Search results

Home / Search

Category:
Select
Select

11269 results

Guest

Guest

Create New Topic As guest or Sign in

HTML tags are not allowed

Select

Assign topic to the user

  • Business Continuity Management System Software Checklist

    Some criteria you should consider for evaluating BCMS software are:

    • Availability of online communication features, so employees have more freedom of work
    • Features specifically designed to cover ISO 22301 core requirements (e.g.: business impact analysis, risk assessment, business continuity planning, document and record management, etc.)
    • Availability of external support service and knowledgebase, because no software will help you solve 100% of the situations, and you will need expert advisement some moment
    • References about performance and stability of the platform
    • Cost for acquisition and maintenance.

    This article can provide additional information:

  • Question about auditors

    1. Does the external auditor need to sit privately with the internal auditor and see his IA plan and its IA report and verify all his findings?

    The external auditor does not need to sit privately with the internal auditor to perform the audit if he can use any other methods to find needed evidence to confirm that the internal audit is performed according to the standard.

    Regarding the internal audit findings, the external auditor can work with a sample, provided this sample can provide enough confidence that the process is being performed according to the standard´s requirements.

    2. Does the external auditor have a commitment and or obligation to verify his findings and corrective actions taken? Or simply look into his plans and its final report.

    ISO 27001 requires the verification not only of internal audit plans and results (clause 9.2) but also of the results of any corrective action taken (clause 10.1), so corrective actions taken as a result of internal audits need to be verified by the external auditor (again, this verification can be performed over a sample). 

    3. It’s well known that IA is not fully impartial and his IA report might not be a bit biased and or impacted by his senior management if he/she is not independently reporting to the highest authority?

    In fact, problems of conflict of interest and impartiality can occur, but to be compliant with ISO 27001 an organization needs to ensure objectivity and impartiality from internal auditors and that these are reported to relevant management (clauses 9.2 e) and 9.2 f)), and the external auditor should verify the fulfillment of these clauses. 

    4. Can the Internal audit out of transparency disclose any Nonconformities to the external auditor and or anything that the external auditor himself can not find during his short visit?

    Members of an organization can provide additional information for an external auditor if they think this can improve the results of the external audit and help improve the organization, but in general disclosure of such information needs to be aligned upfront between auditees and the organization’s top management (normally disclosure of such information without previous alignment can lead to disciplinary process). 

    These materials will also help you regarding audits:

    • ISO Internal Audit: A Plain English Guide https://advisera.com/books/iso-internal-audit-plain-english-guide/
    • Free online training ISO 27001:2013 Internal Auditor Course https://advisera.com/training/iso-27001-internal-auditor-course/
    • Free online training ISO 27001 Lead Auditor Course https://advisera.com/training/iso-27001-lead-auditor-course/

    • Process owner of Training plan documents

      There is no definition on this subject in the IATF 16949: 2016 standard or the ISO 9001: 2015 standard. This issue may vary from company to company.

      In some organizations, all training documents are stored by the HR department. In some companies, HR department stores only for office staff, and for workers who are production employees, the relevant department stores. In short, this subject varies according to the size and structure of the companies.

    • Timeline for processes audit

      According to IATF 16949:2016 standard, while making audit plans for the system and for the manufacturing process, it should be considered risk-based.

      These risks should be determined as follows:

      • Process changes Internal and external problems
      • New process or processes
      • New products or production technologies
      • Organization changes
      • Performance trends Customer complaints
      • etc

      The risk level should be determined according to these situations and the frequency of audits should be determined in a 3-year period. There is no requirement for one audit per year. If there is no risk, a process can be audited once in 3 years, or if there is a risk, another process can be audited 3 times a year.

      The IATF 16949: 2016 standard explains as follows.

      For System Audit; The organization shall audit all quality management system processes over a three-year audit cycle, according to an annual program, using the process approach to verify compliance with this Automotive QMS Standard. Integrated with these audits, the organization shall sample customer-specific quality management system requirements for effective implementation. The complete audit cycle remains three years in length. The quality management system audit frequency for individual processes audited within the three-year audit cycle shall be based upon internal and external performance and risk. Organizations shall maintain justification for the assigned audit frequency of their processes. All processes are required to be sampled throughout the three-year audit cycle and audited to all applicable requirements in the IATF 16949 standard, including ISO 9001 base requirements, and any customer-specific requirements.

      For Manufacturing Process Audit; Each audit does not have to cover all shifts in one audit (for example an audit of the pressing process could be done on shift 1 and 2, sampling shift changeover in year 1, and then in year 2 or 3 an audit undertaken on the third shift for pressing). However, all manufacturing processes must be audited on all shifts over a three-year cycle, the frequency depending on risk, performance, changes, etc.

      For more information, see:

Page 232-vs-13485 of 1127 pages

Didn’t find an answer?

Start a new topic and get direct answers from the Expert Advice Community.

CREATE NEW TOPIC +