27001-manual-really-necessary/

This material will also help you regarding ISMS documentation:

• Managing ISO Documentation: A Plain English Guide https://advisera.com/books/managing-iso-documentation-plain-english-guide/

Identifying Opportunities in Lab

A key requirement in a laboratory management system is to setup process to monitor and track opportunities for improvement.  These opportunities can come from a number of sources – have a look at the note in ISO 17025 17025 clause 8.6. These include

Evaluation of External and internal quality control trends, i.e analysis of data. For example, introducing another control standard.Evalauting risks and noncoforming events and in cases. For example where a risk is accepted ther may still be practical changes that could be introduced that may reduce the risk, although not essesntial.  Meaning simple to implement changes.Customer and personnel feedback. 

Use an Opportunity Register to record your evaluation of and decision to implement improvement.

For more information regarding  actions to address risks and opportunities, see the ISO 17025 toolkit document template: Addressing Risks and Opportunities Procedure