Search results

ISO certification code

You can ask an organization a copy of their certificate. Check the name of the certification body and verify if its name is in any list of an accreditation body recognized by the International Accreditation Forum (IAF). If that certification body is working with an accreditation body recognized by the IAF you can contact them and confirm if their certificate is valid or not. Sometimes certification bodies  issue lists with the name of certified organizations. In that case you can search the name there.

The following material will provide you more information about solving doubts around a certificate validity:

- How to know whether ISO 9001 certificate is valid? – https://advisera.com/9001academy/blog/2018/05/23/how-to-know-whether-iso-9001-certificate-is-valid/- Free webinar – ISO 9001:2015 clause 4 – Context of the organization, interested parties, and scope – https://advisera.com/9001academy/webinar/iso-90012015-clause-4-context-of-the-organization-interested-parties-and-scope-free-webinar-on-demand/- Enroll for free course – ISO 9001:2015 Foundations Course – https://advisera.com/training/iso-9001-foundations-course/- Book – Discover ISO 9001:2015 Through Practical Examples – https://advisera.com/books/discover-iso-9001-2015-through-practical-examples/

SaaS products

Basically, you need to include in the ISMS scope the cloud elements you can control - this article will provide you with details: Defining the ISMS scope if the servers are in the cloud https://advisera.com/27001academy/blog/2017/05/22/defining-the-isms-scope-if-the-servers-are-in-the-cloud/ 

GDPR & CE Mark

Would you recommend for a medical device company that maintains a QMS system (under CE mark) to incorporate all GDPR changes inside the QMS?

QMS is established to certify quality and compliance of products to legal requirements.

A QMS system under CE mark may be related to product safety which can affect data protection if personal data are acquired by the medical device.

Certification process is encouraged by European Authorities and Member States under article 42 GDPR.

Are there subjects or areas that you would not want to be checked by the CE/QMS audit that relate to GDPR?

CE mark or QMS audit can be helpful to demonstrate accountability to GDPR requirements. However, depending on QMS audit that you implement in your company some areas may be not covered. Employee data processing and its storage or the transfer of data outside the EU may be not covered, if your QMS is focused only on product safety, it can be an example. Also, compliance of the data processor to GDPR provision should be checked.

Please consider that according to paragraph 4 article 42 GDPR “certification does not reduce the responsibility of the controller or the processor for compliance with this Regulation and is without prejudice to the tasks and powers of the supervisory authorities”.

Joint responsibility

I would like to have known whether it is possible that jointly responsible persons can assert a legitimate interest as a legal basis?

Legitimate interest is more deeply explained in the preamble of GDPR. Paragraph 47 of GDPR explains how to use legitimate interest as a legal ground.

The key element of legitimate interest as a legal ground of data processing is the existence of a relevant and appropriate relationship between “the data subject and the controller in situations such as where the data subject is a client or in the service of the controller.” (see paragraph 47 of the Preamble of GDPR)

Therefore, you must assess whether the four companies have a relevant and appropriate relationship with the customer (i.e. they all provide a service to the customer like sales of goods and logistics).
It must be assessed whether “a data subject can reasonably expect at the time and in the context of the collection of the personal data that processing for that purpose may take place.” It means that the customer who disclosed his personal data for a certain purpose can reasonably expect that his data will be processed by all the four companies because of the nature of the service provided.

In those cases only legitimate interest can be used as a legal ground of data processing by co-controllers.

Example: 4 independent organizations/companies want to share their customer and supplier data because they partially overlap. If one of the four companies wants to create a new customer, they should first be able to search in a joint program to determine whether it already exists so that they do not have to create it again. Each of these four companies can view this customer record and change it if necessary.

Can I assert a legitimate interest here and say that it makes work easier for the four companies and also means data minimization?

Paragraph 48 in preamble rules the situation of group companies or grouped undertakers which jointly process personal data.

According to paragraph 48 of the GDPR Preamble, the controllers “may have a legitimate interest in transmitting personal data within the group of undertakings for internal administrative purposes, including the processing of clients' or employees' personal data.”

Delivery and monitoring records within ISO 9001 clauses

Based on your information, as an auditor, I would write that the ISO 9001:2015 clause is 7.5.3 b). Let us consider that you are writing an audit nonconformity. Now, the manager of the warehouse/delivery, when answering the request for corrective action, should look for the root cause of the contradiction. For example, during his/her investigation he/she might discover that it is a lack of competence issue (clause 7.2), or a misleading identification issue (clause 8.5.2), or a lack of people at a certain shift (clause 7.1.2).

The following material will provide you information about audit nonconformities:
- Article – How to write a good ISO 9001 audit nonconformity? - https://advisera.com/9001academy/blog/2018/04/24/how-to-write-a-good-iso-9001-audit-nonconformity/

- Article - Seven Steps for Corrective and Preventive Actions to support Continual Improvement - https://advisera.com/9001academy/blog/2013/10/27/seven-steps-corrective-preventive-actions-support-continual-improvement/
- Article - How to use root cause analysis to support corrective actions in your QMS - https://advisera.com/9001academy/blog/2016/03/01/how-to-use-root-cause-analysis-to-support-corrective-actions-in-your-qms/
- ISO 9001:2015 Internal Auditor Course - https://advisera.com/training/iso-9001-internal-auditor-course/
- Book - ISO Internal Audit: A Plain English Guide - https://advisera.com/books/iso-internal-audit-plain-english-guide/

ITIL/ISO 20000 Documenting IT devices

#1 If this list includes items you need to manage in order to deliver a service(s) - then you need to document them.

#2 Partially SDP can be seen as a functional specification (with extended content). But, that also depends on what kind of services you are delivering, how deteiled your functional specification is, etc. 

Here is the article with more details: ITIL Service Design Package – everything under one roof https://advisera.com/20000academy/blog/2014/10/07/itil-service-design-package-everything-under-one-roof/

Capacity Management - well, part of the Capacity Plan relates to business requirements. But you have to, also, plan how to answer (with technology) those requirements. And you have to define how to monitor usage of these resources, react when you need, etc. 

This article can help you further: ITIL Capacity Plan – A document you need, but probably don’t have https://advisera.com/20000academy/knowledgebase/itil-capacity-plan-a-document-you-need-but-probably-dont-have/

Difference between AS 9100 and EN 9100

There's is no real difference between AS9100 and EN9100. These are just the different publishing titles for North America and Europe, however,  the requirements are thre same. 

Current revision of ISO 9001:2015

No. The current version of ISO 9001 is the one published in September 2015 and there is no revision since then.

In this article you can check the history of ISO 9001 revisions - The history and future of the ISO 9000 series of standards - https://advisera.com/9001academy/blog/2019/04/15/history-of-the-iso-9000-series-of-standards-and-what-to-expect-next/

Additional benefits of ISO 9001 for Testing & Calibration labs

Truth is that ISO 9001 and ISO 17025 have different purposes. ISO 9001 is about implementing a quality management system and is applicable to any kind of organization. Quality management systems can be certified by a certification body.

ISO 17025 is about “General laboratory competency of testing calibration requirements” and is applicable to laboratories that produce results, like composition of a sample, that can be used in a court of law. ISO 17025 main concern is competent, impartial, and consistent operation of laboratories. ISO 17025 is mainly used by calibration laboratories. Laboratories are accredited by an accreditation body.

The following material will provide you more information about ISO 17025:

- ISO 17025 vs. ISO 9001 – Main differences and similarities - https://advisera.com/17025academy/blog/2019/07/11/iso-17025-vs-iso-9001-main-differences-and-similarities// 

- Six key benefits of ISO 17025 implementation - https://advisera.com/17025academy/blog/2019/10/18/six-key-benefits-of-iso-17025-implementation/

- Diagram of ISO 17025 Implementation Process - https://info.advisera.com/17025academy/free-download/diagram-of-iso-17025-implementation-process

- What is ISO 17025? - https://advisera.com/17025academy/what-is-iso-17025/ 

- Please check our ISO/IEC 17025 Blog - https://advisera.com/17025academy/blog/ 

- Download free ISO/IEC 17025 materials - https://advisera.com/17025academy/free-downloads/

Maintaining quality documentation

Whenever ISO 9001:2015 uses the formula “maintain documented information” it is about keeping documents approved, distributed and updated. Whenever ISO 9001:2015 uses the formula “retain documented information” it is about keeping records. This article List of mandatory documents required by ISO 9001:2015 - https://advisera.com/9001academy/knowledgebase/list-of-mandatory-documents-required-by-iso-90012015/ gives an idea about documents and records relevant for an ISO 9001:2015 quality management system.

Advisera developed an ISO 9001:2015 Documentation Toolkit - https://advisera.com/9001academy/iso-9001-documentation-toolkit/ with live expert support. A tool to accelerate the design of quality system documentation. Please check also this free webinar on demand - How to use a Documentation Toolkit for the implementation of ISO 9001 - https://advisera.com/9001academy/webinar/how-to-use-a-documentation-toolkit-for-the-implementation-of-iso-9001-free-webinar-on-demand/

You can enroll for free in this course - Free online training ISO 9001:2015 Foundations Course - https://advisera.com/training/iso-9001-foundations-course/
- Book – (where I use the process approach this way) - Discover ISO 9001:2015 Through Practical Examples - https://advisera.com/books/discover-iso-9001-2015-through-practical-examples/