Search results

SOC 1 & 2 equivalent for International Vendor

We're not experts in SOC 2, but there are many common points between SOC II and ISO 27001:2013 that may allow you to adopt ISO 27001 for due diligence for a new international vendor: risk management, internal audit, business continuity, access control, etc.

If you want to know details about the similarities about both standards, and what resources can be shared, you can see the document “Trust Services Map to ISO 27001” in the official site of the American Institute of CPAs. You can find it at this link: https://www.aicpa.org/content/dam/aicpa/interestareas/frc/assuranceadvisoryservices/downloadabledocuments/othermapping/trust-services-map-to-iso-27001.xlsx

ISO 45001 mandatory clauses for an audit

In clause 9.2.1 for internal audit the ISO 45001 standard simply states that the organization must audit that the OHSMS meets their own requirements, and the requirements of the standard. Using the recommended approach from ISO 19011, the idea is to perform an audit of the processes, rather than a clause-by-clause audit of the standard. During the audit you see if the planned process arrangements meet the ISO 45001 standard requirements, then you talk to people and see if they are meeting the process planned arrangements as identified by the company (because most of them won’t know the ISO 45001 standard, rather they know what they have been trained to do. With internal audit the audit is not done clause-by-clause, so there are no mandatory clauses to audit.

When it comes to a certification audit, they will audit all of your processes, and then ensure that everything meets all of the requirements of ISO 45001. If you are auditing a supplier (second-party audit) then it is up to you what you want to look at; you don’t need to follow the standard at all (for instance you may just want to look at their nonconformance process). If you have specific requirements on a supplier, this is often the audit criteria used in a second-party audit.

You can learn more about auditing using ISO 19011 in the article: How to perform an internal audit using

ISO 19011, https://info.advisera.com/free-download/how-to-perform-an-internal-audit-using-iso-19011

Documenting ISO 45001

The ISO 45001:2018 standard does not define how you must create your documentation, or how it must look. In terms of procedures you can use whatever format works best for your organization, including flow charts, text documents, or even diagrammatic instructions if that is what works for your employees. As for records, again whatever format make sense to you for a particular record then that is what you can use. This is of course limited by any legal requirements that may exist for records and reports, such as a government form that needs to be submitted.

The general flow for creating documentation should go like this: What information do we need to document? Is there a required format to use (such as legal or other requirement)? If not, what is the best, and simplest, way we can record this information so that it is usable for us?

You can learn more about the new documentation requirements in the article: New approach to ISO 145001 documentation, https://advisera.com/45001academy/blog/2018/03/13/new-approach-to-iso-45001-documentation/

Privacy Shield being invalidated

Since the European Court of Justice “invalidated” the Privacy Shield, data cannot be transferred on the ground of the previous adequacy decision made by the EU Commission. This means that now data transfers must have another legal ground like the Standard Contractual Clauses (SCC) or the Binding Corporate Rules (BCR).

The European Data Protection Board (EDPB) issued a FAQ on the implication on GDPR compliance of the ECJ solution and stated that the data controller must take additional measure to ensure the same level of protection of personal data assured by GDPR: https://edpb.europa.eu/news/news/2020/european-data-protection-board-publishes-faq-document-cjeu-judgment-c-31118-schrems_en

The main issue is that the US data controllers are forced to comply with US law which prevails over Standard Contractual Clause. The EDPB concluded stating that the data controller should consider storing or processing data elsewhere than the US.

You can process personal data outside of the U.S. if you use cloud providers which have servers in the European Union - all the major providers like Amazon AWS, Google Cloud, Microsoft Azure, and others have that option. 

You can find more information about data transfer here:3 steps for data transfers according to GDPR: https://advisera.com/articles/3-steps-for-data-transfers-according-to-gdpr/

You can consider enrolling in our free EU GDPR Foundations CourseEU GDPR Foundations Course https://advisera.com/training/eu-gdpr-foundations-course//

Internal audit

According to the ISO 13485:2016, requirement 8.2.4 Internal audit states that the organization must conduct internal audits at planned intervals. The purpose of an internal audit is to determine whether your quality management system conforms to both all documented arrangments, requirements of the ISO 13485:2016, and all other applicable regulatory requirements. So, yes, you need to perform another internal audit to assess the compliance with MDR. 

For more information on how the internal audit should be performed, please see following articles: 

• Five main steps in the ISO 13485:2016 internal audit - https://advisera.com/13485academy/knowledgebase/five-main-steps-in-the-iso-134852016-internal-audit/
• How to create a checklist for an ISO 13485 internal audit for your QMS - https://advisera.com/13485academy/knowledgebase/how-to-create-a-checklist-for-an-iso-13485-internal-audit-for-your-qms/
• Checklist of ISO 13485 implementation and certification steps - https://advisera.com/13485academy/knowledgebase/checklist-of-iso-13485-implementation-and-certification-steps/

You can even see which documents our ISO 13485:2016 Internal audit documentation toolkit have:

• ISO 13485:2016 Internal Audit Toolkit https://advisera.com/13485academy/iso-13485-internal-audit-toolkit/

• ISO 9001 NC Management

  When one speaks about non-conformities one can be speaking about audit non-conformities or product/service non-conformities.

  

  Let us consider the product/service non-conformity situation.

  When a non-conformity is determined the first priority is to prevent the unintended delivery or use. ISO 9001:2015 provides several alternatives to treat the non-conforming product/service:

  • correcting the non-conformity by repair or rework
  • segregation, containment, return or suspension
  • recall
  • obtaining authorization under concession to use/deliver as is

  After correction quality should be controlled again.

  Record non-conformities occurrence and reasons. Record what was done and the authority that made the decision about what to do.

  The following material will provide you information about nonconformities:

  • ISO 9001 – Understanding dispositions for ISO 9001 nonconforming product - https://advisera.com/9001academy/blog/2014/11/18/understanding-dispositions-iso-9001-nonconforming-product/
  • ISO 9001 – Difference between correction and corrective action - https://advisera.com/9001academy/blog/2016/02/09/iso-9001-difference-between-correction-and-corrective-action/ ion/
  • Free online training ISO 9001:2015 Foundations Course – https://advisera.com/training/iso-9001-foundations-course/
  • Book - Discover ISO 9001:2015 Through Practical Examples - https://advisera.com/books/discover-iso-9001-2015-through-practical-examples/

• Clause for SOP implementation

  If your organization concluded that cleaning and hygiene is relevant for ensuring product or service quality the most relevant clause for that matter is 7.1.4 - Environment for the operation of processes.

  You can find more information below:

  • Clause by clause explanation of ISO 9001:2015: https://info.advisera.com/9001academy/free-download/clause-by-clause-explanation-of-iso-90012015
  • Free online training ISO 9001:2015 Foundations Course – https://advisera.com/training/iso-9001-foundations-course/
  • Book - Discover ISO 9001:2015 Through Practical Examples - https://advisera.com/books/discover-iso-9001-2015-through-practical-examples/
     

• ISO 9001 implementation time

  Smaller organizations (up to 50 employees) usually implement the standard in up to 8 months. When using our Documentation Toolkit, normally: companies of up to 10 employees - usually implement the standard in up to 3 months and companies of up to 50 employees - usually implement the standard in up to 6 months.

  You can find detailed information about how to plan and implement a quality management system in the following links:

  • Checklist of ISO 9001 implementation & certification steps - https://advisera.com/9001academy/knowledgebase/checklist-of-iso-9001-implementation-certification-steps/
  • ISO 9001 Implementation diagram - https://info.advisera.com/9001academy/free-download/iso-9001-implementation-diagram
  • Free webinar on demand - Overview of ISO 9001 implementation steps - https://advisera.com/9001academy/webinar/overview-of-iso-9001-implementation-steps-free-webinar-on-demand/
  • Free webinar on demand - How to use a Documentation Toolkit for the implementation of ISO 9001 - https://advisera.com/9001academy/webinar/how-to-use-a-documentation-toolkit-for-the-implementation-of-iso-9001-free-webinar-on-demand/
  • Free online training ISO 9001:2015 Foundations Course – https://advisera.com/training/iso-9001-foundations-course/
  • Book - Discover ISO 9001:2015 Through Practical Examples - https://advisera.com/books/discover-iso-9001-2015-through-practical-examples/