Search results

IATF Internal Audit Checklist Guide

Internal audit is a big topic and an explanation of each clause would require a long answer.

In our article "How to make an Internal audit checklist for IATF 16949", you can find a lot of tips for your question: https://advisera.com/16949academy/knowledgebase/how-to-make-an-internal-audit-checklist-for-iatf-16949/

Please consider reading our article: IATF 16949 audit types & how they affect process improvement https://advisera.com/16949academy/blog/2017/11/01/iatf-16949-audit-types-how-they-affect-process-improvement/

Also, an article that can help to choose auditors: Requirements for the competence of IATF 16949 Internal auditors https://advisera.com/16949academy/blog/2017/10/19/requirements-for-competence-of-iatf-16949-internal-auditors/ 

Our course for ISO 9001 as baseline standard can also help: ISO 9001:2015 Internal auditor course https://advisera.com/training/iso-9001-internal-auditor-course/

ISO 27001 objective and requirements

From what I read from the standard, the goal is to ensure the confidentiality, integrity, and availability of information. The quality of information does not seem to me to be a concern of ISO 27001. Quality is necessary, but it is controlled by other means. When I see a request for a letter of competence, due to lack of an employee's diploma, or obligation to present the profile of the employee's professional, I do not understand what this has to do with information security. I got it wrong?

Please note that the objective of the standard is to protect information. Ensuring its confidentiality, integrity, and availability are the means by which this objective is achieved.

Information quality is not a mandatory requirement, but organizations can define information quality as a requirement to be protected by the ISMS if it impacts its information security objectives.

Recommendation letters, or other means to evidence competence, is a requirement of the standard (clause 7.2 c)) to ensure people have the proper experience, training, or education to perform work that can impact information security performance.

These articles will provide you further explanation about these topics:
- What is ISO 27001 https://advisera.com/27001academy/what-is-iso-27001/
- How to identify ISMS requirements of interested parties in ISO 27001 https://advisera.com/27001academy/blog/2017/02/06/how-to-identify-isms-requirements-of-interested-parties-in-iso-27001/
- How to demonstrate resource provision in ISO 27001 https://advisera.com/27001academy/blog/2017/04/10/how-to-demonstrate-resource-provision-in-iso-27001/

Time dedication to work on the implementation project

The time estimation for project duration considers a dedication of c.a. 20% work time, i.e., the project leader would work 1 day per week tops in the project.

Monitoring figures on management review

First you must correct the nonconformity. Perhaps add an annex to management review minute or perform a new management review just about that topic to complement the previous one.

Second you should develop a corrective action. A corrective action eliminates the cause of the nonconformity. To find the cause of the nonconformity you should ask why the nonconformity occurred. A good practice is to ask why five times to find a root cause. Besides that you can create a template for use in future management review minutes, to avoid forgetting some topic.

The following material will provide you more information about developing corrective actions:

- Article - Corrective and Preventive Actions to Support Environmental Management - https://advisera.com/14001academy/blog/2014/07/13/corrective-preventive-actions-support-environmental-management/
- Enroll for free in this course – ISO 14001:2015 Foundations Course - https://advisera.com/training/iso-14001-internal-auditor-course/
- Book – The ISO 14001:2015 Companion - https://advisera.com/books/the-iso-14001-2015-companion/

Product Safety Requirement

 The auditor stated requirement a), that is related to documented processes and i) which is related to the training of personnel.  

You should have documented the process for product-safety for example in the turtle diagram. 

Also, you can have process maps in a documented procedure, please consider our template procedure for product safety in our IATF 16494 Toolkit: https://advisera.com/16949academy/iatf-16949-2016-documentation-toolkit/

Please consider reading our article: “Ensuring product safety according to IATF 16949”: https://advisera.com/16949academy/blog/2017/09/20/ensuring-product-safety-according-to-iatf-16949/

Mould validation

Validation documents are necessary according to the ISO 13485:2016 requirement 7.5.6 Validation of processes for production and service provision. Manufacturer need to have documented procedure for the validation and records of the result and conclusion of validation.

When it comes to product quality in injection molding, machine and tool validation is fundamental to creating a stable manufacturing process and de-risking the project. The purpose of validation is to ensure that injection molders have a stable and dimensionally centered process that consistently produces high-quality products. Validation is basically providing the scientific evidence that the machine and tool is repeatedly doing everything you expect it to do, every minute of every day.

For more information about validation please read the article on the following link: 

Using ISO 13485 to manage process validation in the medical device manufacturing industry https://advisera.com/13485academy/blog/2017/09/07/using-iso-13485-to-manage-process-validation-in-the-medical-device-manufacturing-industry/

Manual de Organización y Funciones & Manual de Puestos y Funciones

Por supuesto puede hacerlo, cualquiera de las opciones que me presenta son válidas. Además los puestos de la organización así como las responsabilidades y competencias para cada una de las funciones deben de estar claramente definidos y si estos están recogidos en un único documento es más sencillo saber quién se responsabiliza de qué. Por otro lado, de esta manera es más sencillo determinar las necesidades de capacitación de cada uno de los roles dentro de la organización.

Estos materiales pueden serle de ayuda para entender mejor las funciones y responsabilidades dengtro de ISO 9001:2015

- Artículo - How to document roles and responsibilities according to ISO 9001: https://advisera.com/9001academy/blog/2018/02/26/how-to-document-roles-and-responsibilities-according-to-iso-9001/
- Inscríbase gratis en este curso -  Curso de Fundamentos de la nroma ISO 9001:2015 - https://advisera.com/es/formacion/curso-fundamentos-iso-9001/
- Libro – Discover ISO 9001:2015 Through Practical Examples – https://advisera.com/books/discover-iso-9001-2015-through-practical-examples/  

Information on EU GDPR

1. Since I am outside the EU what do I need to do?
2. Do I need to find storage in the EU or I can store data in Ukraine?
3. Do I need to set up a company in the EU?
4. Do I need to encrypt my servers?
5. How should I modify the contracts that have with customers in EU?
6. Am I allowed to sent marketing emails to my customers?

27001 Scope Confusion

First is important to note that products cannot be certified against ISO 27001. Processes and services which supports a product can be certified.

Considering that, since information related to the product flows through IT assets and the access to the product itself is provided by Corporate IT, Corporate IT process should be considered part of the scope, not a dependency.

This article will provide you further explanation about defining scope:
- How to set the ISMS scope according to ISO 27001 [free webinar on demand] https://advisera.com/27001academy/webinar/how-to-set-the-isms-scope-according-to-iso-27001-free-webinar-on-demand/
- How to define the ISMS scope https://advisera.com/27001academy/knowledgebase/how-to-define-the-isms-scope/
- Problems with defining the scope in ISO 27001 https://advisera.com/27001academy/blog/2010/06/29/problems-with-defining-the-scope-in-iso-27001/

Inherent vs Residual Risk

1. Considering the initial risk assessment is done taking into account controls already in-place, is it accurate to say that if these controls are sufficient, there should be no change between the inherent and residual risk score?

Your understanding is correct. If the assessed risk, considering controls already in-place, are considered acceptable according to your defined criteria, then assessed risk and residual risk are the same.

2. Added to which, are there any circumstances where you would risk assess assuming NO controls?  You wouldn't approach a risk assessment for crossing the road with worst-case scenario at the outset, i.e. with a blindfold, earplugs and at rush-hour there is a high probability you will be killed?! That can't be your starting point or all risk assessments would be artificially skewed.

An example of a circumstance where you would assess a risk, assuming NO controls applied, is to identify the full impact of the risk occurring, so you can evaluate whether the effort and cost of applied controls are worthy.

This article will provide you further explanation about risk assessment:
- ISO 27001 risk assessment & treatment – 6 basic steps https://advisera.com/27001academy/knowledgebase/iso-27001-risk-assessment-treatment-6-basic-steps/

These materials will also help you regarding risk assessment:
- The basics of risk assessment and treatment according to ISO 27001 [free webinar] https://advisera.com/27001academy/webinar/basics-risk-assessment-treatment-according-iso-27001-free-webinar-demand/
- Book ISO 27001 Risk Management in Plain English https://advisera.com/books/iso-27001-annex-controls-plain-english/