Search results

Home / Search

Category:
Select
Select

11294 results

Guest

Guest

Create New Topic As guest or Sign in

HTML tags are not allowed

Select

Assign topic to the user

  • Non - conformance

    First is important to note that the concept of major and minor non-conformities is not commonly used in internal audits because the type of the identified non-conformity normally does not affect the development of the internal audit (as it occurs in certification and surveillance audits). Considering that:

    Minor nonconformity - a non-conformity that does not affect the capability of the management system to achieve the intended results. An example might be that you find some people have not undertaken training that the organization has made mandatory (ISO 27001 clause 7.2), but you find that those people are still competent to carry out their tasks.

    Major nonconformity - a non-conformity that affects the capability of the management system to achieve the intended results or in other words, when you have found that the requirement of the standard has not been met. For example, if an organization completely failed to fulfill a certain requirement; if a process has completely fallen apart; or if you have several minor nonconformities that are related to the same process, or to the same element of your management system.

    Regarding your scenario, since you have several cases in the same process, you could consider it a major non-conformity, because of its recurrence.

    This article will provide you a further explanation about major and minor nonconformities:

  • GDPR - Breaking of Confidentiality

    I have been in dispute with a care company over an invoice dating from late 2018. Basically the company was trying to charge my mother, who suffers from *** for appointments where they didn't turn up or left early to get to other appointments. I asked for some information under the "Freedom of Information Act 2000" several months back which the care company did not supply. Recently a Debt Recovery company contacted me reference the unpaid invoice. We have been in communication for a several weeks now. This week I received an email from the Debt Recovery company attached to the email was some of the information that I had requested from the care company. The attachments were a copy of my mothers contract with the care company, a copy of her Individual Care and Support Agreement and a copy of my Power of Attorney for my mothers finances.

    Are the care company in breach of GDPR for sharing this information with a third party i.e. the Debt Recovery company?

    First, you should verify if any privacy notice was given to your mother and if she signed it. She may have given consent to data processing and data transfer.

    In any case, Article 6 GDPR paragraph 1 (b), (f) states that data processing (without consent) is lawful when it is necessary to perform a contract between the controller and the data subject or for the purposes of a legitimate interest of the controller or a third party. Therefore, transferring data to collect money for an unpaid invoice is considered lawful.

    You should verify with a lawyer if the Member State where you live introduced some internal regulation over data processing in debt collecting procedure which limits data transferring in some way. 

     

    What can I do about this breach of confidentiality?

    It can be considered a breach of confidentiality only if your mother signed a privacy notice where it was stated that personal data would not transfer to any third party. Otherwise, it can be considered lawful.

     

    Can I take the Care Company to court over this matter? As I am really not happy with them over this!

    I can understand that you are not happy, you should ask for advice from a lawyer in your own country and verify if there is any chance to defend from their request on the basis of the care service provided. 

    You can find more information about data processing here:

    You may also consider enrolling in this online EU GDPR Foundations Course:
    EU GDPR Foundations Course: https://advisera.com/training/eu-gdpr-foundations-course//

  • Integrated joint audit

    When auditing an integrated management system, one must consider the High-Level Structure of the management system standards. Auditing clauses 4, 5, 7, 9 and 10 is straightforward

    When auditing an integrated management system, one must consider two realities of an organization:

    • Its processes; and
    • Its facilities.

    With clause 6 of each standard an organization determines risks around processes, products and business, compliance requirements, environmental aspects, risk of employee injury, and defines action plans and objectives.

    When auditing, you follow an itinerary along its facilities where you audit processes (clause 8), and for each location the relevant environmental aspects and risks of employee injury and related procedures.

    You follow more information below:

  • MDR Medical device documentation for distributors

    Thanks for sharing this detailed breakdown of requirements under EU MDR 2017/745 Article 14—this is really useful for distributors navigating compliance.

    From a practical standpoint, I’d add that even though MDR doesn’t mandate certification, aligning your QMS with ISO 13485:2016 is becoming essential in real-world audits and supplier evaluations.

    Also, beyond checking CE certificates and Declarations of Conformity, distributors should ensure proper traceability and documentation flow across the supply chain. This becomes especially important when dealing with components like medical device stamping  ( https://www.akstamping.com/medical ) parts, where material specifications, tolerances, and batch traceability directly impact compliance and product safety.

    A few additional checks that help in practice:

    • Verification of authorized representative (for non-EU manufacturers)
    • Registration status in EUDAMED
    • Complaint handling and post-market surveillance alignment


    Regarding IFUs and labeling, ensuring country-specific language compliance is often underestimated but critical during inspections.

    Overall, I agree with your point—since ISO 13485 is the only harmonized QMS standard under MDR, it effectively sets the benchmark even for distributors.

  • ISO/IEC ISMS 27001 Annex A

    Please note that ISO 27001 does not require an organizational chart to present how the organization supports information security. The most common way to document responsibilities related to information security is by writing them in the implemented policies and procedures.

    To see how documented responsibilities look like, I suggest you take a look at the free demo of our ISO 27001 documentation toolkit at this link: https://advisera.com/27001academy/iso-27001-documentation-toolkit/

    These articles will provide you a further explanation about documenting responsibilities:

    This material will also help you regarding documentation:

  • Query on Annex A Controls - IS027001

    Software maintenance is basically covered by controls from section A.14 System acquisition, development, and maintenance (there is no single control specific for this purpose).

    Control A.14.1.1ensures that maintenance is done in order to reach some requirements set to protect information.

    The other controls you mentioned are more related to the security of information systems implementation and daily operations.

    These articles will provide you a further explanation about the software development life cycle:

  • Performing Security Risk Analysis

    I'm assuming that by VAPT you mean "Vulnerability Assessment & Penetration Test".

    Considering that, first is important to note that the purpose of risk analysis is to evaluate the risk, quantitatively or qualitatively, and that security audit is used to find out if security is being performed as planned, or results achieved are those expected, and that VAPT is used to find out if there are vulnerabilities in your environment that could be exploited.

    All of this considered, security audit and VAPT cannot be used for risk analysis, but they can be used for risk identification because their results can point situations where information can be compromised (i.e., risks).

    These articles will provide you a further explanation about the risk assessment process:

    These materials will also help you regarding risk assessment:
Page 382 of 1130 pages

Didn’t find an answer?

Start a new topic and get direct answers from the Expert Advice Community.

CREATE NEW TOPIC +