Search results

ISO 13485 implementation

The first thing I would do myself is to implement a general procedure to keep track of actions and agreements within the organization. I do not see it? Why? How to do it?

In ISO 13485:2016, there is no direct requirement to have a documented procedure to keep track of actions and agreements. In requirement 7.4.2 Purchasing information is stated there is a necessity for a written agreement that supplier. To the extent required for traceability given in 7.5.9, the organization shall maintain relevant purchasing information in the form of documents (see 4.2.4) and records (see 4.2.5). There fore, it is up to you how you will document this. You can write a procedure for managing outsourced processes where you will state methods and frequency of the control over the outsourced processes, or add this section in the Purchasing documented procedure.

Following article can provide you more information about critical suppliers:

• How can ISO 13485 clause 7.4, Purchasing, enhance procurement? https://advisera.com/13485academy/blog/2018/04/18/how-can-iso-13485-clause-7-4-purchasing-enhance-procurement/

You can see how our Quality Agreement for Critical Supplier looks like on the following link: https://advisera.com/13485academy/documentation/quality-agreement-for-critical-supplier/

We are a very small startup for a simple small noninvasive medical device. Both my partner and myself are very experienced in MRI (***), CT (***), etc, although it is 20 years since we worked in a QMS. I want to define Research and predevelopment as a process outside the QMS, then Design transfer to a clinical trial process and to subcontractors inside the QMS We will subcontract engineering/development, manufacturing, service, logistics to ISO13485 certified high-quality partners. We will have these partners audited regularly by consultants we contract and sign the audit reports ourselves after review. Can we somewhere buy a core (just enough) QMS that complies with ISO13485? Your toolkit is much more than we need, do you have a core toolkit as well?

Our ISO 13485:2016 is a basic toolkit that covers all mandatory documents required by the standard. You can buy the whole toolkit, or you can buy separately documents that you considered that you need. If you go to the end of this web page, you can see each document and purchased what is necessary for you: https://advisera.com/13485academy/iso-13485-documentation-toolkit/ 

But please be aware that no matter that you are outsourced some processes, you are still responsible for them. In the eyes of the auditor from the certification body, you need to have at least the list of the documents form the outsourced companies. All outsourced processes also need to be stated in the Quality manual together with the connection to your processes. 

For more information on controlling the outsourced processes using ISO 9001 see this article:

• How to control outsourced processes using ISO 9001 - https://advisera.com/9001academy/blog/2015/05/05/how-to-control-outsourced-processes-using-iso-9001/

Do you have a service that adapts your toolkit to our needs? Including filling in of company name etc.

When buying the toolkit, depending on the type of toolkit that you buy, you can get support in the following ways:

• 10 questions via email per month or Unlimited email support
• 1, 5, or 15 hours of one-on-one support with an ISO 13485 expert
• Expert review of 1, 5, or 15 completed documents
• Pre-audit check (1-hour call where we can check the most important items that the certification auditor will be looking for)

For more details about options when buying a toolkit, please see the following link - https://advisera.com/13485academy/iso-13485-documentation-toolkit/ and go to the end of the page.

ISO 9001 Internal Audit

I do not have all the information. One possible clause is 7.1.5.2 b).

The organization considered that calibration was relevant. The organization scheduled the calibration but then did not perform, did not ensure that equipment was calibrated.

You can find more information below:

• ISO 9001 audit checklist for laboratory - https://advisera.com/9001academy/blog/2018/09/04/iso-9001-audit-checklist-for-laboratory/
• Free online training ISO 9001:2015 Foundations Course – https://advisera.com/training/iso-9001-foundations-course/
• Book - Discover ISO 9001:2015 Through Practical Examples - https://advisera.com/books/discover-iso-9001-2015-through-practical-examples/
   

ISO 14001 Wastage of resources

You can start with clause 6.1.2, when you determine environmental aspects and impacts and you realize that, more than consumption, you have wastage of water. Then you can have clause 6.1.4 where you have an action plan to address that significant environmental aspect. That action plan may be translated into rules, good practices for operational control, clause 8.1.

Please check this information below with more detailed answer:

• 4 steps in identification and evaluation of environmental aspects - https://advisera.com/14001academy/knowledgebase/4-steps-in-identification-and-evaluation-of-environmental-aspects/
• What makes an environmental aspect significant in ISO 14001? - https://advisera.com/14001academy/blog/2015/03/09/what-makes-environmental-aspect-significant-in-iso-14001/
• Defining and implementing operational control in ISO 14001:2015 - https://advisera.com/14001academy/blog/2016/04/11/defining-and-implementing-operational-control-in-iso-140012015/140012015/
• Enroll for free in this course – ISO 14001:2015 Foundations Course - https://advisera.com/training/iso-14001-internal-auditor-course/
• Book – The ISO 14001:2015 Companion - https://advisera.com/books/the-iso-14001-2015-companion/

ISO27001 - How to meet the requirement of A.17.1 and A.17.1.2

I'm assuming you are referring to controls A.17.1.1 and A.17.1.2.

Considering that, controls from ISO 27001 Annex A section A.17 (Information security aspects of business continuity management) aims to minimize risks that, in case of an event that disrupts business operations, the information will be kept protected, and operations that rely on them will be resumed as quickly as possible.

To show compliance with control A.17.1.1, an organization needs to identify and include information security requirements in its reparations for business continuity. To do that the organization should ensure that the information security requirements are included when planning for business continuity and disaster recovery. One way to do that is by performing a business impact analysis for information security aspects to verify if the information security requirements being covered in adverse situations.

To show compliance with control A.17.1.2, an organization needs to ensure processes, procedures, and controls required for information security are documented, implemented, and maintained. To do that the organization should:

• put in place a management structure to prepare for, mitigate and respond to a disruptive event using proper resources and competence;
• nominate competent personnel to manage incidents
• documented and approve plans, response and recovery procedures to handle incidents

This article will provide you a further explanation about business continuity for ISO 27001:

• How to use ISO 22301 for the implementation of business continuity in ISO 27001 https://advisera.com/27001academy/blog/2015/06/15/how-to-use-iso-22301-for-the-implementation-of-business-continuity-in-iso-27001/

This material will also help you regarding business continuity for ISO 27001:

• ISO 27001 Annex A Controls in Plain English https://advisera.com/books/iso-27001-annex-controls-plain-english/

Affixing ISO 13485 mark on product

Rules and obligations of how to manage a certification mark, where you can all put a mark for ISO 13485 you must get from your certification body.

ISO 14001 Internal and external issues

Internal issues are about events or products and services that may affect an organization’s environmental performance. For example, a transport company with a very old and inefficient truck fleet.

External issues are about legal, economic, social, or political issues. For example, government may impose more demanding limits to emissions or customers may decide to reward companies with better environmental performance.

As examples of measurable environmental targets, we may have:

• Reducing waste sent to landfills in %
• Reduce hazardous waste production in %
• Increasing waste recycling in %
• Reduce water consumption per unit produced
• Reduce CO2 emissions from transport used per unit produced 

You just have to add a specific target, time frame and responsible.

As examples of risks we may have:

As examples of opportunities we may have:

• A local government help fund to support truck fleet renovation.

You can find more information below:

• Determining the context of the organization in ISO 14001 https://advisera.com/14001academy/knowledgebase/determining-the-context-of-the-organization-in-iso-14001/
• ISO 14001 risks and opportunities vs. environmental aspects - https://advisera.com/14001academy/blog/2016/03/21/how-does-product-life-cycle-influence-environmental-aspects-according-to-iso-140012015/
• Risks and opportunities in ISO 14001:2015 – What they are and why they are important - https://advisera.com/14001academy/blog/2016/03/07/risks-and-opportunities-in-iso-140012015-what-they-are-and-why-they-are-important/
• ISO 14001 document template: Procedure for Identification and Evaluation of Environmental Aspects and Risks - https://advisera.com/14001academy/documentation/procedure-for-identification-and-evaluation-of-environmental-aspects/
• Enroll for free in this course – ISO 14001:2015 Foundations Course - https://advisera.com/training/iso-14001-internal-auditor-course/
• Book – The ISO 14001:2015 Companion - https://advisera.com/books/the-iso-14001-2015-companion/

ISO 9001 Common quality risks in IT functions

Start with the purpose of the IT function.

What are the expected results of the work of the IT function?

When working with ISO 9001:2015, the risk is the effect of uncertainty on objectives – or anything which may impact upon meeting objectives or expected results.

I can think of the following negative outcomes:

• Lose privacy data from customers
• Lose access to data from customers or operations due to virus attack
• Inability to operate due to IT down

More important than the examples is having a methodology.

The following material will provide you more information about risks and opportunities:

• How to address risks and opportunities in ISO 9001 - https://advisera.com/9001academy/blog/2016/06/21/how-to-address-risks-and-opportunities-in-iso-9001/
• Please check this free webinar on-demand - Free webinar – How to implement risk management in ISO 9001:2015 - https://advisera.com/9001academy/webinar/how-to-implement-risk-management-in-iso-90012015-free-webinar/
• Enroll for the free course - ISO 9001:2015 Foundations Course - https://advisera.com/training/iso-9001-foundations-course/
• Book - Discover ISO 9001:2015 Through Practical Examples - https://advisera.com/books/discover-iso-9001-2015-through-practical-examples/

Life cycle perspective

ISO 14001:2015 states that organizations when determining environmental aspects and impacts should consider the lifecycle of its products and services. ISO 14001:2015 uses the word “consider” because each organization must be aware of its context. A small organization has little power or impact over suppliers. A small organization has little influence over its customers and/or customers’ customers. So, considering your organization’s power and influence and the set of suppliers and customers and other participants until final disposal of your products or services, evaluate where significant environmental aspects and impacts are and where your power and influence can help reduce or minimize environmental impacts. Then, invite your suppliers and customers to work with you in order to develop action plans that can improve the relationship with the environment.

You can find more detailed information below:

• Article - How does product life cycle influence environmental aspects according to ISO 14001:2015: https://advisera.com/14001academy/blog/2016/03/21/how-does-product-life-cycle-influence-environmental-aspects-according-to-iso-140012015/
• Article - Lifecycle perspective in ISO 14001:2015: what does it mean: https://advisera.com/14001academy/blog/2017/02/20/lifecycle-perspective-in-iso-140012015-what-does-it-mean/
• Enroll for free online training - ISO 14001:2015 Foundations Course: https://advisera.com/training/iso-14001-internal-auditor-course/
• Book – The ISO 14001:2015 companion: https://advisera.com/books/the-iso-14001-2015-companion/