Search results

Minor nonconformities

ISO 27001 does not prescribe that Nonconformities must be graded, so you can treat all of them only as Nonconformities in the internal audit. The use of minor and major Nonconformities are more used for certification bodies as a best practice.

Considering that, for certification purposes, you only need to ensure that any nonconformity is remediated by the time of the next surveillance/certification audit and that there is no recurrence of the same situation.

This article will provide you with a further explanation about nonconformities:

• Major vs. minor nonconformities in the certification audit https://advisera.com/27001academy/blog/2014/06/02/major-vs-minor-nonconformities-in-the-certification-audit/

For further information, see:

• ISO Internal Audit: A Plain English Guide https://advisera.com/books/iso-internal-audit-plain-english-guide/

Preparing site for first-time audit

Site preparation depends on the type of production you have for your medical device. If that is a sterile medical device, then a lot of attention needs to be on the cleanliness of the premises. It means for example: the separate entrance of the raw material and exit of the finished product, special rules for clothing and behavior in the facility (protective clothing and other equipment, not allowed to eat or drink in the production area).

If you produce a non-sterile device, then also there must be special attention to the work environment which is applicable for that kind of device. 

If you produce software, rules for the work environment are less important, although it is important for the server room to have proper temperature and humidity. 

In the warehouse, you need to have a properly labeled place for non-conforming products. 

Other elements that cover site preparation mean that you need to have everything properly labeled, eg. shelves, lockers, locations in the premises.

For more information on this topic, please see the following articles:

• Managing cleanliness of a product and contamination control according to ISO 13485:2016 https://advisera.com/13485academy/blog/2017/07/04/managing-cleanliness-of-a-product-and-contamination-control-according-to-iso-134852016/
• Managing medical device infrastructure requirements according to ISO 13485:2016 https://advisera.com/13485academy/blog/2017/06/28/managing-medical-device-infrastructure-requirements-according-to-iso-13485/

• Getting IATF 16949 certification

  The first requirement to obtain IATF 16949: 2016 certification is to manufacture for the automotive industry (Original Equipment Manufacturer ‘’OEM’’ or Original Equipment Service ‘’OES’’) and to fit the part on the vehicle. Sales organizations, distributors, dealers, etc. cannot deserve this certificate as they do not produce the parts.

  I understand you are the sales organization and therefore you cannot apply for the IATF 16949: 2016 certification.

  For more information, please read the following:

  • What is IATF 16949? https://advisera.com/16949academy/what-is-iatf-16949/
  • What are the main differences between IATF 16949 and ISO 9001? https://advisera.com/16949academy/blog/2019/11/19/iso-9001-vs-iatf-16949-what-is-the-difference/

• Comparison from ISO 13485 to EU MDR

  Unfortunately, we do not have that kind of article for the whole standard. However, the following articles can help you:

  • EU MDR Checklist of Mandatory Documents https://info.advisera.com/13485academy/free-download/eu-mdr-checklist-of-mandatory-documents
  • How can ISO 13485 help with MDR compliance? https://advisera.com/13485academy/blog/2020/03/09/how-can-iso-13485-help-with-mdr-compliance/

  • Can a medical device do self-calibration?

    Yes, a medical device can do self-calibration, but this performance must be validated. Also, if it is applicable, self-calibration has to be explained in the instruction of use. 

    For more information regarding the validation and calibration, please see the following articles:

    • Using ISO 13485 to manage process validation in the medical device manufacturing industry https://advisera.com/13485academy/blog/2017/09/07/using-iso-13485-to-manage-process-validation-in-the-medical-device-manufacturing-industry/
    • Calibration requirements in ISO 13485 https://advisera.com/13485academy/blog/2019/03/08/calibration-requirements-in-iso-13485/

    • ISO 9001 purpose and principles

      The purpose of a QMS is about having a planned way of working in order to deliver agreed products and services and enhance customer satisfaction.

      A newly developed company can take advantage from a QMS through setting priorities, setting direction, establishing overall objectives and by planning what to do, how to do it with what resources. It also requires having indicators and monitoring and measuring performance.

      Please check these articles about the benefits of implementing a QMS - Six Key Benefits of ISO 9001 Implementation - https://advisera.com/9001academy/knowledgebase/six-key-benefits-of-iso-9001-implementation/ and What are the benefits of ISO 9001 for your employees? - https://advisera.com/9001academy/blog/2016/06/14/what-are-the-benefits-of-iso-9001-for-your-employees/

      The following material will provide you more information:

      • What is ISO 9001? - https://advisera.com/9001academy/what-is-iso-9001/
      • The history and future of the ISO 9000 series of standards - https://advisera.com/9001academy/blog/2019/04/15/history-of-the-iso-9000-series-of-standards-and-what-to-expect-next/
      • Free online training ISO 9001:2015 Foundations Course – https://advisera.com/training/iso-9001-foundations-course/
      • Discover ISO 9001:2015 Through Practical Examples - https://advisera.com/books/discover-iso-9001-2015-through-practical-examples/

    • ISO 9001 and Customer focus

      An auditor can formulate an idea about how an organization works with customer focus by collecting information about:

      • What is being done to enhance customer satisfaction
      • How many complaints were received and how they were treated
      • What is the performance of indicators about promises made to customers concerning quality, service, delivery date, for example 

      You can find more information below:

      • Handling customer satisfaction with code of conduct and complaints procedure - https://advisera.com/9001academy/blog/2014/07/15/handling-customer-satisfaction-code-conduct-complaints-procedure/
      • Free online training ISO 9001:2015 ISO 9001:2015 Internal Auditor Course - https://advisera.com/training/iso-14001-internal-auditor-course/ nal-auditor-course/
      • Book - Discover ISO 9001:2015 Through Practical Examples - https://advisera.com/books/discover-iso-9001-2015-through-practical-examples/
         

    • Does a small Biotech company need to have a DPO?

      Article 37 GDPR states that the controller shall appoint a Data Protection Officer (DPO) when(a)the processing is carried out by a public authority or body;(b) the core activities of the controller or the processor consist of processing operations which require regular and systematic monitoring of data subjects on a large scale; or(c) the core activities of the controller or the processor consist of processing on a large scale of special categories of data pursuant to Article 9 (included health data).

      Therefore, if your company process data on a large scale or there is regular and systematic monitoring of data subjects on a large scale (i.e. an app tracking Covid infections) you should appoint a DPO. You need to consider the scale of processing rather than the dimension of the company. Large scale is not defined by the GDPR, however, the former Working Party (a group study established the EU Commission) defined few examples of large scale (https://ec.europa.eu/information_society/newsroom/image/document/2016-51/wp243_annex_en_40856.pdf):

      • processing of patient data in the regular course of business by a hospital
      • processing of travel data of individuals using a city’s public transport system (e.g. tracking viatravel cards)
      • processing of real time geo-location data of customers of an international fast food chain forstatistical purposes by a processor specialised in these activities
      • processing of customer data in the regular course of business by an insurance company or a bank
      • processing of personal data for behavioural advertising by a search engine
      • processing of data (content, traffic, location) by telephone or internet service providers

      Here you can find more information:

      • Article 37 GDPR https://advisera.com/eugdpracademy/gdpr/designation-of-the-data-protection-officer/
      • The role of the DPO in light of the General Data Protection Regulation https://advisera.com/eugdpracademy/knowledgebase/the-role-of-the-dpo-in-light-of-the-general-data-protection-regulation/

      If you want to know more about GDPR compliance you can consider enrolling in this EU GDPR Foundations Course: https://advisera.com/training/eu-gdpr-foundations-course//

    • Help with ISO 27001 implementation

      1. Tough I would like to approach this topic from a more pragmatic and analytic way. I have seen on your website a categorization of ISO27k controls into organizational, technological, etc. on a pie chart so show with numbers. Could you please send me such a categorization which controls fall into which category?

      Please note that this is not a definitive list, because other people can use criteria different for grouping the controls. Broadly speaking we have:

      • Sections related to organizational issues: A.5, A.6., A.8, A.15
      • Section related to human resources: A.7
      • IT-related sections: A.9, A.10, A.12, A.13. A.14, A.16, A.17
      • Section related to physical security: A.11
      • The section related to legal issues: A.18

      2. It would be also much appreciated if you could suggest on high-level which control main-or sub-chapters would you suggest to include as generally applicable for doing risk assessment for a Domain Controllers and a VPN gateway.

      Since Domain Controllers and VPN gateways are technological solutions, controls from sections A.9, A.10, A.12, A.13. A.14, A.16, A.17 would be generally applicable for risk treatment. Please note that for risk assessment you can consider such controls as guidance to help identify potential risks (controls are not used during risk assessment).

      3. Furthermore in case doing risk assessment for such infrastructure elements, would you suggest to include additional assets like administrators therein? Or even documentation, facilities, because that is also related to my above question, if we have around 30 organizational type controls, the evaluation of those could be more or less the very same way applied to all infrastructure elements or what would you suggest to avoid double work?

      This we could also discuss personally in the course of the online expert support session offered, I am available for this purpose tomorrow or today afternoon.

      In your risk assessment, you should include all infrastructure elements that can impact information security, not only technical equipment (e.g., human error on DC configuration may be a relevant risk for you, or lack of formal procedures may cause important records not to be registered).

      During the assessment, what you can do to minimize rework is to assess how the risk related to these assets impacts the information security, not the DC or the VPN gateway.

    • The best way to include “evidences” of policy implementation

      Please note that ISO 27001 does not prescribe how to store evidence of implementation, so organizations are free to implement them the best that suits them.
       
      Considering that, you can adapt the storage approach to the type of the record (you do not need to adopt a single approach). For example, evidence of monitoring implementation can be stored in the monitoring system (i.e., the monitoring logs). Evidence of awareness and training can be included in the employee's personal folder.
       
      Regarding the use of links in the documents, you should consider including a link only to the general folder of your evidence (for example, the audit folder, not the specific audit). This way you can balance the agility to found the records without adding too much complexity.  

      This article will provide you a further explanation about record management:

      • Records management in ISO 27001 and ISO 22301 https://advisera.com/27001academy/blog/2014/11/24/records-management-in-iso-27001-and-iso-22301/

      This material will also help you regarding record management:

      • Managing ISO Documentation: A Plain English Guide https://advisera.com/books/managing-iso-documentation-plain-english-guide/