Start a new topic and get direct answers from the Expert Advice Community.
CREATE NEW TOPIC +Search results
11294 results
Guest
Guest
Create New Topic As guest or Sign in
Assign topic to the user
-
The use of a toolkit for a QMS
Our toolkit is designed to be really easy to use with documents that contain many comments explaining how to complete them, but also with links to relevant materials that will help your company to understand the requirements covered in each template.
In addition, there is unlimited email support included in the toolkits so you can ask any question that you may have during the implementation. In the top of this you will have expert meetings 1 to 1 with one of the experts in ISO 9001 who will clarify any doubt during the QMS project. Also, you have at least one document for review by an ISO 9001 expert.
This means that even if you face some difficulties during some steps of the implementation, you will have not only the documents but all the support you need to overcome them.
For more information about the benefits of using a toolkit in the implementation o f the standard ISO 9001:2015, see the following materials:
- Free Webinar - How to use a documentation toolkit for the implementation of ISO 9001: https://advisera.com/9001academy/webinar/how-to-use-a-documentation-toolkit-for-the-implementation-of-iso-9001-free-webinar-on-demand/
- Book – Discover ISO 9001:2015 through practical examples: https://advisera.com/books/discover-iso-9001-2015-through-practical-examples/
- Free on-line training – ISO 9001:2015 Foundations: https://advisera.com/training/iso-9001-foundations-course/ -
Life cycle perspective
Response:
This life cycle assessment is just required by ISO 14001 during the identification of the environmental aspects and impacts. This is not required by either ISO 9001 or ISO 45001.
What you need to consider are all the environmental aspects of the activities, products and services from a life cycle perspective that your company can either control or influence. Life cycle stages include the acquisition of raw materials, design and development of a product, production, transportation and delivery, use, end of life treatment, and final disposal. Basically, your organization needs to be aware of all environmental impacts in each every stage of a product’s or service's life to manage the impacts in the best way possible.
Sometimes you won´t be able to control the environmental aspect or impact, for instance when your product is already delivered and will be disposed by the user. In this case you can opt by writing some instructions indicating how to best manage the disposal of the product by the consumer.
You can see these materials to help you with the life cycle assessment:
- Article - How does product life cycle influence environmental aspects according to ISO 14001:2015: https://advisera.com/14001academy/blog/2016/03/21/how-does-product-life-cycle-influence-environmental-aspects-according-to-iso-140012015/
- Article - Lifecycle perspective in ISO 14001:2015: what does it mean: https://advisera.com/14001academy/blog/2017/02/20/lifecycle-perspective-in-iso-140012015-what-does-it-mean/
- Book – The ISO 14001:2015 companion: https://advisera.com/books/the-iso-14001-2015-companion/
- Free on-line training – ISO 14001:2015 Foundations: https://advisera.com/training/iso-14001-internal-auditor-course/ -
Cumplimiento legal de ISO 9001:2015
Respuesta:
Según la norma ISO 9001:2015 la organización tiene que comprender e incluir tanto los requisitos legales como reglamentarios en el Sistema de Gestión de Calidad que sean aplicables a la organización, a sus procesos y los productos y servicios que ofrece.
Por lo tanto se pueden identificar dos tipos distintos de requisitos legales y reglamentarios:
- por un lado los aplicables a los productos y servicios: son aquellos que se refieren a las características y especificaciones de los productos y servicios para que sea posible su venta legal;
- y por otro los aplicables a los procesos y los procedimientos: son requisitos que suelen tener relación con la formación y las competencias de los trabajadores para realizar los procesos, o requisitos para asegurar la seguridad de los empleados durante la realización de sus actividades.
Es importante asignar un responsable o responsables para la identifica ción de estos requisitos legales y reglamentarios así como mantenerlos actualizados para poder cumplir con los mismos.
Estos materiales pueden ayudarle a entender los requisitos legales y reglamentarios de la organización:
- Artículo - How to include statutory and regulatory requirements in your QMS: https://advisera.com/9001academy/blog/2017/02/14/how-to-include-statutory-and-regulatory-requirements-in-your-qms/
- Libro - Discover ISO 9001:2015 through practical examples: https://advisera.com/books/discover-iso-9001-2015-through-practical-examples/
- Curso gratuito en línea - Curso de fundamentos de la norma ISO 9001:2015: https://advisera.com/es/formacion/curso-fundamentos-iso-9001/ -
Do people working in departments excluded from scope have to be trained for QMS?
Answer:
People from marketing (included in the scope) need to be trained for the certain procedure related to QMS, that you as a management find it necessary. People working in departments excluded from the scope of the QMS does not need do be trained in various procedures from QMS.
According to point 6.2, it is the responsibility of the organization to determine what competencies and training are required for a particular job. -
Would becoming ISO 13485 compliant benefit customers more than ISO 9001?
Answer:
Yes, because ISO 13485 is made strictly for the manufacturer of medical devices. ISO 13485 allows a company to demonstrate that it consistently meets customer's needs, medical device regulatory requirements and complies with local legislation. It is, in certain points, related to ISO 9001, but ISO 13485 emphasizes areas such as risk management, the work environment, and medical device documentation and reporting.
For more information about ISO 13485 structure and requirements, please read the following article:
ISO 13485 structure and requirements https://advisera.com/13485academy/what-is-iso-13485/
For more information about similarities beteweed FDA nad ISO 13 485, please read the following link:
https://advisera.com/13485academy/blog/2017/10/05/differences-and-similarities-between-fda-21-cfr-part-820-and-iso-13485/
01 -
Evidencing requirements
The customer has a very small organization, with an IT organization of 5 people.Almost all IT services are outsourced using Google cloud.
1 - What is the best way to deal with controls like logging, capacity management, cabling security, monitoring system use etc. All the measures associated with this control are followed up by the supplier. Our customer does not know exactly how Google Cloud has implemented the measures for this control. Google cloud is ISO 27001 certified.
Answer: The best way to handle controls managed by suppliers is by means of information security clauses in contracts or service agreements, where these clauses enforce the level of protection you expect from the supplier.
For more information, see:
- 6-step process for handling supplier security according to ISO 27001 https://advisera.com/27001academy/blog/2014/06/30/6-step-process-for-handling-supplier-security-according-to-iso-27001/
- Which security clauses to use for supplier agreements? https://advisera.com/27001academy/blog/2017/06/19/which-security-clauses-to-use-for-supplier-agreements/
2 - My question is:Is it necessary to explain how these controls are implemented by Google or is a more general reference for example a reference to the certification of google cloud sufficient?
Answer: Since your customer is participating in a government tender you have to consider the tender's rules to identify which level of detail is required to fulfill the tender process. In other words, if the tender rules require you to explain how the controls are implemented, then referencing to Google's certification is not going to be enough. -
Filling SoA
Answer:
In this case (when you have a large number of risks to refer in the SoA) I suggest you to list in the SoA only the IDs of the 3 or 4 most critical risks related to this control and inform the quantity of other risks that justify the application of this control that can be found in the results of risk assessment. See this example:
"Risks #3, #18, #27, and 23 other risks that can be found in the results of risk assessment." -
Improvement targets and budget targets
Answer
I agree with your organization’s approach. One target is for the budget and has to be communicated to the Finance. The other target is for internal use to guide an improvement project. There is no guarantee that the improvement target will attain. When the budget is prepared, the organization sometimes has no idea about what should be done to meet the improvement target.
The following material will provide you more information about quality objectives:
How to Write Good Quality Objectives - https://advisera.com/9001academy/knowledgebase/how-to-write-good-quality-objectives/
- Free webinar on demand - Measurement, analysis, and improvement according to ISO 9001:2015 - https://advisera.com/9001academy/webinar/measurement-analysis-and-improvement-according-to-iso-9001-2015-free-webinar/
- Enroll for free course - ISO 9001:2015 Foundations Course - https://advisera.com/training/iso-9001-foundations-course/
- book – Discover ISO 9001:2015 Through Practical Examples – https://advisera.com/books/discover-iso-9001-2015-through-practical-examples/ -
ISO 9001 and fertility centers
Answer
Yes, ISO 9001 is applicable to fertility centers. ISO 9001 is applicable to any activity, both public and private.
The following material will provide you more information about ISO 9001 applicability:
ISO 9001 Requirements and Structure - https://advisera.com/9001academy/knowledgebase/iso-9001-requirements-and-structure/
- Free webinar - ISO 9001:2015 clause 4 - Context of the organization, interested parties, and scope - https://advisera.com/9001academy/webinar/iso-90012015-clause-4-context-of-the-organization-interested-parties-and-scope-free-webinar-on-demand/
- Enroll for free course - ISO 9001:2015 Foundations Course - https://advisera.com/training/iso-9001-foundations-course/
- book – Discover ISO 9001:2015 Through Practical Examples – https://advisera.com/books/discover-iso-9001-2015-through-practical-examples/ -
Scope definition
(1 - I hope you are very well, I write since the company where I am currently working wants to be certified in 27001, but just wants to certify a "product" which is electronic invoicing, I wanted to know if this is possible, since I have confusion at the time to delimit the scope of the ISMS and the information security policy, would the policy exclude the other processes and areas of the company?
Answer:
First it is important to note that ISO 27001 does not certify "products", o nly processes. So in your case the certification would be related to the electronic invoicing process.
Regarding scope definition, you can limit the scope to any size you want, and you can exclude processes, locations or business units you think should be left outside the scope.
2 - And, due to cost issues, it would also be less beneficial since it would increase when you want to certify the other processes of the company?)
Answer:
The smaller the scope, the smaller the certification costs will be, in fact including process you do not want to certify now, will increase the costs of certification (many certification bodies use the total of personnel involved in the scope to define required days for the certification, which directly impacts certification costs).
These articles will provide you further explanation about scope definition:
- How to define the ISMS scope https://advisera.com/27001academy/knowledgebase/how-to-define-the-isms-scope/
- Problems with defining the scope in ISO 27001 https://advisera.com/27001academy/blog/2010/06/29/problems-with-defining-the-scope-in-iso-27001/
- How to set the ISMS scope according to ISO 27001 [free webinar on demand] https://advisera.com/27001academy/webinar/how-to-set-the-isms-scope-according-to-iso-27001-free-webinar-on-demand/