Start a new topic and get direct answers from the Expert Advice Community.
CREATE NEW TOPIC +Guest
Previous versions of ISO 14001 used the words “legal requirements”. ISO 14001:2015 uses instead the words “compliance obligations”. Compliance obligations include legal requirements and other requirements like customer requirements.
Any organization operating in a certain region will have to comply with a set of laws and regulations – the legal requirements. For example, in my country any organization has to comply with legislation about:
You can find more information below:
First, that is a great example of what can become a quality management system owned by many people in an organization. Normally, there is great resistance to participate in this way.
What I would recommend is that before starting to create procedures people should have some basic training in ISO 9001 requirements associated with each department. Now, you cannot go back in time. So, I recommend performing departmental internal audits where internal auditors can check implementation and also conformance according to ISO 9001 requirements.
The following material can provide more information:
First is important to note that Document control and confidentiality levels (i.e., information classification) are different things.
Control of documents and records is a requirement of the standard (one that does not require to be documented), while information classification is one of the information security controls from ISO 27001 Annex A.
Considering that, the use of the information classification control to identify confidentiality levels is needed only if your organization has relevant risks, or legal requirements (e.g., laws, regulations, or contracts) demanding the implementation of this control. If no such situations occur, you do not need to implement information classification.
This article will provide you a further explanation about information classification:
Configuration management in AS9100 (clause 8.1.2) is all about ensuring that the end product meets the requirements fully as per the design, with any design changes noted. For a company that is creating designs as their deliverable, the most important thing is traceability for the design to the design requirements to show they are met. This is very much like a design verification activity.
As for FOD, which is an example given in clause 8.5.4 on preservation, this would not really be applicable to a company delivering a design. You will not that the list in this clause is listed as “when applicable”
You can learn more on configuration management in AS9100 in the article: Understanding configuration management in AS9100 Rev D, https://advisera.com/9100academy/blog/2017/05/08/understanding-configuration-management-in-as9100-rev-d/
Operational risk management in AS9100 (clause 8.1.1) is all about identifying and tracking the risks that are in place during the creation and delivery of the product or service. In an organization that delivers designs you still have risks for completing and delivering the design (e.g. incomplete requirements, tight timeline for delivery, etc.). These risks need to be identified for the project, assessed and communicated, and mitigation actions assigned when necessary, with the understanding that some risks will have no action other than tracking until they are gone (e.g. time-critical delivery from a supplier)
You can learn more on operational risk management in AS9100 in the article: 5 key elements of risk management in AS9100 Rev D, https://advisera.com/9100academy/blog/2017/05/15/5-key-elements-of-risk-management-in-as9100-rev-d/
Clause 6.4.2 states that When the laboratory uses equipment outside its permanent control, it shall ensure that the requirements for equipment of this document are met.
Firstly it is important to note that "Equipment" is considered as any item used to generate a result, so this also applies, for example, to software, reference materials, chemicals and reagents.
This clause can cover a number of scenarios, for example
1) When equipment is shared within the laboratory facility or another department of the organisation,
2) When items are stored in a storeroom not managed directly by the laboratory,
3) When equipment is calibrated offsite by a service provider or another department and returned for use by the laboratory, and 4) If a service provider performs a service on an item, even if onsite.
In all these cases the activity must comply with ISO 17025 requirements for equipment. This includes facilities and environment, handling, storage, use, verification, performance checks, and appropriate records.
For more information see
I cannot call these as best practices. They are some of the practices I follow.
Employees are not expected to know all significant environmental aspects), or objectives/targets, or monitoring/measuring requirements. What is expected is that they know which are relevant for their job, which ones they can contribute to or influence.
Normally, what I recommend doing is designing a homogeneous audience based on location, and customize a game where people are invited to determine significant environmental aspects from their job and learn about the best practices to handle each one.
Develop the environmental policy day. A day where the environmental policy is presented, with special attention to its commitments, and a link to the environmental objectives and targets.
Again, with a homogeneous audience based on location you can develop a kind of brainstorming about “How can I contribute, in my work, to meet the objectives and targets?”
For each relevant location periodically post the results of monitoring / measurement that people can influence during the performance of their work
Please consider the following information:
First of all, the product you produce is mounted on the OEM vehicles such as cars, trucks, buses, etc. so you can apply for IATF 16949 certification. If you are designing products besides production activity, design and manufacturing must be clearly defined in your IATF 16949: 2016 scope.
If your customer to whom you sell the product requires you to obtain an IATF 16949: 2016 certificate, then you should apply for certification, and your quality management system must be ready for assessment.
If your customer does not have a request in this regard; you can apply for an IATF 16949:2016 certificate at your own request.
As a laboratory, although a formal risk management program is not required, you need to address risks efficiently and rate them in a way so that actions can be justified and appropriate to the level of risk.
For more information regarding actions to address risks and opportunities, see the ISO 17025 toolkit document template: Addressing Risks and Opportunities Procedure at https://advisera.com/17025academy/documentation/addressing-risks-and-opportunities-procedure/
and for more information on the five steps to address risks, see the article Five-step laboratory risk management according to ISO 17025:2017 at https://advisera.com/17025academy/blog/2019/12/05/iso-17025-risk-management-in-five-steps/
For a more detailed explanation, you can watch the free webinar How to manage risks in laboratories according to ISO 17025 at https://advisera.com/17025academy/webinar/iso-17025-risk-management-how-to-manage-it-free-webinar-on-demand/
Also have a look at the following for more information - Expert Community Answers
Start by the end!
What is the purpose of a documentation department in the pharmaceutical industry?
That department exists to meet what desirable results?
That department exists to avoid what undesirable results?
For example:
As KPIs you can use for this example:
The following material will provide you more information: