Search results

IATF Document Hierarchy

According to clause number of 7.5.1 of the IATF 16949:2016  standard; the quality manual shall be documented. Although it is not a requirement, the quality policy generally continues to be documented in the quality manual.
With this new standard, the word  ‘’procedure’’ is not used. Also, there is no definition for the Level 1 document.

To learn more about the mandatory documents, see this free white paper: Checklist of Mandatory Documentation Required by IATF 16949:2016 https://info.advisera.com/16949academy/free-download/checklist-of-mandatory-documentation-required-by-iatf-16949

ISO 13485 and ISO 9001

Basic aspects of Quality management systems in ISO 9001 and ISO 13485 are very similar: documentation control, internal audits, corrective actions, management of non.conforming products, management review. From  medical devices point of view, ISO 13485: 2016 is more important.

To understand better what are similarities and differences between these two standards, please read an article on the following link: Similarities and differences between ISO 9001:2015 and ISO 13485:2016 https://advisera.com/9001academy/blog/2015/01/21/iso-9001-vs-iso-13485/

On this link you can find several white papers about the planning process for implementation od ISO 13485, project proposal and similar: https://advisera.com/13485academy/free-downloads/

Opportunities and challenges of the application of standards

Here are few articles that discuss ITIL/ISO 20000 implementation and it's benefits i.e. challanges:

5 key benefits of ISO 20000 implementation https://advisera.com/20000academy/blog/2016/02/09/5-key-benefits-of-iso-20000-implementation/

4 Crucial Techniques for Convincing your top Management to Implement ISO 20000 https://advisera.com/20000academy/blog/2017/10/31/4-crucial-techniques-for-convincing-your-top-management-to-implement-iso-20000/

What are the most common ISO 20000 implementation myths? https://advisera.com/20000academy/blog/2016/02/23/what-are-the-most-common-iso-20000-implementation-myths/

5 excuses why IT organizations avoid ITIL implementation https://advisera.com/20000academy/blog/2015/08/25/5-excuses-why-it-organizations-avoid-itil-implementation/

How ITIL can help cloud services https://advisera.com/20000academy/blog/2015/07/28/how-itil-can-help-cloud-services/

Risk management process

This order follows exactly the sequence of requirements of ISO 27001.

Please note that the Risk Treatment Plan defines the actions, resources, responsibilities, and dates for the implementation of risk treatment options (e.g., risk transfer and risk mitigation), and you first need these options to be approved, generally as part of the SoA approval, so you can minimize risks of rework or loss of time if a treatment option is not approved.

These articles will provide you further explanation about the risk management process:

• ISO 27001 risk assessment & treatment – 6 basic steps https://advisera.com/27001academy/knowledgebase/iso-27001-risk-assessment-treatment-6-basic-steps/
• Risk Treatment Plan and risk treatment process – What’s the difference? https://advisera.com/27001academy/iso-27001-risk-assessment-treatment-management/#treatment

ISO 9001 Clauses for Construction Companies

Let us start by what clauses could be candidate to non-applicability:

• Does your organization receive project from customers or designs projects? If only receive project from customers, then clause 8.3 is not applicable
• Does regulation, customers, or your internal policy determine traceability requirements? If not, traceability is not applicable
• For construction companies, clauses 8.5.1 f) and 8.5.3 are normally applicable.
   

The following material will provide you more information about non applicable clauses:

• What clauses can be excluded in ISO 9001:2015? - https://advisera.com/9001academy/blog/2015/07/07/what-clauses-can-be-excluded-in-iso-90012015/2015/ 
• Enroll for free course - ISO 9001:2015 Foundations Course - https://advisera.com/training/iso-9001-foundations-course/
• Book - Discover ISO 9001:2015 Through Practical Examples - https://advisera.com/books/discover-iso-9001-2015-through-practical-examples/

Incident Priority Levels & Classes

ITIL doesn't explicitly define priority levels. Priority matrix should be applied based on your SLA's, type of services/business, tool you use, etc.

Here is the article where you can find more details: All about Incident Classification https://advisera.com/20000academy/knowledgebase/incident-classification/

as well as this free webinar

ITIL Incident Management Process Demystified https://advisera.com/20000academy/webinar/itil-incident-management-process-demystified-free-webinar-on-demand/

Documents for distribution company

From ISO 13485:2016 Documentation toolkit, in my opinion, you can exempt the following documents: Design and development, Sterilization and Adverse event investigation. Procedure Production and service provision in your case will be Service provision.

Product vs Service

Yes, ISO 9000:2015 defines product as the output of an organization that can be produced without any interaction taking place between the organization and the customer. The same ISO 9000:2015 defines service as the output from an organization where at least one activity is necessarily between the organization and the customer.

By the way, this theme is a theme that I follow with some attention. I prefer the approach of some marketing scholars that invite us to consider that everything is service. There is even a phrase that I like very much: "Everything is service. A product is an avatar of a service". More and more we see organizations that bet on co-development, co-production, co-creation with customers. When we receive in the mail a simple T-shirt with a message ordered by us. Is it a service or a product?

The following material will provide you information about ISO 9001:

• Understanding Product & Service Provision in ISO 9001 - https://advisera.com/9001academy/blog/2014/10/07/understanding-product-service-provision-iso-9001/
• Enroll for free course - ISO 9001:2015 Foundations Course - https://advisera.com/training/iso-9001-foundations-course/
• Book - Discover ISO 9001:2015 Through Practical Examples - https://advisera.com/books/discover-iso-9001-2015-through-practical-examples/

ISO 27K Competences

ISO 27001 does not prescribe the CISO role, neither the competencies required to run an ISMS, but considering the requirements o the standard, if you have a CISO in your organization, you should consider at least these areas of competencies:
- Standard: knowledge of ISO 27001 standard
- Compliance: to identify interested parties and their requirements
- Documentation: for the development of policies and procedures
- Risk Management: to teach and guide employess during risk assessment and risk treatment process
-Human resources management: to provide awareness and training activities

These articles will provide you further explanation about CISO role and competencies:
- Chief Information Security Officer (CISO) – where does he belong in an org chart? https://advisera.com/27001academy/blog/2012/09/11/chief-information-security-officer-ciso-where-does-he-belong-in-an-org-chart/
- What is the job of Chief Information Security Officer (CISO) in ISO 27001? https://advisera.com/27001academy/knowledgebase/what-is-the-job-of-chief-information-security-officer-ciso-in-iso-27001/

Electronic signatures

Certain procedures in our ISO 13485:2016 toolkit have described workflows (eg. customer complaint process, sales process, evaluation of suppliers). Workflows are not mandatory according to the ISO 13485:2016. 

Advisera does not provide software for ISO 13845, therefore we do not have electronic signatures. The ISO 13485 Documentation Toolkit is only a set of documentation templates, this is not a software.