Search results

Information security career

First is important to note that you do not need an IT background to work with an Information Security Management System (certainly an IT background is helpful, but it is not mandatory).

Considering your ISO background, the first step is for you to decide which path you want to follow considering security management or security assurance (i.e., security audit), and for these areas, you have the following ISO 27001 career you can follow:
- ISO 27001 Lead Implementer – this certification recognizes people who have competency in the ISO 27001 implementation process.
- ISO 27001 Lead Auditor – this certification recognizes people who have competency in auditing an ISM S against ISO 27001 requirements and want to become certification auditors (and with this provides more confidence to an organization for being certified).

These articles will provide you a further explanation about ISO 27001 personnel certifications:
- What does ISO 27001 Lead Implementer training look like? https://advisera.com/27001academy/blog/2016/11/28/what-does-iso-27001-lead-implementer-training-look-like/
- What does ISO 27001 Lead Auditor training look like? https://advisera.com/27001academy/blog/2016/08/29/what-does-iso-27001-lead-auditor-training-look-like/
- Lead Auditor Course vs. Lead Implementer Course – Which one to go for? https://advisera.com/27001academy/blog/2014/06/16/lead-auditor-course-vs-lead-implementer-course-which-one-to-go-for/

For courses related to these certifications, please see:
- ISO 27001:2013 Lead Auditor Course https://advisera.com/training/iso-27001-lead-auditor-course/
- ISO 27001:2013 Lead Implementer Course https://advisera.com/training/iso-27001-lead-implementer-course/

Duration of surveillance audit

The duration of audits by certification bodies depends mainly on the size of the organizations in terms of the number of employees, and to a lesser extent on the complexity of the products or services. The duration of surveillance audits is shorter than that of certification audits.

The following material will provide you information about surveillance audits:

• ISO 9001 – What is an ISO 9001 surveillance audit? - https://advisera.com/9001academy/blog/2016/10/18/what-is-an-iso-9001-surveillance-audit/
• Surveillance visits vs. certification audits - https://advisera.com/27001academy/knowledgebase/surveillance-visits-vs-certification-audits/
• Free online training ISO 9001:2015 Foundations Course – https://advisera.com/training/iso-9001-foundations-course/
• Book - Discover ISO 9001:2015 Through Practical Examples - https://advisera.com/books/discover-iso-9001-2015-through-practical-examples/

Delivery department documentation

There is no mandatory documentation required by ISO 9001:2015 concerning the delivery department. Please check this article - List of mandatory documents required by ISO 9001:2015 - https://advisera.com/9001academy/knowledgebase/list-of-mandatory-documents-required-by-iso-90012015/

So, it is up to each organization decide what documentation is required.

Please check this article - How ISO 9001 improves shipping procedures - https://advisera.com/9001academy/blog/2019/07/09/how-iso-9001-improves-shipping-procedures/ - perhaps you could find some tips, although it is for shipping companies

You can find more information below:

• Discover ISO 9001:2015 - https://advisera.com/books/discover-iso-9001-2015-through-practical-examples/
• ISO 9001:2015 Foundations Course - https://advisera.com/training/iso-9001-foundations-course/

E-waste management

I find in the internet some discrepancies in the information about e-waste. Some sources say that it is becoming more dense, less volume. Other sources, like the European Parliament, say something like “E-waste is the fastest growing waste stream in the EU and less than 40% is recycled.” Some sources see a great problem, others see a great opportunity for recycling rare metals.

Concerning ISO 14001, please consider this ISO 14001 document template: Guideline for Electronic Waste Management - https://advisera.com/14001academy/documentation/guideline-for-electronic-waste-management/ - Consider also this article - Using ISO 14001 to manage and reduce waste in the electronics industry - https://advisera.com/14001academy/blog/2017/02/13/using-iso-14001-to-manage-and-reduce-waste-in-the-electronics-industry/

ISO 45001 - identifying internal and external issues

If your organization uses the SWOT analysis already, then the strengths and weaknesses of the SWOT analysis are applicable tot eh internal and external issues in ISO 45001 clause 4.1. Likewise, the issues causing the threats and opportunities would also be external issues, and the threats and opportunities would be applicable in clause 6.1.

It is however important to note that a SWOT analysis is not a mandatory requirements of ISO 45001, and is only one way to identify this information.

You can learn a bit more of how SOWT works in the OHSMS in the article: Benefits of SWOT analysis in ISO 45001, https://advisera.com/45001academy/blog/2019/05/27/iso-45001-swot-analysis-what-are-the-benefits/

OHSAS 18001 vs ISO 45001

OHSAS18001 was the designation for the previous standard from BSI for creating an OHSMS, or Occupational Health & Safety Management System, which is the collection of all the rules, policies, procedures and processes you put in place to manage OH&S performance in your organization. ISO 45001 is the new OHSMS standard which is released by the International Organization for Standardization, making it a more internationally accepted and applicable document.

Both OHSAS 18001 and ISO 45001 are documents that provide requirements on how to create an OHSMS, with OHSAS 18001 becoming obsolete in the near future as ISO 45001 becomes the new international standard. Organizations have a certain time to transition before the OHSAS 1`8001 standard is made obsolete and certification to this older standard is stopped.

You can learn more on the changes from OHSAS 18001 to ISO 45001 in the recorded webinar: ISO 45001 vs OHSAS 18001 the main changes, https://advisera.com/45001academy/webinar/iso-45001-2017-vs-ohsas-18001-2007-the-main-changes-on-demand/

Process turtle for Customer Specific Requirements

Many companies use turtle diagrams when defining processes. This form of identification is not mandatory for IATF 16949 but is preferred because it is an easy identification method. If you want to define a process such as reviewing customer-specific requirements in your QMS structure, you can use this type of process definition map.

For more information, see this article: 

• How to satisfy customer-specific requirements when implementing IATF 16949 https://advisera.com/16949academy/blog/2019/07/02/iatf-16949-customer-specific-requirements-how-to-meet-them/

• Are Cardiovascular Stent covered in ISO 13485?

  Cardiovascular stents are medical devices. ISO 13485:2016 is a standard that is applicable for manufacturers of all types of medical devices, therefore, it's applicable for cardiovascular stents.

  For more information on what is ISO 13485, please see the following links:

  • >What is ISO 13485? https://advisera.com/13485academy/what-is-iso-13485/
  • Six key benefits of ISO 13485 implementation https://advisera.com/13485academy/knowledgebase/six-key-benefits-of-iso-13485-implementation/
  • ISO 13485 structure and requirements https://advisera.com/13485academy/what-is-iso-13485/
  • Checklist of ISO 13485 implementation and certification steps https://advisera.com/13485academy/knowledgebase/checklist-of-iso-13485-implementation-and-certification-steps/

  • Assessing risks and opportunities

    While there is no mandatory timeline in ISO 45001 for risk and opportunity assessment, it is common to have this done as part of management review on a cycle or 3, 4 or 12 months. The important thing to consider for your company is how often do the risks and opportunities in your industry and location change. If there are highly changing risks and opportunities in your industry, then more frequent review is a wise decision. In many cases a 4 month review cycle is likely adequate.

    You can read a bit more on risk and opportunity in the OHSMS in the article: What are the new requirements for risks and opportunities according to ISO 45001?, https://advisera.com/45001academy/blog/2018/04/25/what-are-the-new-requirements-for-risks-and-opportunities-according-to-iso-45001/

  • Strategic intent

    ISO 9001:2015 only mention “strategic direction” in clauses:

    • 4.1 – organizations must determine internal and external issues that are relevant to their strategic direction. Different strategies make some issues relevant or not and positive or negative. For example, an organization that serve premium segment customers sees a downturn in the economy differently than an organization in the same economic sector but serving low-price customers
    • 5.1.1 and 5.2.1 – the quality policy must be aligned with the strategic orientation. For example, an organization that competes on price has different priorities and concerns than an organization that competes on product innovation
    • 9.3.1 – management review must evaluate if the system is aligned with the strategic direction

    Neither ISO 9001:2015 nor ISO 9000:2015 define what is strategic direction. Also, it is not mandatory, according to ISO 9001:2015, to have a document about the strategic direction. Please check this article - List of mandatory documents required by ISO 9001:2015 - https://advisera.com/9001academy/knowledgebase/list-of-mandatory-documents-required-by-iso-90012015/ - where you can see the mandatory documents and records according to ISO 9001:2015.

    According to ISO 9001:2015, one can draw a model of how an organization works based on the process approach. For example:

    

    If an organization competes on cost, this may be the critical processes:

    

    If an organization competes on customization/service, this may be the critical processes:

    

    If an organization competes on innovation, this may be the critical processes:

    

    Different strategies, different priorities, different motivations, different indicators.

    As an auditor, I do not expect to see a document, but I expect some consistency between priorities in the quality policy and what top management considers its strategic direction.