Search results

ISO 9001 Design and Development exemption

Let us consider the possibility of a customer requesting your organization an expert to provide the service X. What the customer expects from your organization is the selection of competent people able to work with them. So, perhaps the service that requires certification is not what the person does for the customer, but the service of identifying the customer's needs and hiring/assigning the right person for the project. 
I find it odd that a company providing engineering consulting services considers clause 8.3 not applicable. If I were in your position and with doubts I would contact one or two certification bodies and ask their opinion. Remember, after all, they are your suppliers, and they want to win a customer. So, they have all the motivation to answer you.

Risks and Opportunities in the HIRA register

Risks and opportunities in the ISO 45001:2018 standard are looking at top level risks rather than individual risks posed by specific job functions. For instance, a top-level risk may be posed by a supplier of a chemical notifying you that they will no longer make this chemical after a certain date. This is not the risk from a direct hazard, but rather a risk to future processing. These do not need to be recorded in the HIRA register (in fact the ISO standard does not use this term) and you can keep records in any fashion you see fit.

You can find out more about the new risk and opportunities requirements in ISO 45001 in the article: What are the new requirements for risks and opportunities according to ISO 45001?, https://advisera.com/45001academy/blog/2018/04/25/what-are-the-new-requirements-for-risks-and-opportunities-according-to-iso-45001/

Design and development

what type of documents do I need to fulfil the requirements of clause 8.3

Answer:

Please check this article about the mandatory documents required by ISO 9001:2015 - List of mandatory documents required by ISO 9001:2015 - https://advisera.com/9001academy/knowledgebase/list-of-mandatory-documents-required-by-iso-90012015/ there you can check that only records are mandatory. However, I recommend that organizations develop a procedure about the good design and development practices that need to be followed and authorities and responsibilities.
 

can I have any such formats for Planning, input, controls, outputs and changes?"

Answer:

Yes, you can have a format for each topic, or for two or more topics simultaneously.
 

The following material will provide you more information about design and development:

- The ISO 9001 Design Process Explained - https://advisera.com/9001academy/blog/2013/11/05/iso-9001-design-process-explained/
- Procedure for Design and Development - https://advisera.com/9001academy/documentation/procedure-design-development/
- Free online training ISO 9001:2015 Foundations Course - https://advisera.com/training/iso-9001-foundations-course/
- Book – (where I use the process approach this way) - Discover ISO 9001:2015 Through Practical Examples - https://advisera.com/books/discover-iso-9001-2015-through-practical-examples/

Supplier Security

Based in your attached document, I'm assuming you are referring to a document similar to a "Confidentiality Statement" (the term “Order data protection agreement” does not exist in the standard, nor it is a common term).

Considering that, please note that for ISO 27001, you only have to implement a "Confidentiality Statement", or similar document like the ”Order Data Protection Agreement”, or any other type of control, if:
- the results of risk assessment require the implementation of such document
- there are legal requirements (e.g., laws and contracts) which require the implementation of such document
- there is a top management decision for implementation of such document

If none of the above mentioned situations occur, then you do not need to implement a "Confidentiality Statement", or ”Order Data Protection Agreement”.

Considering our toolkit, we have a "Confidentiality Statement" template, located on folder 08 Annex A Security Controls >> A.7 Human Resource Security, that you can evaluate if it can fulfill your needs. It contains the minimum required for compliance with the standard (for further security you should consider seeking expert legal advice because we are not legal experts).

Regarding your document, it seems fine as a "Confidentiality Statement", with more clauses than our "Confidentiality Statement", but again we recommend you to seek legal advice.

Another way to handle this situation is by including a security clause in your service agreement with those parties working with you.

This article will provide you a further explanation about control selection and security clauses:
- The basic logic of ISO 27001: How does information security work? https://advisera.com/27001academy/knowledgebase/the-basic-logic-of-iso-27001-how-does-information-security-work/
- What to consider in security terms and conditions for employees according to ISO 27001 https://advisera.com/27001academy/blog/2018/05/23/what-to-consider-in-security-terms-and-conditions-for-employees-according-to-iso-27001/

Quality control statement

I don’t know if I understand correctly your question. Organizations have the authority to decide what makes sense to include in a SOP. So, there is no compulsory requirement to add a quality control statement.

The following material will provide you more information about documentation:

- How to structure quality management system documentation - https://advisera.com/9001academy/knowledgebase/how-to-structure-quality-management-system-documentation/
- List of mandatory documents required by ISO 9001:2015 - https://advisera.com/9001academy/knowledgebase/list-of-mandatory-documents-required-by-iso-90012015/
- Free online training ISO 9001:2015 Foundations Course - https://advisera.com/training/iso-9001-foundations-course/
- Book - Managing ISO Documentation: A Plain English Guide - https://advisera.com/books/managing-iso-documentation-plain-english-guide/

Identification of justifications for SoA

https://advisera.zendesk.com/attachments/token/0Sa3NH86A9WJA1S9njTfJrTuc/?name=image001.png

When the justification for control applicability is related to risk assessment results, you can identify the Id of the related risks (e.g., results of last risk assessment ID 32, ID 17, and ID 23). As for contractual or legal obligation, you can identify the name of the obligation (e.g., name of the law or ID of the contract), and the clauses related to the control.

Included in the toolkit you bought you also have access to a video tutorial that can help you fill the Statement of Applicability.

This article will provide you a further explanation about Statement of Applicability:
- The importance of Statement of Applicability for ISO 27001 https://advisera.com/27001academy/knowledgebase/the-importance-of-statement-of-applicability-for-iso-27001/

ISO 9001 and non-conformities

No, the non-conformity can only be closed after checking a representative sample, after the closing date of your project and concluding that the non-conformity was removed.

The following material will provide you more information about the closing nonconformities:

- How to deal with nonconformities in an ISO 9001 certification audit - https://advisera.com/9001academy/blog/2015/06/09/how-to-deal-with-nonconformities-in-an-iso-9001-certification-audit/
- Free online training ISO 9001:2015 Foundations Course - https://advisera.com/training/iso-9001-foundations-course/
- Book – (where I use the process approach this way) - Discover ISO 9001:2015 Through Practical Examples - https://advisera.com/books/discover-iso-9001-2015-through-practical-examples/

Service-Only Providers and ISO 13485

Thanks for taking the time to respond in detail.  I appreciate it.

ISO 9001 clause 4.4 requrements

ISO 9001:2015 promotes the use of the process approach. Please consider watching this free webinar on demand about the process approach - The Process Approach - What it is, why it is important, and how to do it - https://advisera.com/9001academy/webinar/iso-9001-process-approach-free-webinar-on-demand/

Slide 12 is about determining a set of interrelated processes that model how an organization works. (4.4.1 b))

Slide 13 is about the characterization of each process (4.4.1 a); c) d) e) f) g) and h))

Slide 14 is about risks and processes (4.4.1 f))

Slide 15 is about (4.4.1 e))

I consider the process approach one of the best tools to manage and improve an organization.

The following material will provide you more information about the process approach:

- ISO 9001 – ISO 9001: The importance of the process approach - https://advisera.com/9001academy/blog/2015/12/01/iso-9001-the-importance-of-the-process-approach/
- free online training ISO 9001:2015 Foundations Course - https://advisera.com/training/iso-9001-foundations-course/
- book – (where I use the process approach this way) - Discover ISO 9001:2015 Through Practical Examples - https://advisera.com/books/discover-iso-9001-2015-through-practical-examples/

Implementation cutoff dates

Both standards are currently in effect, and a company can become certified to them right now, however, below is the information on transitioning from other standards and when these previous standards become obsolete as this is what is normally viewed as the cut off for implementation.

ISO 45001:2018 was released in March 2018, and as such will replace OHSAS 18001 in March 2021. At this point all companies who were registered to OHSAS 18001 will need to be transitioned over to ISO 45001, any certification will not be renewed, and the OHSAS standard will be made obsolete. This is confirmed in the BSI website, the organization that controlled the OHSAS 18001 standard, here: https://www.bsigroup.com/en-CA/BS-OHSAS-18001-Occupational-Health-and-Safety/

ISO 22000:2018 was published in June 2018, and if you had the ISO 22000:2005 standard in place you will have 3 years until June 2021 to make your transition. More about this standard can be found on the ISO website here: https://www.iso.org/standard/65464.html