Search results

Home / Search

Category:
Select
Select

11269 results

Guest

Guest

Create New Topic As guest or Sign in

HTML tags are not allowed

Select

Assign topic to the user

  • Measurement uncertainity

    You asked

    Is measurement of uncertainty applicable for our scope of work? 

    All testing laboratories must evaluate or, at least, estimate measurement uncertainty by identifying contributions to measurement uncertainty and considering all significant contributions including those arising from sampling and using appropriate methods of analysis. Where detailed measurement uncertainty evaluation is not possible due to the nature of the test method, the measurement uncertainty may be estimated based on principles of the techniques or practical experience of the performance of the method.

    You also asked

    what are factors to be considered if we requires to calculate the same? 

    Measurement uncertainty is a statistical representation, representing the statistical certainty that the true result lies within the stated margin. It is understood as the margin of doubt regarding the results of any measurement.

    To establish how large the margin of doubt is for a method, at a specified confidence level (e.g., 95% confidence), all the contributions (from your method steps and calcultions) must be included either a mathematical budget or by using long term quality control data of reproducibility and bias. It depends on the method and what you have available - standard uncertainties derived from various sources (such as calibrations) or long term “whole method” standard deviation

    You also asked

    can you suggest some tools for the calculation?"

    For more information regarding the measurement uncertainty, see the ISO 17025 toolkit document template: Evaluation of Measurement Uncertainty Procedure at https://advisera.com/17025academy/documentation/evaluation-of-measurement-uncertainty-procedure/ This  covers the basic principles and steps to plan, measure and calculate the data required for an evaluation of measurement uncertainty. The two appendices related to the document, Measurement Uncertainty Checklist and Measurement Uncertainty Record support the process. I recommend you also look to your sector and suppliers for commonly used approaches.

  • Providing consultation to a 3rd party

    Concerning consulting if the third party agrees to work with you it is something that it is up to the two parties.

    Concerning performing ISO 9001 internal audits it is up to your audit client to determine internal auditor requirements. If you comply with their requirements I, as external auditor, would not have anything against it.

    You can find more information below:

  • Carrying out document control effectively

    Document control means that relevant documents for the quality management system:

    • Are approved by an authorized person
    • Relevant users have access to those documents
    • Obsolete versions are removed
    • It is easy to check the current version of a document and what changed from the previous version

    Please check in this article - List of mandatory documents required by ISO 9001:2015 - https://advisera.com/9001academy/knowledgebase/list-of-mandatory-documents-required-by-iso-90012015/ the list of mandatory records required by ISO 9001:2015

    You can find more information about records below:

     

  • GDPR Privacy querries

    Having longitude and latitude i.e. G. location coordinates (and hence the home address t believe if I am not wrong) of some person be considered as Pll

    Yes, GDPR considers location coordinates as well as the home address as personal data. Article 4, (1) GDPR states that ‘personal data’ means any information relating to an identified or identifiable natural person (‘data subject’); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person;”

    Since Clouds like Amazon AWS have backups happening across the world to maintain a high availability and for BCP purposes, so I feel it's a fair assumption to thin, that AWS will he considering PrwacY laws Eke GDPR before sent. European resident Pll data to any other country outside Europe. Correct?

    Yes, Amazon AWS implemented the GDPR compliance system in its services. Here you can find what Amazon does for GDPR https://aws.amazon.com/it/compliance/gdpr-center/

    While doing assessment, Do I need to ask vendors to give me list of countries where the cloud is sending the backup data (containing PII) to, while thinking of pnvacy Logic being European resident data is going outside Europe ask if the cloud follow GDPR by having controls or not

    You need to establish with your vendors who act as data processor a data processing agreement requiring them to select cloud providers who are compliant with GDPR (i.e. with data centers in the EU) you can also demand proof of compliance with GDPR of their cloud servers as the data controller has the power to give instruction on data processing, according to article 28 GDPR.

    Am I correct regarding applicability of GDPR in below practical life scenarios-

     a) European resident I not citizen) went to India and registered an account with Uber by giving his Pil and rode on cab So GDPR would NOT be applicable regarding handling of this European person. Correct, I think GDPR should be as law of land will prevail which is India in this case and not Europe. 

    Article 3 GDPR defines the territorial scope of GDPR and it is applicable to data processing taking place in the EU or from data controller located in the EU. Therefore, the EU citizen in India will not be under GDPR.

    b) Indian resident went to Europe and registered an account with Uber Europe by giving PII and is currently doing a cab ride, so GDPR will be applicable as per what's written in the GDP. regulation. Correct? 

    Yes, it is correct.

    Now the Indian resident has completed the trip and has gone back to India and left Europe. Will GDPR still protect his Pll data which is now residing in Europe?

    GDPR will protect data collected through the EU company, while the data collected through the Indian company will not under GDPR, because the data processing is outside the EU, with non-EU citizens and through non-EU data controller.

    Someone from India want to make a trip to Europe and thought of advance booking, so while sitting from India itself register an account by giving his PII on the website of some European tour operator with its data center in:  c.1) Europe - Will GDPR be applicable?  c.2) Outside Europe - Will GDPR be applicable?

    Yes, all data processed by the EU data controller (European tour operator) are under GDPR, for the processing carried all around the world.

    Will the time of the actual visit make any difference on GDPR applicability i.e. GDPR is ON only after the actual visit has happened and not before?

    No, even if the Indian tourist does not leave India but gave some PII to European Tour Operator, personal data will be processed according to GDPR.

    Since IP is a PII, so will even the Dynamic IP not static IP) be considered as PII? By the time the captured dynamic IP will. processed to find PII, the dynamic IP would have changed/expired 

    Requesting your guidance on these as I believe these will help me in understanding Privacy better"

    Yes, dynamic IP is a PII because it makes the individual identifiable, according to article 4 GDPR.

    Here you can find more information:

    If you want to know more about GDPR compliance you can consider enrolling in this EU GDPR Foundations Course: https://advisera.com/training/eu-gdpr-foundations-course//

  • Sterilization procedure template

    1. We have a procedure “Sterilization” covering below topics: Elements of the validation process - Bioburden Method validation - Bioburden enumeration -Sterilization process validation – Sterility testing - Validation by The Bacteriostasis/Fungistasis Test - Sterility testing - EO residue - Bacterial endotoxins (LAL) test – Product Package Testing - Functional test - Validation records and approval - Impact on manufacturing and packing in routine –Process review – requalification – Concession. However, we have a separate procedure on Sterility monitoring, covering below topics: Microbial environmental monitoring - Product bioburden monitoring - Sterility testing (confirmation) -Bacterial endotoxins (LAL) test Product Package integrity testing In the sample we see from your documentation we only find “Sterilization”. Are the monitoring topics included in the Sterilization procedure template?

    Yes, monitoring and validation topics are included in the Sterilization procedure. We wanted to simplified documentation so we prepare just one procedure for that. 

    On this link you can find out how to manage the medical device sterilization process according to ISO 13485:2016

    The documents show a very adequate relationship to the ISO13485 paragraph that is the basis for the requirement. Although most of these requirements are (then again) based on Article, annexes of the EU MDR (2017/745) For example: For 7.3.9 (ISO) is based (now in MDR) on Annex IX, 2.2 c and Article 10. Are there any referrals in the document point to these specific MDR article/requirements (possible?)

    No, in our procedures we refer only to the MDR in general. However, this is a very good suggestion, we will think about it to implement in our documentation. Thank you for pointing it out to us.

  • 8.5 Actions to address risks and opportunities (Option A) (new)

    Complying with clause 8.5 starts with taking a process approach – knowing your workflow for activities that are (or will be) part of your laboratory scope of accreditation. It involves identifying the factors that can affect the activity being assessed. For example, not having a calibrators that are traceable to SI units will mean you have a risk to the validity of your result.

    Opportunities must also be addressed, meaning opportunities for improvement. A lab must consider the impact of risk or opportunity and take propitiate action. This involves choosing your methodology, performing an assessment (identification and analysis), deciding if risk treatment is required (or in the case of opportunities, whether you should adopt that change), implementing and then monitoring and followup.

    For more information regarding actions to address risks and opportunities, see the ISO 17025 toolkit document template: Addressing Risks and Opportunities Procedure at https://advisera.com/17025academy/documentation/addressing-risks-and-opportunities-procedure/

    and for more information on the five steps to address risks, see the article Five-step laboratory risk management according to ISO 17025:2017 at https://advisera.com/17025academy/blog/2019/12/05/iso-17025-risk-management-in-five-steps/

    Other responses to similar questions may also be of interest – have a look at 
    What is the efficient way and tricks to address, handle and treat the risk and opportunity? at https://community.advisera.com/topic/what-is-the-efficient-way-and-tricks-to-address-handle-and-treat-the-risk-and-opportunity/ and 
    Addressing Improvement clause at https://community.advisera.com/topic/addressing-improvement-clause/

  • Setup of Governance, Risk and Security department

    Broadly speaking, to set up a new department in an organization is very similar to the implementation of a management system, and you should consider:

    • the identification of a clear reason why you need this new department (e.g., it will fulfill a business need, it will give a market advantage, it will comply with legal requirements, etc.).
    • the definition of objectives, goals, and targets
    • the performing of risk assessment, to identify relevant risks related to the achievement of objectives, goals, targets.
    • the definition of an action plan, considering the activities the department must perform (e.g., risk management, audit, controls implementation, employees training, etc.), which competencies you need (i.e., job descriptions), how many people will be required, and how it will be its internal organization (i.e., hierarchy). At this point, you will define which policies, guidelines, and controls to implement to mitigate risks to the achievement of objectives, goals, and targets.
    • the identification of requirements related to space, equipment, and facilities.
    • how to fill job vacancies (e.g., internal placement, or external hiring)
    • the definition of a specific budget
    • top management approval of the proposed department

    For further information, see:

    The concepts in these articles, although applied to ISO 27001, can be used to set up a new department from zero.

  • Which are the right ISO standards to use

    First is important to note that there is no such ISO 27301 standard.

    Considering that, the proper standard to use will depend on your needs:

    • if your priority is information protection, then you should use ISO 27001.
    • if your priority is to ensure processes and services delivery under disruptive conditions, then you should use ISO 22301.

    ISO 27031 is a support standard that can be used together with ISO 27001, because it provides specific guidance for ICT readiness for controls from ISO 27001 Annex A.

    Sometimes it may be advantageous to implement both ISO 27001 and ISO 22301 (e.g., when this integrated implementation can fulfill other business objectives).

    These articles will provide further information:
Page 285-vs-13485 of 1127 pages

Didn’t find an answer?

Start a new topic and get direct answers from the Expert Advice Community.

CREATE NEW TOPIC +