Search results

Home / Search

Category:
Select
Select

11293 results

Guest

Guest

Create New Topic As guest or Sign in

HTML tags are not allowed

Select

Assign topic to the user

  • Controls a.15.10.2 and a.13.2.4

    In case the NDA identified in the SLA you have with your provider fulfills all your needs (you should confirm that with a legal expert, based on the results of risks assessment and applicable legal requirements), and is regularly reviewed, then this situation is compliant with requirements of control A.13.2.4 - Confidentiality or nondisclosure agreements.

    Regarding control A.15.1.2 – the identification of the NDA in the SLA provided by the supplier is acceptable, but please note that you also need to verify if other relevant risks related to this supplier are also covered by security clauses in the SLA.

    These articles will provide you a further explanation about supplier management:

    These materials will also help you regarding supplier management:

  • Lead Auditor Certification

    You should ask this information from the certification body with who you plan to work with because it is the certification body that plans the audits you will be included in (e.g., you may be included in three audits in sequence or one audit per month, etc.). In general, a single certification audit may last between 3 to 5 days, depending on the size and complexity of the scope.  

    For further information, see:

  • Data Protection for clients

    The data protection policy is an internal document that shows how the company deals with personal data and it is not published in contracts, so maybe you are referring to clauses on data protection in your contracts (yes, you should have) or to a data protection agreement as an annex to contracts signed with clients or suppliers (it is required if the contract involve the transfer of data between the two subject). The privacy policy on the website, usually, describes how personal data collected through the website are processed, it may involve also data processing made by the company with personal data of clients (i.e., there is an online shop).Of course, if your privacy policy on the website describes how your company processes data of clients, employees, and suppliers, you can state in your contract that data are processed according to the privacy policy available on the website (remember to insert the link).

    Here you can find more information about the privacy notice.

    If you need to understand how to process personal data under GDPR, you can consider enrolling in our free online training EU GDPR Foundations Course: https://advisera.com/training/eu-gdpr-foundations-course//

  • Documented Information

    Normally, those documents are issued over digital support. So, to control those documents you need to control the software that issues them. That way you don’t need to show identification numbers, revision and revision date.

    By the way, you use the wording “external documents” please check this article - What does “external documents control” mean in ISO 9001? - https://advisera.com/9001academy/blog/2019/02/04/what-does-external-documents-control-mean-in-iso-9001/

    You can find more information below:

  • Questions related to accreditation and calibration

    You asked

    Once you attain accreditation for a lab can you also expand the accreditation to another premises? Would the lab tests being performed in the new premises have to be re-validated etc?

    Accreditation is typically per site, so in that case each site would need a separate accreditation assessment. You could obviously share QMS documentation, but records , including MV would be required for each site. Alternatively, for some programmes the new premises could be accredited under a satellite program as falling under the quality management system of an accredited head office / reference laboratory. I suggest you confirm this with the particular accreditation body – it will depend on their policies and programme on offer.

    You also asked

    Is it ok to write a calibration due date on a calibration cert for a device we have calibrated? Do we need to write a disclaimer saying the calibration interval is determined by the customer? I've seen this on a number of ISO17025-accredited certificates.

    It is not acceptable to specify a date and then state a waiver as described. ISO 17025 specifies that the calibration laboratory cannot document any recommendation on the calibration interval, unless agreed with the customer. This means if there is evidence of agreement, you can include the date. No waiver is applicable.

    And you asked

    we use a subfraction of an ISO 12103-1 standard dust for calibrating our dust monitors. Does this material need to be tested (particle distribution) by an ISO 17025 accredited laboratory? we have a particle distribution from a non-accredited lab for the material. I am concerned that as we are using it as a reference material we would need to have an accredited certificate of the particle distribution.

    To answer this question ISO 17025 6.5 applies, as well as the policy of your accreditation body. As an example, see TPS 57 UKAS Policy on Selection and Use of Reference Materials (Edition 4, June 2020). Yes, you are right, as a calibration lab issuing a certificate with a reported measurement uncertainty, the material should ideally be certified to achieve that assurance. For example, in the UKAS TP57 they state UKAS recommends the use of accredited reference material producers and calibration laboratories where they exist. Basically, in a testing context this requirement may be less stringent as a testing lab would need to provide assurance that the results are traceable, along with a known Measurement uncertainty. This they in fact get from the calibration lab. The context is different if you are issuing a calibration certificate. I do suggest a call to your accreditation body to confirm this, before incurring additional costs. The link to TPS 57 is availabe form https://www.ukas.com/resources/publications/laboratory-accreditation/

  • Does Medicine Product Class 1 need Certificate from Notified bodies according to ISO 13485?

    Regarding the certification of medical devices, we must separate two things: one is the certification of the quality system according to ISO 13485: 2016, and the other is the certification of products and the issuance of the CE mark according to the MDR.

    Manufacturers of Class I medical devices do not need a notifying body for product certification. So, they themselves issue the Declaration of conformity and put the "CE" mark on their medical products, but the CE mark without a number (for example, they put the CE mark on the product, and not CE2460). 

    Manufacturers of Class I medical devices need to prepare a quality system in accordance with ISO 13485 and be certified according to that standard.

    For more information, please see the following:

Page 207-vs-13485 of 1130 pages

Didn’t find an answer?

Start a new topic and get direct answers from the Expert Advice Community.

CREATE NEW TOPIC +

This website stores cookies on your computer. These cookies are used to collect information about how you interact with our website and allow us to remember you. We use this information in order to improve and customize your browsing experience and for analytics and metrics about our visitors both on this website and other media. To find out more about the cookies we use, see our Privacy Policy.

If you decline, your information won't be tracked when you visit this website. A single cookie will be used in your browser to remember your preference not to be tracked.