Search results

Audit and Risk Management

I'm assuming you are auditing considering ISO 27001.
 
Considering that, first you need to consult the Statement of Applicability, to identify which controls are related to license and patch management (e.g., A.11.2.7 Secure disposal or reuse of equipment, A.12.5.1 Installation of software on operational systems, and A.12.6.1 Management of technical vulnerabilities), and how these controls are implemented.
 
Based on that you can build a checklist with documents and records you need to look for.  

This article will provide you a further explanation about developing an internal audit checklist:

• How to make an Internal Audit checklist for ISO 27001 / ISO 22301 https://advisera.com/27001academy/knowledgebase/how-to-make-an-internal-audit-checklist-for-iso-27001-iso-22301/

These materials will also help you regarding internal audit:

• ISO Internal Audit: A Plain English Guide https://advisera.com/books/iso-internal-audit-plain-english-guide/
• Free online training ISO 27001:2013 Internal Auditor Course https://advisera.com/training/iso-27001-internal-auditor-course/

Organisational annual audit plan and audit of each department.

ISO 9001:2015 is not about departments, but about processes. So, determine which processes cross each department. When auditing a department you will audit the requirements around the processes that cross that department.

For example, purchasing department may be about purchasing (clause 8.4), about quality control at reception and nonconformities (clauses 8.6 and 8.7), about identification and traceability (clause 8.5.2), about production planning (clause 8.5.1), about preservation (clause 8.5.4), about warehouse conditions (clause 7.1.4). If you check, I identified the clauses by following the process since identifying a need for purchasing until receiving and storing in the warehouse.

About the annual audit plan, you should consider auditing all processes and ISO 9001:2015 clauses in two or more internal audits along a year.

The following material will provide you information about internal auditors:

• ISO 9001 – ISO 9001 internal auditor training: Is it for me? - https://advisera.com/9001academy/blog/2015/06/02/iso-9001-internal-auditor-training-is-it-for-me/
• What is the ISO 9001 audit program, and how does it work? - https://advisera.com/9001academy/blog/2017/01/24/what-is-the-iso-9001-audit-program-and-how-does-it-work/
• Free online training ISO 9001:2015 Internal Auditor Course – https://advisera.com/training/iso-9001-internal-auditor-course/
• Book -  ISO Internal Audit: A Plain English Guide - https://advisera.com/books/iso-internal-audit-plain-english-guide/
   

Employees transportation as an environmental aspect in ISO 14001

You can consider it an indirect environmental aspect that the organization can influence, but not control. Then, while evaluating that aspect you can decide if your organization should do anything about it, or if there are other priorities.

You can find more information below:

• 4 steps in identification and evaluation of environmental aspects - https://advisera.com/14001academy/knowledgebase/4-steps-in-identification-and-evaluation-of-environmental-aspects/
• Environmental aspect identification and classification - https://advisera.com/14001academy/blog/2019/08/27/key-iso-14001-benefits-to-customers/nowledgebase/environmental-aspect-identification-and-classification/
• Free webinar - Free webinar - ISO 14001: Identification and evaluation of environmental aspects - https://advisera.com/14001academy/webinar/iso-14001-identification-and-evaluation-of-environmental-aspects-free-webinar-on-demand/
• ISO 14001 document template: Procedure for Identification and Evaluation of Environmental Aspects and Risks - https://advisera.com/14001academy/documentation/procedure-for-identification-and-evaluation-of-environmental-aspects/
• Enroll for free in this course – ISO 14001:2015 Foundations Course - https://advisera.com/training/iso-14001-internal-auditor-course/
• Book – The ISO 14001:2015 Companion - https://advisera.com/books/the-iso-14001-2015-companion/

Preliminary steps in the implementation of ISO 9001:2015

Determine the scope of the quality management system (QMS), your organization may decide to include only certain lines of business.

Setup a project sponsor, a project manager and a project team. Ensure top management support, get training about the standard. Designing and implementing a quality management system implies being knowledgeable about ISO 9001:2015.

As a first step perform a Gap analysis, to determine the amount of work to be done - comparing what your organization already has in place versus ISO 9001:2015 requirements. From that GAP Analysis you can develop your Project Plan, listing what needs to be done, by whom, until when.

Then, an important step is to design a model of how your organization work as a set of interrelated processes. For example:

Decide how to describe and monitor those processes.

From there it is implementation in order to close the gaps found. Then, perform an internal audit and the management review. There you can decide if your organization is ready for a certification audit.

This is a very short description of the journey but below you can find more detailed information:

You can find more information below:

• Free Gap Analysis Tool - https://advisera.com/9001academy/iso-9001-gap-analysis-tool/
• Should you use a gap analysis in your ISO 9001 implementation? -https://advisera.com/9001academy/17/use-gap-analysis-iso-9001-implementation/
• Checklist of ISO 9001 implementation & certification steps - https://advisera.com/9001academy/knowledgebase/checklist-of-iso-9001-implementation-certification-steps/
• ISO 9001 Implementation diagram - https://info.advisera.com/9001academy/free-download/iso-9001-implementation-diagram
• How to budget an ISO 9001 implementation project - https://info.advisera.com/9001academy/free-download/how-to-budget-an-iso-9001-implementation-project?utm_source=script-for-iso-9001-lead-implementer-course&utm_medium=downloaded-content&utm_content=lang-en&utm_campaign=free-downloads-9001
• Free webinar on demand - Overview of ISO 9001 implementation steps - https://advisera.com/9001academy/webinar/overview-of-iso-9001-implementation-steps-free-webinar-on-demand/
• Free online training ISO 9001:2015 Foundations Course – https://advisera.com/training/iso-9001-foundations-course/
• Book - Discover ISO 9001:2015 Through Practical Examples - https://advisera.com/books/discover-iso-9001-2015-through-practical-examples/
   

Overview of complete links for whole company QMS

Unfortunately, there is no straightforward way to review the company's QMS documentation according to                  IATF 16949: 2016 standard.

Important issues for major QMS documentation are given below.

• The company has a documented methods in front of each "documented process" statement written in the standard,
• The existence of a risk assessment system for each place where "Risk" is mentioned in the standard,
  Documentation of the quality manual,
• Documentation of all QMS processes and documentation of at least 12 months of KPI data.
• Inclusion and evaluation of customer-specific requests in the QMS system.
• Documentation of machine set-up, maintenance, usage instructions, measuring equipment instruction work instructions, etc.
• Availability of all relevant records (PPAP, corrective action, FMEA, capability analysis, MSA results, production and product approvals, supplier assessment and evaluation results, internal audits, management review results, job descriptions, Quality Policy, training records, etc.) in the system.

IAFT 3rd party training for PPAP

The IATF 16949: 2016 standard does not expect 3rd party PPAP certification. In addition, there is no expectation of 3rd party PPAP certification. However, internal auditors and person who is preparing PPAP documentation may need PPAP training.Since the competence of the person giving the training is important.

The instructor of PPAP training can be a 3rd party IATF 16949: 2016 and/or VDA 6.3 auditor, etc. Or the instructor's CV should be competent and sufficient in the PPAP subject. 

Risk vs Impact

They are different. Environmental impacts are about the changes to the environment resulting from an organization’s environmental impacts:

Risks are about the effect of uncertainty. Most of time there is no uncertainty about impacts, they are happening and predictable.
The impact is about the consequences for the environment, while the risk is about processes, products or services.

Some risks become higher when they are associated with an abnormal or emergency situation.

You can find more information below:

• Risks and opportunities in ISO 14001:2015 – What they are and why they are important - https://advisera.com/14001academy/blog/2016/03/07/risks-and-opportunities-in-iso-140012015-what-they-are-and-why-they-are-important/
• Free webinar - Free webinar - ISO 14001: Identification and evaluation of environmental aspects - https://advisera.com/14001academy/webinar/iso-14001-identification-and-evaluation-of-environmental-aspects-free-webinar-on-demand/
• ISO 14001 document template: Procedure for Identification and Evaluation of Environmental Aspects and Risks - https://advisera.com/14001academy/documentation/procedure-for-identification-and-evaluation-of-environmental-aspects/
• Enroll for free in this course – ISO 14001:2015 Lead Auditor Course - https://advisera.com/training/iso-14001-lead-auditor-course/
• Book – The ISO 14001:2015 Companion - https://advisera.com/books/the-iso-14001-2015-companion/

Document control and compliance with ISO 9001

In order to be in compliance with the ISO 9001:2015 standard, a company only need to have Document Control in place for documents and records relevant for the quality management system.

You can find more information about documentation below:

• How to structure quality management system documentation - https://advisera.com/9001academy/knowledgebase/how-to-structure-quality-management-system-documentation/
• New approach to document and record control in ISO 9001:2015 - https://advisera.com/9001academy/blog/2015/06/30/new-approach-to-document-and-record-control-in-iso-90012015/
• Some tips to make Document Control more useful for your QMS - https://advisera.com/9001academy/blog/2014/05/20/tips-make-document-control-useful-qms/
• Free online training ISO 9001:2015 Foundations Course - https://advisera.com/training/iso-9001-foundations-course/
• Book - Managing ISO Documentation: A Plain English Guide - https://advisera.com/books/managing-iso-documentation-plain-english-guide/

Educating staff on risk management

According to ISO 9001:2015 risks must be:

• determined
• evaluated
• acted upon the most relevant

About determination I would provide a set of examples about risks and opportunities in processes, products, services and from the context, and I would train people to determine risks and opportunities.

About evaluation I would develop a simple matrix to reduce subjectivity in evaluating risk and opportunity relevance, and I would train people to evaluate risks and opportunities.

About acting, I would ask people to help develop actions to minimize probability of occurrence and/or minimize consequences of occurrence. I would also ask people how to monitor the implementation and effectiveness of those actions.

Show examples and invite them to be part of the approach.

You can find more information below about risks.

• How to address risks and opportunities in ISO 9001: https://advisera.com/9001academy/blog/2016/06/21/how-to-address-risks-and-opportunities-in-iso-9001/
• Does ISO 9001 require a procedure for addressing risks and opportunities?: https://advisera.com/9001academy/blog/2017/10/10/does-iso-9001-require-a-procedure-for-addressing-risks-and-opportunities/
• For a free preview of an example of the Registry of Key Risks and Opportunities - https://advisera.com/9001academy/documentation/registry-of-key-risks-and-opportunities/
• Free webinar on demand - How to implement risk management in ISO 9001:2015 - https://advisera.com/9001academy/webinar/how-to-implement-risk-management-in-iso-90012015-free-webinar/
• Enroll for free course - ISO 9001:2015 Foundations Course - https://advisera.com/training/iso-9001-foundations-course/
• Book - Discover ISO 9001:2015 Through Practical Examples - https://advisera.com/books/discover-iso-9001-2015-through-practical-examples/ (I use a lot of examples based on the risk-based approach)
   

How to implement Computer System Validation (chapter 7.5.6) without excessive effort and costs?

Requirement 7.5.6 consider the validation of processes for production and service provision. Section 4.1.6 considers software validation. In small companies, always is a question of how to implement this requirement. You have to understand that you need to validate only software that can have an impact on the or quality of your management system or on the safety of the medical device. This means that you do not need to validate word processor or spreadsheet software. But if you have software for managing your warehouse and delivery process, that you need to be sure that in the case of a software update, your warehouse quantity of goods, lot numbers, invoice numbers, and delivery notes have not changed.

If you have any software in the production, software that runs the machine, that software also needs to be validated. 

However, these validations are not software type validations. With this validation, you need to prove that the software updates did not disrupt your database. 

For example, for the number of the invoices and delivery notes, the easiest way is to check the is numbering in the expected sequence, for warehouse, does the quantity on the shelves corresponds to the number defined in the program. 

You can see how the record for software validation looks like in our ISO 13485:2016 Documentation toolkit here:

• Record of Software Validation https://advisera.com/13485academy/documentation/record-of-software-validation-iso-13485-2016/