Search results

Assets and Risks

Please note that the approach you are using is not common (the common practice is the asset-threat-vulnerability approach, not using only asset and threat combination). The problem with your approach is that by not considering potential vulnerabilities related to the asset you can have a misunderstanding about the risk. For example, if for a certain asset the vulnerabilities aren't easy to be exploited by threats the risk will be lower.
 
Considering that, during risk assessment, you do not need to use data classification type, only information assets (e.g., reports, databases, contracts, etc.)
 
Regarding the number of risks, a good approach is for each asset to identify 2 or 3 threats and for each threat 2 or 3 vulnerabilities. For 50 assets this will result in a number of risks between 200 and 450 risks.
 
This article will provide you a further explanation about risk assessment:  

• ISO 27001 risk assessment: How to match assets, threats, and vulnerabilities https://advisera.com/27001academy/knowledgebase/iso-27001-risk-assessment-how-to-match-assets-threats-and-vulnerabilities/

Defining quality objectives

Quality objectives are overall goals or targets stated by the organization in order to achieve improvement within the QMS. Quality objectives have a strategic role in carrying out the quality policy and its implementation through a quality management system and provide a means to assess whether the QMS achieves its goals.  Therefore, it is not necessary to define quality objectives each year, this really depends on the mission, a vision and strategy of your company.

However, please differentiate a quality objectives from regular business objectives. Business objectives you can define each year, they can be depatment-specific, anything that you need fulfill you business golas.

Standard quality objectives can be: meeting customer and regulatory requirements, achieving the improvement of the QMS and its products, and enhancing customer satisfaction. 

In these articles, you have more information about setting good quality objectives:

• Setting good quality objectives for ISO 13485 https://advisera.com/13485academy/knowledgebase/setting-good-quality-objectives-for-iso-13485/
• How to write good quality objectiveshttps://advisera.com/9001academy/knowledgebase/how-to-write-good-quality-objectives/

• ISO 14001 accreditation scheme for global financial services

  The answer to that question is not technical.

  Please check these articles - 6 Key Benefits of ISO 14001 - https://advisera.com/14001academy/blog/2019/08/27/key-iso-14001-benefits-to-customers/nowledgebase/6-key-benefits-of-iso-14001/ and - ISO 14001: The benefits for customers - https://advisera.com/14001academy/blog/2019/08/27/key-iso-14001-benefits-to-customers/

  Without knowing your business priorities and strategic orientation I can speculate that your organization wants to meet potential customers, potential investors with environmental concerns. If that is the case, certification under ISO 14001 can help to reinforce a brand image in this regard.

  Please check also – What is ISO 14001? - https://advisera.com/14001academy/what-is-iso-14001/

  You can find more information below with more detailed answers:

  • Project checklist for ISO 14001 implementation - https://info.advisera.com/14001academy/free-download/project-checklist-for-iso-14001-implementation
  • ISO 14001:2015 Implementation diagram - https://info.advisera.com/14001academy/free-download/iso-14001-2015-implementation-diagram
  • Enroll for free in this course – ISO 14001:2015 Foundations Course - https://advisera.com/training/iso-14001-internal-auditor-course/
  • Book – The ISO 14001:2015 Companion - https://advisera.com/books/the-iso-14001-2015-companion/

• Defining standard requirements in practical use for Rework and Repair

  a) IATF 16949: 2016 standard requires the following conditions for rework subject.

  8.7.1.4 Control of reworked product

  The organization shall utilize risk analysis (such as FMEA) methodology to assess risks in the rework process prior to a decision to rework the product. If required by the customer, the organization shall obtain approval from the customer prior to commencing the rework of the product.

  The organization shall have a documented process for rework confirmation in accordance with the control plan or other relevant documented information to verify compliance with original specifications.

  Instructions for disassembly or rework, including re-inspection and traceability requirements, shall be accessible to and utilized by the appropriate personnel. The organization shall retain documented information on the disposition of reworked product including quantity, disposition, disposition date, and applicable traceability information

  PS: However, changes are coming to the IATF 16949: 2016 standard over time. These are published on the IATF website as "SI". The SI-9 change came in October 2019. In its standard original state, it was asking for customer approval before starting the "rework" process. With this change, customer approval for rework was removed, but customer approval was required for the repair process.

  b) IATF 16949: 2016 standard requires the following conditions for repair subject

  8.7.1.5 Control of repaired product

  The organization shall utilize risk analysis (such as FMEA) methodology to assess risks in the repair process prior to a decision to repair the product. The organization shall obtain approval from the customer before commencing the repair of the product.

  The organization shall have a documented process for repair confirmation in accordance with the control plan or other relevant documented information. Instructions for disassembly or repair, including re-inspection and traceability requirements, shall be accessible to and utilized by the appropriate personnel.

  The organization shall obtain a documented customer authorization for a concession for the product to be repaired.

  The organization shall retain documented information on the disposition of repaired products including quantity, disposition, disposition date, and applicable traceability information.

  For more information please see:

  • What are the five core tools of IATF 16949 https://advisera.com/16949academy/blog/2017/08/23/what-are-the-five-core-tools-of-iatf-16949/

  • Relation between Directive IVDR 98/79, IEC 64304, 62366 and ISO13485

    The relation between Directive IVDR 98/79, IEC 64304, 62366 and ISO13485. Esepecially the documentation.

  • Auditing regulatory offices

    I have no experience of auditing a regulatory office, but I would do no different from other organizations. I would use the process approach and from there audit conformance with procedures and practices. I would use the quality policy and objectives and the management review to start auditing top management.

    The following material can provide more information:

    • ISO 9001 internal auditor training: Is it for me? - https://advisera.com/9001academy/blog/2015/06/02/iso-9001-internal-auditor-training-is-it-for-me/
    • Free webinar on demand - The Process Approach - What it is, why it is important, and how to do it - https://advisera.com/9001academy/webinar/iso-9001-process-approach-free-webinar-on-demand/ 
    • Free webinar on demand - How to perform an ISO 9001:2015 internal audit - https://advisera.com/9001academy/webinar/how-to-perform-an-iso-9001-2015-internal-audit-free-webinar-on-demand/
    • Free online training ISO 9001:2015 Internal Auditor Course: https://advisera.com/training/iso-9001-internal-auditor-course/
    • Book - Discover ISO 9001:2015 Through Practical Examples - https://advisera.com/books/discover-iso-9001-2015-through-practical-examples/

  • Properly implementing section 7.2 and 7.6 for a microbiological lab

    You asked

    "How to properly implement section 7.2 and 7.6 for a microbiological lab?"

    You question relates to the Selection, verification and validation of methods (clause 7.2 section 7.2.1 and 7.2.2) as well as evaluation of measurement uncertainty (clause 7.6).

    Selection of a method and its validation involves ensuring you are using the correct method for the purpose. Microbiological laboratory activities can be diverse, beyond enumeration of microbes, so can involve standard or non-standard methods and diverse techniques and equipment. The validation experiments must demonstrate that the method is suitable to detect and identify one or more analyte in all the matrices of interest (e.g. water, foodstuff), using the required instruments or techniques. Typically if a rapid test is used, this would have to be verified for suitable performance against a gold-standard test for the purpose. If the kit is commercially available and validated, then you would need to show you can achieve a suitable performance in terms of the relevant validation parameters. Microbiological validation parameters generally include specificity, sensitivity, accuracy, trueness, precision, reproducibility, and ruggedness.

    Regarding measurement uncertainty you need to 1) identify the contributions and 2) evaluate. It depends highly on the method - principles or experience of the performance of the method. For example, consider any condition that by your experience or principle of the method, has a contribution to variability. Sources of uncertainty typically come from sampling, storage, sample preperation (homogenization / extraction), weighing, pipetting, dilutions and of course the quantitation of colonies – either by counting manually, automatically or semiautomated methods to calculate the Most Probable Number (MPN). You would basically consider what trueness and replicate data you can acquire – for example replicates for laboratory control samples and reference cultures. Method validation data and ongoing quality control data can be used.

    Commercial kits may report uncertainty limits for the main sources, then you do not need to do any further estimation, just control the system

    I suggest you contact your accreditation body and or regulatory bodies (e.g FDA) for their policies and guidelines on microbiology laboratory method validations and evaluation of measurement uncertainty. Also look at other industry guidelines (perhaps references from the accreditation body guidelines) to provide more detail. There are also ISO standards, for example ISO 19036:2019 Microbiology of the food chain - Estimation of measurement uncertainty for quantitative determinations.

    For more information regarding the method validation and measurement uncertainty, see the ISO 17025 toolkit document templates: 

    • Test and Calibration Method Procedure at https://advisera.com/17025academy/documentation/test-and-calibration-method-procedure/ that is part of the ISO 17025 toolkit, along with the Test Method Development, Verification and Validation Register and Test Method Development, Verification and Validation Record.
    • Evaluation of Measurement Uncertainty Procedure at https://advisera.com/17025academy/documentation/evaluation-of-measurement-uncertainty-procedure/ .
      This covers the basic principles and steps to plan, measure and calculate the data required for an evaluation of measurement uncertainty. The two appendices related to the document, Measurement Uncertainty Checklist and Measurement Uncertainty Record support the process. 

  • General criteria used to determine critical services

    I work for the ***, and ***, a co-worker, gave me your email. In 2019, she acquired your company's business continuity templates.
    I am writing to see if you can help me with a query: In your experience, what is the general criteria that companies use to determine critical services, which are the basis of the business continuity strategy?
    On the other hand, if you can share with us the list of courses you offer on the subject of business continuity.
    I greatly appreciate your assistance.

    General criteria used to identify critical services are impacting the business considering:

    • financial impact
    • legal impact
    • market impact
    • operational impact

    These criteria are used during the business impact analysis to identify which services are critical to the business

    Regarding courses, at this moment we do not any available, but these free webinars can help you on the subject of business continuity:

    • Implementing Business Impact Analysis according to ISO 22301 [free webinar on demand] https://advisera.com/27001academy/webinar/implementing-business-impact-analysis-according-to-iso-22301-free-webinar-on-demand/
    • Developing the business continuity strategy according to ISO 22301 [free webinar on demand] https://advisera.com/27001academy/webinar/developing-the-business-continuity-strategy-according-to-iso-22301-free-webinar-on-demand/
    • Writing a business continuity plan according to ISO 22301 [free webinar on demand] https://advisera.com/27001academy/webinar/writing-a-business-continuity-plan-according-to-iso-22301-free-webinar-on-demand/

    These articles will provide you a further explanation about business continuity:

    • What is ISO 22301 https://advisera.com/27001academy/what-is-iso-22301/
    • How to implement business impact analysis (BIA) according to ISO 22301 https://advisera.com/27001academy/knowledgebase/how-to-implement-business-impact-analysis-bia-according-to-iso-22301/
    • Five Tips for Successful Business Impact Analysis https://advisera.com/27001academy/blog/2010/06/10/five-tips-for-successful-business-impact-analysis/

    This material will also help you regarding business continuity:

    • Book Becoming Resilient: The Definitive Guide to ISO 22301 Implementation https://advisera.com/books/becoming-resilient-the-definitive-guide-to-iso-22301-implementation/

  • ISO 9001 update on the requirements

    No, ISO 9001:2015 does not prescribe any update requirement. Please check clause 7.5.2 c) review should be done when appropriate or needed.

    ISO 9001:2015 is not like some requirements from FDA, for example. Where organizations already include a limit date for review, after that date the document is obsolete.

    The following material will provide you information about document control:

    • How to set up document approval/withdrawal within your QMS based on ISO 9001:2015 - https://advisera.com/9001academy/blog/2016/04/12/how-to-set-up-document-approvalwithdrawal-within-your-qms-based-on-iso-90012015/
    • What kind of Document Management System (DMS) do you need for handling ISO documents? - https://advisera.com/conformio/blog/2020/08/11/what-kind-of-dms-you-need-for-handling-iso-27001-documents/
    • Should you keep your ISO documents in the cloud or on paper? - https://advisera.com/conformio/
    • Book - Managing ISO Documentation: A Plain English Guide https://advisera.com/books/managing-iso-documentation-plain-english-guide/