Search results

8.5 Actions to address risks and opportunities (Option A) (new)

Complying with clause 8.5 starts with taking a process approach – knowing your workflow for activities that are (or will be) part of your laboratory scope of accreditation. It involves identifying the factors that can affect the activity being assessed. For example, not having a calibrators that are traceable to SI units will mean you have a risk to the validity of your result.

Opportunities must also be addressed, meaning opportunities for improvement. A lab must consider the impact of risk or opportunity and take propitiate action. This involves choosing your methodology, performing an assessment (identification and analysis), deciding if risk treatment is required (or in the case of opportunities, whether you should adopt that change), implementing and then monitoring and followup.

For more information regarding actions to address risks and opportunities, see the ISO 17025 toolkit document template: Addressing Risks and Opportunities Procedure at https://advisera.com/17025academy/documentation/addressing-risks-and-opportunities-procedure/

and for more information on the five steps to address risks, see the article Five-step laboratory risk management according to ISO 17025:2017 at https://advisera.com/17025academy/blog/2019/12/05/iso-17025-risk-management-in-five-steps/

Other responses to similar questions may also be of interest – have a look at 
What is the efficient way and tricks to address, handle and treat the risk and opportunity? at https://community.advisera.com/topic/what-is-the-efficient-way-and-tricks-to-address-handle-and-treat-the-risk-and-opportunity/ and 
Addressing Improvement clause at https://community.advisera.com/topic/addressing-improvement-clause/

Setup of Governance, Risk and Security department

Broadly speaking, to set up a new department in an organization is very similar to the implementation of a management system, and you should consider:

• the identification of a clear reason why you need this new department (e.g., it will fulfill a business need, it will give a market advantage, it will comply with legal requirements, etc.).
• the definition of objectives, goals, and targets
• the performing of risk assessment, to identify relevant risks related to the achievement of objectives, goals, targets.
• the definition of an action plan, considering the activities the department must perform (e.g., risk management, audit, controls implementation, employees training, etc.), which competencies you need (i.e., job descriptions), how many people will be required, and how it will be its internal organization (i.e., hierarchy). At this point, you will define which policies, guidelines, and controls to implement to mitigate risks to the achievement of objectives, goals, and targets.
• the identification of requirements related to space, equipment, and facilities.
• how to fill job vacancies (e.g., internal placement, or external hiring)
• the definition of a specific budget
• top management approval of the proposed department

For further information, see:

• How to identify ISMS requirements of interested parties in ISO 27001 https://advisera.com/27001academy/blog/2017/02/06/how-to-identify-isms-requirements-of-interested-parties-in-iso-27001/
• ISO 27001 control objectives – Why are they important? https://advisera.com/27001academy/blog/2012/04/10/iso-27001-control-objectives-why-are-they-important/

The concepts in these articles, although applied to ISO 27001, can be used to set up a new department from zero.

Which are the right ISO standards to use

First is important to note that there is no such ISO 27301 standard.

Considering that, the proper standard to use will depend on your needs:

• if your priority is information protection, then you should use ISO 27001.
• if your priority is to ensure processes and services delivery under disruptive conditions, then you should use ISO 22301.

ISO 27031 is a support standard that can be used together with ISO 27001, because it provides specific guidance for ICT readiness for controls from ISO 27001 Annex A.

Sometimes it may be advantageous to implement both ISO 27001 and ISO 22301 (e.g., when this integrated implementation can fulfill other business objectives).

These articles will provide further information:

• What to implement first: ISO 22301 or ISO 27001? https://advisera.com/27001academy/blog/2017/04/03/what-to-implement-first-iso-22301-or-iso-27001/
• How to implement integrated management system https://advisera.com/articles/how-to-implement-integrated-management-systems/
• Understanding IT disaster recovery according to ISO 27031 https://advisera.com/27001academy/blog/2015/09/21/understanding-it-disaster-recovery-according-to-iso-27031/

Reputation Management ISO product

We are not aware of a Reputation Management ISO product. What we can tell you is about an ISO Technical committee about Online reputation (ISO/TC 290), whose current status is "stand by": https://www.iso.org/committee/5166853.html

Related to this committee there is a single published standard: ISO 20488:2018 Online consumer reviews — Principles and requirements for their collection, moderation and publication : https://www.iso.org/standard/68193.html?browse=tc

Do manufacturing of medical face mask require clean room?

The work environment for the production of face masks depends on the intended use and declarations that you want to put on your medical device. If you want to sell sterile face masks, then you need sterilization facilities. In that case, each mask will be packed in a separate pouch and will be class Is. 

If you do not want it to be sterile, then it is class I. There is no direct requirement in the standard to produce those masks in the cleanroom area. However, in ISO 13485:2016 in requirement 6.4.1 Work environment is stated that organization must be defined and document requirements needed to achieve conformity to product requirements. So, it is up to you how you will decide.

For more information regarding the work environment, please see the following links:

• Managing cleanliness of a product and contamination control according to ISO 13485:2016 https://advisera.com/13485academy/blog/2017/07/04/managing-cleanliness-of-a-product-and-contamination-control-according-to-iso-134852016/
• Managing medical device infrastructure requirements according to ISO 13485:2016 https://advisera.com/13485academy/blog/2017/06/28/managing-medical-device-infrastructure-requirements-according-to-iso-13485/

• Instructions for aspect evaluation

  Your organization will determine the environmental aspects. Determine also the environmental impacts related with each aspect. An organization may have the same environmental aspect but different environmental impacts. For example, wastewater discharging may be into a river with or without any treatment – very different environmental impacts.

  In your instruction you can consider if there is applicable legislation and if it is met or not. If it is not met it is a significant aspect. If it is met, you can apply more evaluation items to define priorities. For example – frequency/probability (normal, periodical, abnormal) – Consequences for the environment (minor, medium, major). These are the two more common topics. However, you add more topics like economic impact, interested parties relevance.

  Please check this information below with more detailed answers:

  • Environmental aspect identification and classification - https://advisera.com/14001academy/blog/2019/08/27/key-iso-14001-benefits-to-customers/nowledgebase/environmental-aspect-identification-and-classification/
  • Catalogue of environmental aspects - https://advisera.com/14001academy/blog/2019/08/27/key-iso-14001-benefits-to-customers/nowledgebase/catalogue-of-environmental-aspects/
  • How does product life cycle influence environmental aspects according to ISO 14001:2015? - https://advisera.com/14001academy/blog/2016/03/21/how-does-product-life-cycle-influence-environmental-aspects-according-to-iso-140012015/
  • Free webinar - ISO 14001: Identification and evaluation of environmental aspects - https://advisera.com/14001academy/webinar/iso-14001-identification-and-evaluation-of-environmental-aspects-free-webinar-on-demand/
  • ISO 14001 document template: Procedure for Identification and Evaluation of Environmental Aspects and Risks - https://advisera.com/14001academy/documentation/procedure-for-identification-and-evaluation-of-environmental-aspects/
  • Enroll for free in this course – ISO 14001:2015 Lead Auditor Course - https://advisera.com/training/iso-14001-lead-auditor-course/
  • Book – The ISO 14001:2015 Companion - https://advisera.com/books/the-iso-14001-2015-companion/
     

• Closed the minor NC for last year

  I'm assuming your question is "What if the client already closed the minor NC for last year, however this year we still find the same issue. Is it minor or major?"

  Considering that, if you found the same issue that should be solved by a previously issued NC, this means that the NC treatment was ineffective, and this would raise a major non-conformity because it means a mandatory requirement of the standard was not fulfilled.
   
  Please note that minor and major non-conformities are generally used for certification audits, not internal audits, and major non-compliances identified during ISO 27001 certification/surveillance audit, can lead to problems with the certification process.
   
  These articles will provide you a further explanation about the impacts of non-compliance:

  • Major vs. minor nonconformities in the certification audit https://advisera.com/27001academy/blog/2014/06/02/major-vs-minor-nonconformities-in-the-certification-audit/
  • Practical use of corrective actions for ISO 27001 and ISO 22301 https://advisera.com/27001academy/blog/2013/12/09/practical-use-of-corrective-actions-for-iso-27001-and-iso-22301/
     

• How is the supply chain interrelated with business continuity?

  1. How the supply chain is interrelated with business continuity

  Depending on your business continuity objectives, a disruption in the supply chain may have a big impact on the business. For example, if you work with "just in time" supplies (i.e., you only have minimal stock of raw material), a disruption of your supply chain may disrupt your production line, even if the disruptive incident is hundreds of miles away from your facilities.

  To have a better view of how your supply chain can affect your business, you should perform a Business Impact Analysis.

  For further information, see:

  • Setting the business continuity objectives in ISO 22301 https://advisera.com/27001academy/blog/2014/02/17/setting-the-business-continuity-objectives-in-iso-22301/
  • How to implement business impact analysis (BIA) according to ISO 22301 https://advisera.com/27001academy/knowledgebase/how-to-implement-business-impact-analysis-bia-according-to-iso-22301/

  2. How to generate the emergency plan during the breakdown of any of the links

  Once you have identified the disruptive scenarios you have to handle, broadly speaking, the development of a continuity plan based on ISO 22301: 2012 requires the development of:

  • incident response plans, with emergency actions to be performed right after the disruption being identified;
  • continuity actions to bring activities back to the minimum agreed levels;
  • recovery actions to bring activities back to normal operations.

  These materials will provide you a further explanation about developing a continuity plan:

  • Business continuity plan: How to structure it according to ISO 22301 https://advisera.com/27001academy/knowledgebase/business-continuity-plan-how-to-structure-it-according-to-iso-22301/
  • How to write business continuity plans? https://advisera.com/27001academy/blog/2010/04/08/how-to-write-business-continuity-plans/
  • Writing a business continuity plan according to ISO 22301 [free webinar on demand] https://advisera.com/27001academy/webinar/writing-a-business-continuity-plan-according-to-iso-22301-free-webinar-on-demand/
  • Book Becoming Resilient: The Definitive Guide to ISO 22301 Implementation https://advisera.com/books/becoming-resilient-the-definitive-guide-to-iso-22301-implementation/

  To see how a Business Continuity Plan compliant with ISO 22301 looks like, I suggest you see the free demo of our Business Continuity Plan at this link: https://advisera.com/27001academy/documentation/business-continuity-plan/

• ISO 27001

  Please note that a complete answer to the applicable standards and international regulations for the issues you mentioned requires legal expert advice, which is not our field of expertise.

  What we can answer is about the applicability of ISO 27001, ISO 27701, and GDPR for such issues, by means of these articles:

  • What is ISO 27001 https://advisera.com/27001academy/what-is-iso-27001/
  • Where to start from with ISO 27001 https://advisera.com/27001academy/knowledgebase/iso-27001-where-to-start-most-important-materials/
  • Relationship between ISO 27701, ISO 27001, and ISO 27002 https://advisera.com/27001academy/blog/2019/12/10/relationship-between-iso-27701-iso-27001-and-iso-27002/
  • What is EU GDPR https://advisera.com/eugdpracademy/what-is-eugdpr/
  • Does ISO 27001 implementation satisfy EU GDPR requirements? https://advisera.com/27001academy/blog/2016/10/17/does-iso-27001-implementation-satisfy-eu-gdpr-requirements/

• Document Control Numbers (Doc Code)

  You can solve this situation in at least three ways. 

  One way is the way that you have described in your question. 

  Another way is for the company to make a decision that from a certain date you will start with a new document tagging (e.g. 01.10.2020), that all documents will start from revision 0, and there will be a combination of documents from the toolkit and your existing documents. In this case, you will describe this as a change in the quality management system, in the archive, you will have all of this „old“ versions with all relevant changelogs and start with the new numbering process. 

  The third way is that you use your numbering of existing documents and take our numbering for the new documents. 

  Try to see which way is the easiest way for you and all employees, which way will be the easiest to implement in everyday work. 

  For more information about common mistakes with ISO 13485:2016 documentation control and how to avoid them, please see the following link:

  • Common mistakes with ISO 13485:2016 documentation control and how to avoid them https://advisera.com/13485academy/blog/2018/03/14/common-mistakes-with-iso-134852016-documentation-control-and-how-to-avoid-them/