Search results

Home / Search

Category:
Select
Select

11269 results

Guest

Guest

Create New Topic As guest or Sign in

HTML tags are not allowed

Select

Assign topic to the user

  • Stage 1 Auditing

    Stage 1 audits are about documentation and are normally performed in a meeting room. The main purpose is to evaluate the design of the management system against the standard, stage 2 audits are performed at the places where people do their jobs and are much more practical, much more about whether the employees are complying with everything that is written in the documentation. This is achieved by means of interviewing the employees, examining the relevant documents, records, forms and guidelines and also by visiting relevant areas of the organization. 

    So, normally, during stage 1 audits auditors will not check quality control records although they might want to check management review records.

    The following material will provide you more information about certification audits:

    - How to prepare your company for the ISO 9001 certification audit - https://advisera.com/9001academy/03/how-to-prepare-your-company-for-the-iso-9001-certification-audit/
    - free online training ISO 9001:2015 Foundations Course – https://advisera.com/training/iso-9001-foundations-course/
    - book – Preparing for ISO Certification Audit: A Plain English Guide - https://advisera.com/books/preparing-for-iso-certification-audit-plain-english-guide/

  • Facilities Validation Master Plan

    Each Validation Master Plan (VMP) must outline the following: principles involved in the qualification of a facility, defining the areas and systems to be validated, and provides a written program for achieving and maintaining a qualified facility. A VMP is a document that details the way a company will operate, who has control over the various aspects of the validation activities, and how production, quality control, and personnel management will be directed. Ideally, from a risk perspective, the VMP should include an overall assessment of the potential impact of the R&D processes on the quality of the new product. When you use a risk-based approach, then VMP will identify which processes to validate and in what order to perform the validations.

    By performing validation, an organization can make sure that the processes can produce the planned results consistently.

    For more on how to perform validation, please read the following article: 

    Using ISO 13485 to manage process validation in the medical device manufacturing industry https://advisera.com/13485academy/blog/2017/09/07/using-iso-13485-to-manage-process-validation-in-the-medical-device-manufacturing-industry/

  • CE-MDD marking, NBOG Scope Expression and GMDN code

    In most certification bodies, the last date for medical devices to be CE marked according to the MDD 93/47/EEC is 1st November. After that date, all new medical devices must be certified according to new Regulation 2017/745 on medical devices (MDR): https://eur-lex.europa.eu/legal-content/EN/TXT/PDF/?uri=CELEX:32017R0745&from=EN  

    For classification, you have to look in Annex VIII of MDR where all rules for classification are. In my opinion, your device is going under Rule 8 for all implantable device, but since they „are spinal disc replacement implants or are implantable devices that come into contact with the spinal column, in which case they are classified as class III with the exception of components such as screws, wedges, plates, and instruments.“ Therefore, if your spinal implants ARE NOT screws, wedges, plates, and instruments, than your spinal implants are class III.

    For other questions, I suggest that we talk over Skype or similar services as it will be easier to explain the terms sought.

  • Auditing suppliers

    How can I make a statement to my suppliers informing them that I am implementing an ISMS and that at later dates we will be auditing suppliers?
    Will they have an example?

    ISO 27001 does not prescribe the form to be used for such communication, only that an organization must determine the need for internal and external communications relevant to the
    ISMS, considering what to communicate, when, with whom, who shall communicate, and processes to be used.

    Considering that, you can use already implemented methods and forms you have (e.g., paper memos, e-mail, etc.).

    The most important thing regarding this situation is that you must review the contracts and service agreements with your suppliers to identify legal clauses that can support your demand to audit them (you should make reference to these clauses in your communication). In case you do not have such clauses, you will have to consider review the contracts/service agreements.

    This article will provide you a further explanation about supplier security:
    - 6-step process for handling supplier security according to ISO 27001 https://advisera.com/27001academy/blog/2014/06/30/6-step-process-for-handling-supplier-security-according-to-iso-27001/
    - Which security clauses to use for supplier agreements? https://advisera.com/27001academy/blog/2017/06/19/which-security-clauses-to-use-for-supplier-agreements/
    - How to perform an ISO 27001 second-party audit of an outsourced supplier https://advisera.com/27001academy/blog/2017/10/10/how-to-perform-an-iso-27001-second-party-audit-of-an-outsourced-supplier/

  • Safety policy, hazard identification, risk assessment and evacuation policy importance

    1. What do you know about health and safety policy and Sherq policy and how would you go about developing/formulating and implementing them?
    The H&S policy is the overall goal of a company for their OHSMS, where as the SHERQ policy is an integrated policy for safety, health, environment, risk and quality. If you had an integrated management system for all of these disciplines it can be helpful to have one overall policy (goal) for all of the management systems so that goals are aligned, and assessments (such as risk assessments) are done in a consistent fashion. Any policy should be developed by looking at the needs and expectations of interested parties, including the organization, and developing a policy goal to meet these expectations. For more information on this topic see the article: How to write an OH&S Policy, https://advisera.com/45001academy/blog/2015/06/19/how-to-write-an-ohs-policy/
    • 2. Why is hazard identification and risk assessment are important in the workplace, and how would you conduct them?
    Hazard identification is identifying what could cause injury or ill health in your processes, and this is obviously important so that you can do something about these hazards to prevent injury and ill health. Risk assessment is looking at the top level risks that can affect the OH&S in the organization, and again making plans to avoid serious risk is the reason for doing these. The important thing about both of these is to get the people involved who best know the processes since they can best assess the hazards and risks. For more information on this topic see the article: Hazards vs. risks – What is the difference according to DIS/ISO 45001?, https://advisera.com/45001academy/blog/2016/03/23/hazards-vs-risks-what-is-the-difference-according-to-disiso-45001/
    3. What is the importance of an evacuation policy, and how can it be developed?
    An evacuation policy is one of the emergency response plans to have in place that you create in response to a potential problem. It is often developed by identifying the potential problem to be controlled, then identifying the evacuation that is needed in response to this problem. For more on this topic see the article: 5 elements to consider when testing your organization’s health & safety emergency response procedure, https://advisera.com/45001academy/blog/2017/02/22/5-elements-to-consider-when-testing-your-organizations-health-safety-emergency-response-procedure/

  • Monitoring and measuring reports

    Thank you so much, this has been a huge help! :)

  • EU GDPR compliance on websites

    The minimum documentation you need is the Website T&C, Privacy Policy, and the Cookie Policy.

    You can find readily available templates for websites within this Mini GDPR Toolkit for Websites -https://advisera.com/eugdpracademy/eu-gdpr-mini-toolkit-for-websites/

  • ISO 9001 implementation and QMS

    1. Can you please help me with the list of documents required for ISO 9001:2015 certification?

    In the following articles you can find a list of mandatory documents required by ISO 9001:2015 – List of mandatory documents required by ISO 9001:2015 - https://advisera.com/9001academy/knowledgebase/list-of-mandatory-documents-required-by-iso-90012015/ and - Checklist of Mandatory Documentation Required by ISO 9001:2015 - https://cdn2.hubspot.net/hubfs/1983423/9001Academy/9001Academy_FreeDownloads/Checklist_of_ISO_9001_2015_Mandatory_Documentation_EN.pdf

    2. I need to build a QMS right from scratch so need to draft appropriate policies, procedures, forms etc.

    If you are in a hurry to draft your documentation perhaps one of our ISO 9001:2015 Documentation Toolkits -  https://advisera.com/9001academy/iso-9001-documentation-toolkit/ could be helpful. Please consider following this advise for the structure - How to structure quality management system documentation - https://advisera.com/9001academy/knowledgebase/how-to-structure-quality-management-system-documentation/

    3. And also, I would like to know is it mandatory for us to buy a software for maintaining QMS? Can we not do it in Grand avenue?

    Implementing and maintaining a QMS can be easier with the help of software. However, ISO 9001:2015 does not mandates buying or using any particular software. About Grand Avenue, I never worked with it but based on what I saw in internet I believe it can be used and be useful.

    The following material will provide you more information from Advisera about implementing a QMS:

  • Documents from an external origin

    First, it is important to note that as for "Documented information" the standard means both documents and records. Second important point is that the standard does not prescribe documents from external origin to be controlled, only that if the organization identifies such document they must be controlled. In short, it is your organization that must define which external documents are necessary to ensure your ISMS is properly planned, implemented and operated.

    Regarding types of documents, your own question covered the most basic ones (considering the needs of your ISMS):
    - Documents and records from legal authorities or regulators (including your certification body): your ISO 27001 certificate, the ISO 27001 standard, EU GDPR (so you can have access to information security-related clauses from Article 32), official letters from government agencies, etc.
    - Documents and records from customers, suppliers, and partners: contracts, service agreements, product/service specification, operation manuals, etc.

    This article will provide you a further explanation about the document management:
    - Document management in ISO 27001 & BS 25999-2 https://advisera.com/27001academy/blog/2010/03/30/document-management-within-iso-27001-bs-25999-2/

  • Risk transfer

    Part of the XXXX company's network of operations is managed by an external company, called XXXX, located within the XXXX company's facilities: personnel, systems, and information.

    All the assets of this network are critical assets and all with a very high risk of threats. Some of these assets have measures applied, some are insufficient and should improve. I have identified the owner of the asset the company XXXX, owner of the risk, the external company XXXX.

    As we commented, we would have two options:

    • From the XXXX company, treat the risks and implement the controls
    • From the XXXX company, transfer the risk to the XXXX company which is the one who must implement the controls but following the criteria of the XXXX company.

    I'm lost!!!

    I need you to advise me on the most effective way to do it. If we transfer the risk to the company XXXX, we lose control of the controls and it will not be defined what are the controls to be applied… .. and we should not.

    Can you please help me at this point?

    When you transfer risk treatment to a third-party the best way to do that is by means of contract or service agreement, so you can enforce, through security clauses, the third-party to keep the same or higher level of security you would implement by your own, as well as to present evidence you need to not lose sight of the controls you want implemented.

    These articles will provide you a further explanation about supplier security:
    - 6-step process for handling supplier security according to ISO 27001 https://advisera.com/27001academy/blog/2014/06/30/6-step-process-for-handling-supplier-security-according-to-iso-27001/
    - Which security clauses to use for supplier agreements? https://advisera.com/27001academy/blog/2017/06/19/which-security-clauses-to-use-for-supplier-agreements/
    • Page 501-vs-13485 of 1127 pages

    Didn’t find an answer?

    Start a new topic and get direct answers from the Expert Advice Community.

    CREATE NEW TOPIC +