Search results

Home / Search

Category:
Select
Select

11272 results

Guest

Guest

Create New Topic As guest or Sign in

HTML tags are not allowed

Select

Assign topic to the user

  • How to know if you can apply for ISO 14001 certification?

    Yes, you can.

    Your organization can apply for certification once you have an implemented environmental management system (EMS) in place. Your organization knows how it interacts with the environment, knows the compliance obligations, sets EMS objectives (results you want to achieve, undesired results you want to avoid, like accidents, and compliance with compliance obligations), and works to achieve them and to maintain what already works.

    To get more information, please check:

  • Laboratory Certifications for ISO9001 and 17025

    Both ISO 9001 and ISO 17025 are quality management systems. ISO 9001 is focussed on the quality of service delivery while ISO 17025 focus is on technical competency. ISO 7025 and ISO 9001 are assessed by different bodies. An accreditation body assesses the performance and awards ISO 17025 accreditation to laboratories that show competence to produce consistent valid test or calibration results. Certification bodies audit organisations and award ISO 9001 certification if the QMS requirements are met. This typically includes non laboratory departments, for example finance, procurement and Human resources. If the laboratory is not seeking ISO 17025 accreditation, they can apply for ISO 9001 certification, however it does not provide confidence in the technical competence of the laboratory. If the customer requires the organisation as a whole to be ISO 9001 certified, with ISO 17025 accreditation for the laboratory, the management of the systems can be integrated with common approaches to for example, complaints and risk analysis; however the assessments will be separate.

    For more information on the purpose of ISO 17025 as well as Option A and B for laboratories, see https://community.advisera.com/topic/completing-implementation/  and the articles  
    ISO 17025 vs. ISO 9001 – Main differences and similarities at https://advisera.com/17025academy/blog/2019/07/11/iso-17025-vs-iso-9001-main-differences-and-similarities/
    What is ISO 17025? at https://advisera.com/17025academy/what-is-iso-17025/ and the white paper
    Clause-by-clause explanation of ISO 17025:2017 available at https://info.advisera.com/17025academy/free-download/clause-by-clause-explanation-of-iso-17025

  • Writing laboratory document and record control procedure

    Documents and records need to be designed, authored and controlled to be suitable to hold valuable data and information. When you write the procedure for this activity, understand the requirements in clauses 8.3, 8.4, 7.5 and 7.11 first. Then depending on the platform you will use, for example Microsoft Office (Word and Excel), SharePoint, commercial LIMS or other, document the specific process to be followed in the laboratory.

    For more information and the availability of toolkit documents and resources from Advisera, see a similar question and answer at https://community.advisera.com/topic/document-and-record-control-procedure-means-what-are-the-procedure-will-include/

  • The differences between actions, processes, and procedures according to ISO 14001

    Actions are what we do. For example, we monitor energy consumption. We segregate wastes. We prevent environmental emergencies.

    A process is a set of interrelated actions that work together to convert inputs into outputs. For example, we manage waste. We monitor environmental performance.

    Procedures are documents specifying the way to carry out an activity or a process. A procedure is about the what, the who, the when, and sometimes the how (most of the time the how is in a specific kind of documentation called work instruction.

  • Question for assignment

    1 - For instance, in documents like SECURITY PROCEDURES FOR IT DEPARTMENT and IT SECURITY POLICY, record names, storage locations, etc. must be specified. So my concern is, how will it be if we are progressing with IT Security policy and have to write the same document name in the record name? According to my understanding, if we define a record name, there would be various documents pointing to that procedure. Let me know briefly what we can write, please.

    Please note that even if the document and record have the same name, for Conformio they are different items (one is type “policy/procedure”, and the other is type “record”), so Conformio will know how to handle them and will make the pointing the right way.

    2 - The situation you presented is very unusual, because a record related to a document in general refers to a specific action described in the document, and would not include the name of the type of the document. For example, for the “Backup Policy” you would have a record named “backup record” or “restoration record”

    Another concern is that we don't use antivirus software, yet the IT Security Policy has a section about it. "What should we say in that section if our company doesn't use antivirus software?

    Please note that this section related to antivirus software will appear in the IT Security Policy only in case you have a relevant risk treated by control A.8.7 Protection against malware.

    So, you need to review your Statement of Applicability to see if control A.8.7 is stated as applicable and reassess any related risks so they do not require to be treated by this control anymore.

    3 -If you could clarify my confusion regarding the fact that the record name here in the secure development policy prepopulates the information for the record name and also shows the procedure for secure information system engineering and testing plan for security requirements and system acceptance, will we still need to create these documents on our own? How will the records be created?

    This question is related to Section 4 in security development policy document

    Your understanding is correct. You will need to create the documents (the record name in Conformio only identifies what they exist in your environment and what they are called).

    These documents need to be created manually by the user. Since such information is very specific for each organization, it is unfeasible to provide a template that can fit the organization's needs.

    In case you are having difficulties in developing such documents, you can schedule a meeting with one of our experts, and he will help you develop them.

  • Performing work outside scope

    Excellent response, very well written, clear and concise.  Thank you for your support!  

  • KPI project management / engineering IATF

    As a requirement of ISO 9001:2015 and IATF 16949:2016, you must put at least one or two KPIs in each process. It would be better if there are KPIs that are important for you and related to the process in these KPIs.

    The IATF 16949:2016 standard does not specifically specify that there will be KPIs. Customer satisfaction, it requires the monitoring of features such as quality, shipment, and premium freight.

    It is also desirable to follow the cost of poor quality trend.

    But especially organizations usually follow the below KPIs.
    In the production process; Targets such as OEE, internal scrap, failure rate, compliance with the production plan, and efficiency are followed.

    In the logistics process, points such as on-time shipment, premium freight, and shipping complaints should be followed.


    During the production process, KPIs such as customer ppm, internal ppm, scrap, rework, repair rates, compliance with the calibration plan, compliance with the inspection plan, and cost of poor quality are generally monitored. 

     

  • Change Management Document

     For more detailed documentation for change management, I suggest you take a look at the templates in this toolkit that are compliant with ISO 20000 (the ISO standard for the management of IT services): https://advisera.com/20000academy/itsm-change-management-toolkit/

    • Change Management Process
    • Request for Change and Change Record
    • Minutes of Meeting CAB
    • Change Schedule

    They can be used in an ISMS, but they are not mandatory for ISO 27001 compliance.

  • Statement of Applicability

    You need to go through all controls listed in Annex A and explain why we have (or haven't) decided to implement them.

    Please note that according to ISO 27001, the following information must be included in the SOA:

    • All applied controls
    • Justification for inclusions
    • Implementation status
    • Justification for exclusions of controls from Annex A

    You can also add information you consider relevant to help manage the ISMS (e.g., a brief description of how the control is implemented).

    For further information, see:

  • Independent Contractor Contact

    1: How do I as an individual convince companies to take up my services as an ISMS expert individual contractor

     Basically, you need to demonstrate to them how you can add value to their business:

    •  How your experience and skills can help them improve information security
    • How well you are recognized in the market from previously delivered services (i.e., reference customers) and support to the community (through presentations, publications, training, etc.),
    • How well do you know customers’ industries

    For more information, see:

    2: if I'm ISMS expert working on my own how do I convince companies to take me on as an Independent contractor

    The same answer from the previous answer applies to this question also.
Page 30-vs-13485 of 1128 pages

Didn’t find an answer?

Start a new topic and get direct answers from the Expert Advice Community.

CREATE NEW TOPIC +