Search results

Home / Search

Category:
Select
Select

11270 results

Guest

Guest

Create New Topic As guest or Sign in

HTML tags are not allowed

Select

Assign topic to the user

  • Using Non-ISO Clients on Controlled Forms

    Thank you for the information. Regarding you being “shocked”, I agree with your concern. As I do not have all the context (it depends on the use of the record), I will answer generally with some comments to assist.

    A laboratory implementing ISO 17025 and working towards accreditation must state the range of activities that conform to ISO 17025. For general activities, for example, document and record control, customer contracts, handling complaints and corrective actions, it is not appropriate to consider applying a conforming approach to some and a non-conforming approach to situations. The management system must cover all activities that could impact the policies and objectives (aligned to ISO 17025 purpose), otherwise, it defeats the purpose of the management system. The purpose of ISO 17025:2017 is to provide laboratories with the requirements to ensure competence, impartiality, and consistent operation. The purpose of the accreditation is to provide confidence in the operation of the laboratory. Beyond the overall requirements for common general activities,  only the tests on the scope of accreditation need to comply with all the mandatory technical competency requirements such as completed metrological traceability, validation, participation in interlaboratory studies.

    Bear in mind that often an auditee will answer in a way that does not reflect the real situation. What is required in an audit is objective evidence against specific criteria. When a response is given verbally, best practice is to ask an open-ended question to get to the basis of that response. With your knowledge of ISO 17025:2017 and laboratory operations, ask yourself where the higher risk or deficiency lies and go deeper there. In this case, it means looking at the criteria for confidentiality (clause 4.1), data and information management (clause 7.11), and customer requirements (clause 5.4); not document control. As an auditor notes the document control observation/concern to tie in later with other observations. You can also note a concern in the apparent gap in the responder's knowledge of the requirements (consider if the person should know details or have an awareness, depending on responsibility).

    Any situation where you are looking for evidence that the organization has established and is maintaining their management to the extent required (or not), consider the operational, standard, and regulatory needs. For example, ISO 17025 clause 8.2.5 states personnel must have access to information required. That said, in order to minimize risks, protect the confidentiality and safeguard impartiality, an organization should only make the minimum information available, and only to that personnel who need it do to their work. Take a risk approach to the audit, considering the context. There are four questions to ask which will lead you to the criteria for deeming compliance or not. Ask: 1. What is the organization required by law?2. What has been agreed with the customer?3. What are the mandatory ISO 17025 requirements?4. What has the laboratory documented as a procedure, meaning what have they stated they will do?

    Stating the non-conformance finding clearly against specific criteria will assist the laboratory to close the significant gaps.

    The following may be of interest, to compliment your approach:

  • Accreditation for 3D machines

    First of all, there is no relationship or request with the 3D machine in the IATF 16949:2016 standard. I would like to state again that you cannot see the word 3D printer directly in any item of the IATF standard.

    I will answer your question in 2 ways.

    Firstly, if the company produces 3D printers and sells these machines to automotive customers, then the company that produces 3D must be ISO 9001: 2015 certified. Calibration may be required for 3D printing and machine maintenance must also be performed. The machine must be repaired in case of malfunction and the necessary spare parts must be provided.

    Secondly, if the company producing automotive parts uses a 3D printing machine to design products and/or molds, item 8.3 of the IATF 16949: 2016 standard must be considered a product and process design and development.

    In other words, part/mold technical drawings must be kept with revision numbers and history. FMEA’s (Design and/or Process) records related to the project must be created. Prototype part tests and results must be followed and documented. This topic is about a product or process design, not related to the 3D printer machine. Here, the 3D printer is in the auxiliary equipment position. It should be calibrated, routinely maintained, necessary spare parts must be kept, user trained, etc.

     

  • Information Security Incident or Business Continuity Disruption

    If a customer has a business continuity disruption that affects the availability of information, must they log it as an InfoSec incident AND a BCMS Disruption?  How should they go about assessing which system to manage it under?

  • Implementar el ISO 9001 en una biblioteca universitaria

    Lo primero que debe de hacer es contar con el apoyo de la dirección de la organización, en este caso la dirección d ela biblioteca, que será clave durante la implementación de ISO 9001:2015 ya que proporciona los recursos tanto económicos como de personal.

    Después lo que puede hacer es un análisis GAP o de brecha, que le va a ayudar a identificar aquellos requisitos con los que ya cumple y aquellos con los que aún debe aún cumplir. Aquí puede llevar a cabo el análisis de forma gratuita: https://advisera.com/9001academy/iso-9001-gap-analysis-tool/

    Luego debe conocer cada una de las cláusulas con las que tiene que cumplir para poder llevar a cabo el proyecto de implementación de ISO 9001. En este white paper puede encontrar información resumida sobre cada una de ellas - Clause by clause explanation of ISO 9001: https://info.advisera.com/9001academy/free-download/clause-by-clause-explanation-of-iso-90012015

    Posteriormente puede escribir un plan de proyecto en el que de signa responsabilidades, define la documentación que va a escribirse, los plazos de implementación, etc. En este enlace puede descargarse una plantilla - Plan de Proyecto para la implementación de ISO 9001:https://info.advisera.com/9001academy/es/descarga-gratuita/plan-de-proyecto-para-la-implementacion-de-iso-9001-ms-word

    Luego ya podría empezar con la implementación de la norma: la definición de la política de calidad, los objetivos de calidad y planes para llevarlos a cabo, el contexto de la organización y sus partes interesadas, el alcance del SGC, etc...hasta llegar a la auditoría interna y la revisión por la dirección, que sería el paso previo para certificarse. En este enlace puede descargarse un checklist para la implementación de la norma - Porject checklist for ISO 9001:2015: https://info.advisera.com/9001academy/free-download/project-checklist-for-iso-9001-2015-implementation

    Estos materiales pueden ayudarle con la implementación de ISO 9001:2015:
    - Libro – Discover ISO 9001:2015 through practical examples: https://advisera.com/books/discover-iso-9001-2015-through-practical-examples/
    - Formación gratuita en línea – Fundamentos de ISO 9001:2015 : https://advisera.com/es/formacion/curso-fundamentos-iso-9001/

  • ISO 13485 Lead Auditor

    Thanks for your reply to my questions. I do appreciate it.

  • List of referenced risks and numbers

    Please note that these referenced risks and numbers are only examples for the training, so there is no complete list of risks.

    To see a comprehensive list of threats and vulnerabilities you can use to develop a risk assessment and a risk treatment plan, please see this article:

    In the Risk Assessment Table template available at this link: https://advisera.com/27001academy/documentation/risk-assessment-table/

    You can see a demo of a list of assets, threats, and vulnerabilities.

    This article will provide you a further explanation about risk assessment:

    These materials will also help you regarding risk assessment:

  • Key elements of ISO 27001

    First is important to note that ISO 27001 is not about "how to" (e.g., which documents, technologies, and other solutions to use), but about "what needs to be done" (i.e., which objectives to achieve, like treat risks, train people, etc.)

    Considering that, some key elements you need to consider are:

    • Top management support
    • Definition of roles and responsibilities
    • Information security risk management
    • Employees engagement

    These articles will provide you a further explanation about ISO 27001:

    These materials will also help you in presenting ISO 27001:

  • Main challenges in the implementation of ISO 27001

    The main challenges related to ISO 27001 implementation are:

    • Lack of management support: without this support, you won't have the minimal resources and engagement to implement the required controls.
    • Not using a project management approach: such implementation involves coordinating several people to perform dozens of activities, and without a methodology, you will finish inside a huge mess with no security at all.
    • Lack of time for the implementation project: The project can be very important, but normally, there are a lot of urgent things happening that postpone the project.
    • ISMS scope wrongly defined: not protecting information that really matters.
    • Documentation: Procedures excess or lack of details may compromise operations.

    This article will provide you additional information:

    These materials will also help you regarding ISO 27001 implementation:

  • Information Security Management System

    Would you advise (feasible) and what recommendations would you give during or after the design of the ISMS an application be developed to carry out an automated and adequate management and monitoring of information security, with traceability when implementing an Information Security Management System ( ISMS)?

    Please note that while some activities, like risk assessment and internal audit, require a lot of analysis and evaluation work to be done, and it is not possible to automate them, because some decisions require a human feeling and perception of the business environment that a machine cannot properly evaluate, some activities you can be automated, such as:

    • collect data from existing databases (e.g. to help identity assets if an asset-threat-vulnerability risk assessment approach is used)
    • compare data gathered with risk level limits to warn about risks that require further analysis
    • organize and present data for decision making.

    Considering that, in the development of an ISMS application to fulfill your needs, you need first identify which requirements this application needs to meet, to see the level of automation you can reach, and if this is enough for your purposes.

    This article will provide you a further explanation about the use of tools:

  • How to inspire people for new standard?

    The most effective ways to get the engagement of people are:

    • to show them how the new standard can benefit them, help them achieve their business results
    • always take their opinion into account on project decisions
    • be transparent with them about what you are going to do and why
    • help them to resolve conflicts of interest with other areas, searching for mutually beneficial solutions

    For further information, see:
Page 296-vs-13485 of 1127 pages

Didn’t find an answer?

Start a new topic and get direct answers from the Expert Advice Community.

CREATE NEW TOPIC +