Search results

Environmental and Safety Management

If your organization is going to be audited only according to ISO 9001:2015, Environment and Safety management documents are not audited.

The following material will provide you more information about scope:

- How to define the scope of the QMS according to ISO 9001:2015 - https://advisera.com/9001academy/knowledgebase/how-to-define-the-scope-of-the-qms-according-to-iso-90012015/
- Free webinar - ISO 9001:2015 clause 4 - Context of the organization, interested parties, and scope - https://advisera.com/9001academy/webinar/iso-90012015-clause-4-context-of-the-organization-interested-parties-and-scope-free-webinar-on-demand/
- Enroll for free course - ISO 9001:2015 Foundations Course - https://advisera.com/training/iso-9001-foundations-course/
- Book – Discover ISO 9001:2015 Through Practical Examples – https://advisera.com/books/discover-iso-9001-2015-through-practical-examples/

Preparing a Risk Assessment Procedure

The procedure should contain at least the following sections:

- How you identify your risks and opportunities - In this section you can describe a method which can include questions to answer during a brainstorming session with the relevant people of your organization or for instance conducting a SWOT analysis to better understand the risks and opportunities of the context of your organization. 

- How you determine the level of significance of each risk that has been indentified - In this section you need to establish certain criteria to determine a rating for each risk and opportunitiy. For instance the probablity of ocurrence is a criteron often used. 

- Which actions must be conducted to address the significant risks and opportunties - Here you define which measures must be taken according to the results of risk significance obtained.

- Review of the actions taken to address the risks and opportunities - In this section you define the frequency of the assessment to be done in order to check the actions that have been conducted to address risks and opportunities. 

For more information about how to write a procedure for addressing risks and opportunities, see the following materials:

- Article - How to address risks and opportunities in ISO 9001: https://advisera.com/9001academy/blog/2016/06/21/how-to-address-risks-and-opportunities-in-iso-9001/

- Enroll for free course - ISO 9001:2015 Foundations Course - https://advisera.com/training/iso-9001-foundations-course/

- Book – Discover ISO 9001:2015 Through Practical Examples – https://advisera.com/books/discover-iso-9001-2015-through-practical-examples/

Expired calibration of infusion/drivers

Yes, it is a violation of both the regulations and the SOP. 

For more information about calibration, please read this article:

Calibration requirements in ISO 13485“ https://advisera.com/13485academy/blog/2019/03/08/calibration-requirements-in-iso-13485/

ISO 9001 process flow diagram

Considering the ISO 9001 process flow diagram.

Let us concentrate our attention on the activities. Think in terms of verbs, of actions. What do you see from the moment a potential customer contacts the laboratory and the moment that customer receives a report with the test results?

You can gather a team of people and with sticky notes draw a picture like this one:

This is why the laboratory exists. Those are the main, the operational processes.

Those processes do not work alone. They need support from other processes that supply resources. Perhaps you can see something like this:

Where is your laboratory going? To whom should it work? What kind of tests should perform?

This is typical of a management process that works in close relationship with two other support processes (commercial and developing new tests and services):

The following material will provide you more information about the process approach:

- ISO 9001: The importance of the process approach - https://advisera.com/9001academy/blog/2015/12/01/iso-9001-the-importance-of-the-process-approach/
- Free webinar - The Process Approach - What it is, why it is important, and how to do it - https://advisera.com/9001academy/webinar/iso-9001-process-approach-free-webinar-on-demand/
- Enroll for free course - ISO 9001:2015 Foundations Course - https://advisera.com/training/iso-9001-foundations-course/
- book – Discover ISO 9001:2015 Through Practical Examples – https://advisera.com/books/discover-iso-9001-2015-through-practical-examples/

Handling of requirements

If I understood correctly, you are referring to two possible situations:

• 1. Standard's requirements do not make sense to the purpose of the standard anymore
• 2 Standard's requirements do not make sense to your organization's context

In the first case, during the standard review (which occurs approximately every 5 years) such requirements can be excluded or reformulated.

In the second case, you have to verify in the standard if the requirement is mandatory or if there is any condition for exclusion that can be applied to your organization. In the case of ISO 27001, requirements from sections 4 to 10 are mandatory (you cannot exclude any of them), and controls from Annex A can be excluded considering the results of risk assessment.

Impact level in specification of security requirements

In this case, you have two options:

1 - Use the worst-case scenario for impact considering the threats and vulnerabilities in the category that is closest to the specific information system you want to determine the impact level for. For example, if you have a pair of threat and vulnerability with the highest level of risk and this one can be related to your specific information system, you use it as specification.

2 - Add this individual information system as a specific asset and identify specific threats and vulnerabilities for this information system and use them as specification of security requirements.

Please note that one criterion to choose the proper approach will depend on the criticality of these individual systems (the more critical, the more important is that this asset is considered individually instead of as part of a group). It will also depend on the type of risks related to the categories you have (sometimes useful risks can be identified from these general categories and you do not have to work on a specific asset).

Work instructions and processes

If you check the list of mandatory documentation - List of mandatory documents in AS9100 Rev D - https://advisera.com/9100academy/knowledgebase/list-of-mandatory-documents-in-as9100-rev-d/ you will see that only a few procedures are required. However, I recommend, and most organizations do it, having a set of procedures that describe: What is done; By whom; and When.

When detailed information about how to do it is needed, we use Work Instructions.

There is no universal standard way for writing Work Instructions. You can use:

- Written text;
- Drawings and diagrams like used with furniture mounting instructions;
- Sets of photos or pictures like in a comic book;
- Short movies explaining and showing how to do it;
- A mix of the above approaches.
 

Work Instructions should be written with effectiveness in mind. Will people understand and use it when needed? And when used will they be easy to understand? 

I try to avoid lengthy Work Instructions because people will, probably not use them.

The following material will provide you more information about documentation:

- Article - AS9100 Rev D vs. Rev C: What has changed? - https://advisera.com/9100academy/knowledgebase/as9100-rev-d-vs-rev-c-what-has-changed/
- AS9100 Knowledge base - https://advisera.com/9100academy/knowledgebase/
- Book - Applying AS9100 Rev D - https://advisera.com/books/applying-as9100-rev-d/

ISMS scope change

1. If a company has been ISO27001 certified over the last couple of years and the scope is for say Datacenter facility Mgt/Infra/Network Services, Managed Security Services, Operations Support - covering server, Helpdesk, etc and now due to changes in the organization, say, one of the area MSS has been moved to a centralized function under their regional HQ, is the existing ISO27001 certification still valid?

The ISO 27001 certification would be still valid for the scope that remains under control of the company (i.e., the MSS would not be part of the ISMS scope anymore). This change in the ISMS scope needs to be need to informed to the certification body.

2. If not why? If yes, why?

A change in the ISMS scope is something expected during a certification life cycle and this situation does not make it invalid, provided that the new scope still fulfills all requirements of the standard.

3. What can be done to minimize a recertification?

Since the certificate is still valid, there is no need for recertification.

4. Can a surveillance audit still proceeds?

The surveillance audits can proceed normally. You only have to inform this situation to the certification body so they can review the surveillance audit schedule. In this situation, you have to evaluate the impacts of the change in the scope and make proper adjustments in the ISMS (e.g., risk assessment, risk treatment, SoA, etc.).

Please note that one adjustment is also to create an agreement with the new "provider" of the MSS, i.e. the regional HQ. 

Roles and responsibilities for infosec management

First of all, sorry for this confusion.

Top-level information security roles and responsibilities are defined in the Information Security Policy.

Specific roles and responsibilities for information security are defined in each template, considering activities to be performed (i.e., there is no central document specifying these ones). The parts in a template where you can find roles can be identified by a text like "[jobtitle]". For example, in the Backup policy, you have "[jobtitle] is responsible to perform backup restore."

ISO 27001 does not prescribe which roles and responsibilities must be performed, so an organization is free to define the framework that best suits it (e.g, by creating new roles, or designating information security responsibilities to already existing roles.

These articles will provide you further explanation about roles and responsibilities:
- How to document roles and responsibilities according to ISO 27001 https://advisera.com/27001academy/blog/2016/06/20/how-to-document-roles-and-responsibilities-according-to-iso-27001/
- What is the job of Chief Information Security Officer (CISO) in ISO 27001? https://advisera.com/27001academy/knowledgebase/what-is-the-job-of-chief-information-security-officer-ciso-in-iso-27001/
- Chief Information Security Officer (CISO) – where does he belong in an org chart? https://advisera.com/27001academy/blog/2012/09/11/chief-information-security-officer-ciso-where-does-he-belong-in-an-org-chart/

ISO 9001 and corporate office audit

If there are processes relevant for the scope of the quality management system performed by your corporate office, they have to be audited too. Some organizations agree with their certification body and, on the day of the audit, people from headquarters come to the production site to be audited there, they bring documentation and have access to the digital information. So, in your case, your organization can evaluate what is better, and communicate that to your certification body.

The following material will provide you more information about certification audits:

- How to prepare your company for the ISO 9001 certification audit - https://advisera.com/9001academy/03/how-to-prepare-your-company-for-the-iso-9001-certification-audit/- What questions to expect on the ISO 9001 certification audit - https://advisera.com/9001academy/blog/2016/04/19/what-questions-to-expect-on-the-iso-9001-certification-audit/- Enroll for free in the course - ISO 9001:2015 Lead Auditor Course - https://advisera.com/training/iso-9001-lead-auditor-course/- Book – Preparing for ISO Certification Audit: A Plain English Guide - https://advisera.com/books/preparing-for-iso-certification-audit-plain-english-guide/