Answer
No, it is not mandatory to have a consultant to get or maintain ISO 9001 certification. The only requirement is being compliant with ISO 9001 and internal requirements.
Section A.18.1 Compliance with legal and Contractual Requirements
Answer:
To record the legal and contractual requirements relevant to your ISMS you can use the List of Legal Regulatory Contractual and Other Requirements template. To document your approach to identify these requirements you can use the Procedure for Identification of Requirements template.
Both templates are located in folder 02 Identification of Requirements of your toolkit.
By the way, included in your toolkit there is a List of Documents file which shows you which requirements and controls from ISO 27001 are covered by each document in the toolkit.
BIA questions
Answer:
First of all thanks for this feedback.
Legal penalties refer to penalties related to laws and regulations defined by governments, while contractual penalties refer to penalties related to contracts and service agreements established between the organization and customers, organization and suppliers, or organization and partners or other third parties.
If you have other explanation you need about specific questions on BIA questionnaire, could you please send it to us, so we can have a better understanding on which details we must provide?
Document control of handwritten documents
Answer
Handwritten documents can be controlled documents under an ISO 9001 quality management system.
First, identify that kind of document, give it a name or designation, and identify its version.
Then, determine the authority to approve that kind of document and evidence that approval.
Then, determine where and how will those documents be available and whom should have access to them.
Answer:
Please check ISO 9001:2015 clause 10.2.2 and ISO 14001:2015 clause 10.2.
It is mandatory to retain a record that evidences the results of any developed correction action.
Clause 4.1 is about determining those internal and external issues that can be relevant to influence your organization’s future. You can think about political, economic, social, technological, environmental and legislative as external issues, and about performance, complaints, experience, market presence as internal issues.
Clause 4.2 is about determining who are the relevant interested parties for your organization’s business ecosystem: customers; customer’s customers; regulators; influencers; universities; suppliers; unions; competitors.
The following material will provide you more information about the context and interested parties:
We have a simple process map:
Managing process?
Main processes: 1. Take over the order and material 2. Preparation of production and production 3. Control and packaging 4. Expedition
Supporting processes: 1.Training of people, 2. Internal audit, 3. Maintenance and calibration
What will be the inputs and outputs of the Managing process, please?
Answer:
I understand that you are refering to the different management processes that you should include in the process map. This is something that differs from one organization to another, but to give you an example, some of the managerial processes usually are:
- Financial and resources management
- Roles, responsibilities and authorities
- Measurement, analysis and improvement
A Process map is just one way to provide a high-level view of the processes that conforms your quality management system and also shows how different processes interact. However this is very helpful is not mandatory in ISO 9001:2015.
Answer
First, what is an audit?
It is a systematic, independent (to ensure objectivity) and documented process to get audit evidences and compare them with the audit criteria to conclude about the extension these criteria are fulfilled.
I use this image to explain what an audit is:
An auditor goes into reality, collects audit evidences (facts) and compares them with the audit criteria (the rules).
Each comparison is an audit finding.
Comparing the audit objective with the sum of all audit findings the auditor can draw a conclusion.
Second, what types of audits can we talk about?
There are three types of audits: first, second- and third-party audits. In a first party audit the audit manager belongs to the organization being audited. In a second party audit the audit manager belongs to a customer. In a third party audit the audit manager belongs to a certification body.
Third, what is an ISO 9001 audit?
An iso 9001 audit is an audit where the audit criteria is based on ISO 9001, a quality management standard.
First, there is an updated version for ISO 22000 from 2018.
Normally, a QMS is based on ISO 9001:2015. A general usage standard that can be applied in all economic sectors. ISO 22000 is for the food industry and is very concerned with food safety along the food chain with special requirements for food safety prevention, emergency response and communication.