Search results

Admin Expert Guest

Created: {{ topic.date_formatted }} Last commented:   {{ topic.last_comment.date_formatted }} Read later:   Pin topic: Unpin topic: Pinned topic:

Assigned topic

Private

IN COMMENT:

COMMENT:

Read more

Replies: {{ topic.reply_count }} Be the first to comment

Tags: {{tag.name}},

Votes {{ topic.downvotes_count }} {{ topic.upvotes_count }}

Want to vote?

Sign in to make your opinion count.

SIGN IN

Load more

There are no topics yet.

• Key Universal Principles of Segregation of Duties

  The most common criteria to be considered for segregation of duties of critical activities are:

  • the person who elaborates something does not approve it
  • the person how performs a task does not review it

  Considering that, for example, the internal auditor/security tester should not be the same person as the service manager. The service manager defines and handles changes/incidents, while internal auditor/security tester verifies if these are effective. So, you should verify exactly which activities will be performed by each role to identify potential conflicts of interest.

  For further information, see:

  • Segregation of duties in your ISMS according to ISO 27001 A.6.1.2 https://advisera.com/27001academy/blog/2016/11/21/segregation-of-duties-in-your-isms-according-to-iso-27001-a-6-1-2/

  These materials will also help you regarding segregation of duties:

  • ISO 27001 Annex A Controls in Plain English https://advisera.com/books/iso-27001-annex-controls-plain-english/
  • ISO 27001 Foundations Course https://advisera.com/training/iso-27001-foundations-course/

• ISO 27001 Internal Auditor or Lead Auditor

  This depends on your career objectives:
  - The ISO 27001 Internal Auditor certification recognizes people capable of ISMS against ISO 27001. This allows them to perform audits in their own organizations.
  - The ISO 27001 Lead Auditor certification recognizes people who have competency on auditing an ISMS against ISO 27001 requirements and qualifies them to audit other organizations on behalf of a customer, or to start the process to become a certification auditor.

  These articles will provide you a further explanation about personal certifications:
  - What does ISO 27001 Lead Auditor training look like? https://advisera.com/27001academy/blog/2016/08/29/what-does-iso-27001-lead-auditor-training-look-like/
  - ISO 27001 Internal Auditor training – Is it good for my career?  https://advisera.com/27001academy/blog/2016/03/29/iso-27001-internal-auditor-training-is-it-good-for-my-career/  

  These materials will also help you regarding audit training:
  - ISO Internal Audit: A Plain English Guide https://advisera.com/books/iso-internal-audit-plain-english-guide/
  - ISO 27001:2013 Internal Auditor Course https://advisera.com/training/iso-27001-internal-auditor-course/
  - ISO 27001:2013 Lead Auditor Course https://advisera.com/training/iso-27001-lead-auditor-course/

• ISO 27001 Lead Implementer Course

  The material of our ISO 27001:2013 Lead Implementer Auditor Course is designed by Advisera, and at this moment we are working on its accreditation by Exemplar Global (formerly RABQSA), but it would not be advisable to use the learning material from one course to pass the exam of another course - therefore, if you plan to go for e.g. BSI course, you should use their learning materials.

• Review ISMS document

  You should review all ISMS scope content, considering the internal and external issues (e.g., internal culture, iplemented technologies, market trends, new technologies, etc.) that can affect the ISMS and its proposed objectives, as well as the defined requirements of the interested parties (e.g., contractual clauses, legislation, etc.).

  A change in one of these aspects may require a change in the ISMS scope, either to add, exclude or change something in the current ISMS scope document.

  
  These articles will provide you a further explanation about the scope definition:
  - How to define the ISMS scope https://advisera.com/27001academy/knowledgebase/how-to-define-the-isms-scope/
  - Problems with defining the scope in ISO 27001 https://advisera.com/27001academy/blog/2010/06/29/problems-with-defining-the-scope-in-iso-27001/
  - How to define context of the organization according to ISO 27001 https://advisera.com/27001academy/knowledgebase/how-to-define-context-of-the-organization-according-to-iso-27001/
  - How to identify ISMS requirements of interested parties in ISO 27001 https://advisera.com/27001academy/blog/2017/02/06/how-to-identify-isms-requirements-of-interested-parties-in-iso-27001/

  These materials will also help you regarding scope definition:
  - How to set the ISMS scope according to ISO 27001 [free webinar on demand] https://advisera.com/27001academy/webinar/how-to-set-the-isms-scope-according-to-iso-27001-free-webinar-on-demand/
  - Free online training ISO 27001 Foundations Course https://advisera.com/training/iso-27001-foundations-course/

• Implementation of iso 27001 controls

  Since you already identified all controls that are applicable and the percentage by which they are already implemented, my suggestion for additional criteria to prioritize implementation are:
  - controls which affects the highest risks (in fact this should be your first criteria)
  - which controls will have a more positive impact after implementation
  - which controls require less effort to be implemented

  Regarding starting with those who are lower in percentage, please note that a common risk in implementation projects is that a long period without results can decrease interest in the project by its supporters, so you should balance the implementation of controls which treat the highest risks with those that deliver the quickest results (i.e., implemented and measured controls as fast as you can).

  These articles will provide you a further explanation about common controls:
  - The most common physical and network controls when implementing ISO 27001 in a data center https://advisera.com/27001academy/blog/2019/02/26/the-most-common-physical-and-network-controls-when-implementing-iso-27001-in-a-data-center/
  - How to apply information security controls in teleworking according to ISO 27001 https://advisera.com/27001academy/blog/2021/10/27/how-to-use-iso-27001-to-secure-data-when-working-remotely/

  These materials will also help you regarding controls implementation:
  - ISO 27001 Annex A Controls in Plain English https://advisera.com/books/iso-27001-annex-controls-plain-english/
  - Preparations for the ISO Implementation Project: A Plain English Guide https://advisera.com/books/preparations-for-the-iso-implementation-project-a-plain-english-guide/
  - ISO 27001 Foundations Course https://advisera.com/training/iso-27001-foundations-course/

   

• Internal ISO 9001-2015 audit

  I have identified the sections in our company manual to answer the questions, but do I need to obtain paper proof?

  Answer:

  You need to obtain evidences that support the answers to your questions. What people say in their answers are not facts, are pseudofacts. You have to get evidences, facts that support what people say in their answers. For example, it might be a demonstration, or it might be a record, or it might be corroboration from others, in different places and at different times. So, you need proof, but not necessarily a paper proof.

  if I discover a procedure that has not been implemented, do I include it in the audit with a procedure to correct?

  Answer:

  No. If the procedure is not implemented you found a nonconformity. You should write the nonconformity with evidences. That is your role as auditor.

  Auditors do not compromise their independence and impartiality with a solution to the nonconformity. The solution is up to the quality manager or, even better, to the audited area manager. Auditees may decide that the procedure is OK, and what was wrong was a lack of training, ineffective training for the procedure users, for example. It is not auditors job to propose solutions.

  The following material will provide you more information about internal audit:

  • How to write a good ISO 9001 audit nonconformity? - https://advisera.com/9001academy/blog/2018/04/24/how-to-write-a-good-iso-9001-audit-nonconformity/
  • Free online training ISO 9001 Internal Auditor - https://advisera.com/training/iso-9001-internal-auditor-course/
  • Book ISO Internal Audit: A Plain English Guide https: //advisera.com/books/iso-internal-audit-plain-english-guide/

• EN 13795/ISO 13485

  In the standard  EN 13795-1:2019 Surgical clothing and drapes - Requirements and test methods - Part 1: Surgical drapes and gowns are specified performance requirements for gowns. There are stated the tests and criteria for acceptance for different tests for standard and high performance. But, you as the manufacturer are responsible for defining the specifications of your medical device.   

• IATF Documentation and records

  Yes, your action is correct. 

  The process performance (KPI) data of the last 12 months are taken into consideration in every IATF 16949: 2016 audit. These data should be recorded for each process defined in the quality management system. I recommend that you follow the process performance monthly or quarterly.

  Example: If your last audit was done in April 2019; 12-month process performance data between April 2019 and April 2020 will be checked in your April 2020 IATF 16949:2016 audit. Of course, the goals and results of each process performance should be ready for the year 2018 and 2019.

  In particular, the auditors want to see the progress of the targets by years. This is also very good evidence for the organization's level of continuous improvement.

 For more information please to read the following article: 

• How to define Key Performance Indicators for a QMS based on ISO 9001 https://advisera.com/9001academy/24/define-key-performance-indicators-qms-based-iso-9001/-iso-9001/ 

For more information, please see the following materials:

• IATF 16949:2016 Documentation Toolkit https://advisera.com/16949academy/iatf-16949-2016-documentation-toolkit/
• Managing ISO Documentation: A Plain English Guide https://advisera.com/books/managing-iso-documentation-plain-english-guide/