Search results

Home / Search

Category:
Select
Select

11277 results

Guest

Guest

Create New Topic As guest or Sign in

HTML tags are not allowed

Select

Assign topic to the user

  • Changing risk scale in Conformio

    ISO 27001 does not prescribe which scale to be adopted, so we adopted a 1-3 scale to make risk assessment simpler and practical (a 1-5 scale will involve more values and alternatives).

    These articles will help you:

    By the way, the risk assessment process is also explained in this free online training:

  • Management Representative Role

    While AS9100 clause 5.3 does not dictate exactly who is to be appointed the management representative, it does require that it shall be a specific member of the organization’s management, so appointing a non-management person does not meet this requirement. As for Pro’s and Con’s of using a someone who is very low-level management to this position I can’t think of any Pro’s, and the biggest risk is the ability to have the “organizational freedom and unrestricted access to top management to resolve quality management issues” as required by the standard. This would occur if the low-level manager did not have the organizational clout to ensure that managers who are senior to the representative will resolve quality issues to the satisfaction of the quality representative.

    You can read more on the quality management representative in the article: Is the management representative still required in AS9100 Rev D?, https://advisera.com/9100academy/blog/2017/05/22/is-the-management-representative-still-required-in-as9100-rev-d/

  • QA Manual format changes

    Thank you Mark. That's helped clarify the situation completely. Very helpful to understand the context of the QA Manual need outside the framework of the standard

  • Implementation ISO 13485 on making medical materials for medical laboratories

    Yes, clinical chemistry reagents are considered to be in vitro diagnostic medical devices, therefore ISO 13485:2016 is apllicable as quality management standard.  

  • IT Assets Disposal/ Write-Off

    First of all, congratulations on your company’s achievement.

    Regarding the IT assets disposal, you need to evidence that the applied data deletion method has made the previously stored information unrecoverable and that its application was verified and approved by the data owner.

    For example, for a laptop, you can perform full disk encryption two or three times in a row, and at each time encryption is performed you must destroy the related encryption key.

    As a proof for auditors you can develop a "Destructio/Deletion Record" containing the information about the asset, the deletion method aplied, date when the procedure was performed, and the signature of the person responsible for the deleted data, as a confirmation that the procedure was successfull.

    For technical guidance, you should consider these references:
    - ISO/IEC 27040 Information technology — Security techniques — Storage security - https://www.iso.org/obp/ui/#iso:std:iso-iec:27040:ed-1:v1:en
    - NIST 800-88 - Guidelines for Media Sanitization https://csrc.nist.gov/publications/detail/sp/800-88/rev-1/final

  • Risk managment plan

    No, these non-medical devices do not require risk assessment. Of course, you have under the ISO 9001:2015 risk analysis and you can cover any specific risks for these there. 

    More about risk management within ISO 9001 you can find on the following links:

Page 148-vs-13485 of 1128 pages

Didn’t find an answer?

Start a new topic and get direct answers from the Expert Advice Community.

CREATE NEW TOPIC +