Start a new topic and get direct answers from the Expert Advice Community.
CREATE NEW TOPIC +Guest
I do not use the word “observation” since there is no ISO 9000 or ISO 19011 definition for it. I use major and minor nonconformity.
In your audit you verified a non-conformity according to clause 7.1.5.2 b). According to your description, I would raise a minor nonconformity.
You can find more information in the following links:
I can say that I already worked with organizations in that situation and they decided to consider clause 8.3 as non-applicable. They decided and explained that their business is not developing or designing parts, their business is manufacturing parts according to customer requirements. The molds were approved by the customer indirectly when the customer approved the injected parts.
If your organization has already decided who is going to be your certification body, remember that you can explain to them the situation and ask for a statement.
I was asked to develop a (*Subject) for a small organisation with no more that 1500 words and it's not very specific as to have user profile A,B...etc.. and their designation, their rights and all. How do I start with it?
I have a question "an organization is AS9100 Rev D certified but organization has no production since one year from any customer then how can compliance of QMS can be interpreted? How internal audits be conducted? How KPI be translated ? What standard say that if an organization have no customer since long time then how QMS compliance be evaluated?
ISO 27001 clause 9.2 speaks specifically about internal audit, whereas control A.18.2.1 defines independent review of information security - besides internal audit, such independent review can also be certification audit, 2nd party audit, etc.
To learn more about internal audit, sign up for this free online training ISO 27001 Internal Auditor Course https://advisera.com/training/iso-27001-internal-auditor-course/
PPAP requirements should be determined according to customer-specific requirements. If you do not have a special customer requirement then you can use the PPAP rev 4 blue books written by AIAG as a reference manual. There are generally 19 main topics in PPAP. Some of those are given below.
In ISO 17025; "laboratory activities" are one of three types of work taking place in a laboratory, i.e. either testing, calibration or sampling, (when the sample is going to be tested or calibrated). That means that the range of lab activities is the testing, calibration or sampling that is to be, or is accredited. Laboratories must define and document (i.e. decide and put in writing) a list of what testing, calibration or sampling activities conform to ISO 17025, as this will be listed on the accreditation certificate; and is what can be claimed as accredited.
I will give you two testing laboratory examples:
Laboratories must perform the work themselves on an ongoing basis, and not “contract out” such work unless under controlled temporary arrangements due to an emergency.
For more information on ISO 17025 see
Every company has a different set of risks because of different products, technology, processes, people, etc. so it is is not possible to develop a generic list of risks.
However, in the ISO 27001/27017/27018 Toolkit you purchased, in the folder 05 you have a document called Risk Assessment Table where you will find catalogs of assets, threats and vulnerabilities you can take into account - these will speed up significantly the identification of risks in your company.
Further, you have also received access to video tutorial which show a couple of examples of how to identify risks using this document.
To learn more about the risk management, sign up for this free online training: ISO 27001 Foundations Course https://advisera.com/training/iso-27001-foundations-course/
OLA is an internal agreement (two different parts, e.g. departments, of the same organization) where you define activities in scope with related parameters, e.g. response time). More about OLA in this document "SLAs, OLAs and UCs in ITIL and ISO 20000“ https://advisera.com/20000academy/knowledgebase/slas-olas-ucs-itil-iso-20000/
OLA can be a formal document but can be also e.g. ticket forwarded to another department.
The technical service catalogue is part of the Service catalogue and describes the service in technical parameters. More about Service catalogue in the article "Service Catalogue – a window to the world“ https://advisera.com/20000academy/blog/2013/03/19/service-catalogue-window-world/ and "Service Catalogue – Defining the service“ https://advisera.com/20000academy/blog/2014/03/11/service-catalogue-defining-service/ or in this free webinar " ITIL Service Catalogue from scratch“ https://advisera.com/20000academy/webinar/itil-service-catalogue-from-scratch-free-webinar-on-demand/