Start a new topic and get direct answers from the Expert Advice Community.
CREATE NEW TOPIC +Search results
11294 results
Guest
Guest
Create New Topic As guest or Sign in
Assign topic to the user
-
Training others to perform internal audits
Answer
An internal auditor must be competent to perform internal audits. Companies have the authority to determine what should be their requirements for competency. Normally, they are about knowing the standard and about knowing good audit practices and some previous experience.
With this course ISO 9001:2015 Lead Auditor Course you will get training about ISO 9001:2015 and about good audit practices (preparing, performing and reporting). This will give you knowledge that you can pass on to others through an internal auditor course performed by you in-house. Attention, this course is better suited to those that want to follow a career as Lead Auditors. Just to enable you to train internal auditors, if you don’t want to follow a career as Lead Auditor, perhaps our ISO 9001:2015 Internal Auditor Course is better suited to your needs.
The following material will provide you more information about internal audits:
- Article - ISO 9001 – How to prepare for an internal audit - https://advisera.com/9001academy/blog/2017/09/26/iso-9001-how-to-prepare-for-an-internal-audit/
- [free course] ISO 9001:2015 Internal Auditor Course - https://advisera.com/training/iso-9001-internal-auditor-course/
- book - ISO Internal Audit: A Plain English Guide - https://advisera.com/books/iso-internal-audit-plain-english-guide/ -
Internal audit
# Type
# Scope
# Frequency
Is the documents of "10_Internal_Audit" covering this point?
Answer:
I'm assuming you are referring to ISO 27001 Annex A section A.18.2 Information security reviews. Considering that, your assumption is correct, the internal audit procedure is the document which covers the controls from this section.
The definition of scope and frequency will depend on factors such as the importance of the information system, related risks, results of previous audits, etc., but a good start to consider is to audit information systems in the ISMS scope at least once a year.
2. I´m having a problem to figured out this issue, do you have forms or a procedure to cover this point?
Answer:
To see how this internal audit document looks like, please take a look at the free demo of our ISO 27001/ISO 22301 Internal Audit Toolkit at this link: https://advisera.com/27001academy/iso-27001-22301-internal-audit-documentation-toolkit/
For further information also see:
- How to prepare for an ISO 27001 internal audit https://advisera.com/27001academy/blog/2016/07/11/how-to-prepare-for-an-iso-27001-internal-audit/
- ISO 27001:2013 Internal auditor course https://advisera.com/training/iso-27001-internal-auditor-course/ -
Certification bodies
Answer:
Unfortunately we do not have this kind of list, and you should ask for this specific need in the quotes you will send to potential certification bodies.
This article will provide you further explanation about selection of certification bodies:
- How to choose a certification body https://advisera.com/blog/2021/01/11/how-to-choose-an-iso-certification-body/ -
Aspects, impacts and risks
Answer:
Consider the example below:
One of the activities performed by an organization (cutting steel sheet) interacts with the environment through one or more environmental aspects (noise generation). Environmental impacts are the expected and normal outcomes or consequences of an environmental aspect (neighborhood nuisance below legal limits in this case).
Please check risk definition (3.2.10) on ISO 14001:2015 (effect of uncertainty). With environmental aspects and impacts we are considering normal, expected situations. Whenever there is uncertainty there is risk, there is a potential deviation from the expected.
In the example above one of the risks, one of the possibilities, it is a cutting machine malfunction. That malfunction can generate a negative deviation from the expected, can generate much more noise, exceed legal limits and increase neighborhood complaints.
In my work with organizations we determine environmental aspects and impacts. Then, for each impact I ask (and please check the relationship with Mark Hammar’s article):
What can help us improve the environmental impact? (opportunity)
What can deteriorate the environmental impact? (risk)
The following material will provide you information about getting clients as consultant:
- ISO 14001 risks and opportunities vs. environmental aspects - https://advisera.com/14001academy/blog/2016/06/06/iso-14001-risks-and-opportunities-vs-environmental-aspects/
- Free webinar – How to implement risk management in ISO 9001:2015 - https://advisera.com/9001academy/webinar/how-to-implement-risk-management-in-iso-90012015-free-webinar/
- Free online course - ISO 14001:2015 Lead Implementer Course - https://advisera.com/training/iso-14001-lead-implementer-course/ -
Gap analysis feedback
Answer
As far as I understand your question, you can design something like:
Perform gap analysis
Communicate result
Act upon the system to close the gaps
Re-perform gap analysis
Check improvement/evolution
Communicate result
Back to: act upon the system to close the remaining gaps
…
You can use a detailed Gap Analysis checklist and perhaps evaluate the gap not as a yes or no, but as a result between 0, 1, 2 and 3. Being 0 having nothing (total gap) and 3 being no gap detected (or vice versa)
The following material will provide you more information about Gap Analysis:
- ISO 9001 – Should you use a gap analysis in your ISO 9001 implementation? - https://advisera.com/9001academy/17/use-gap-analysis-iso-9001-implementation/
- Free ISO 9001:2015 Gap Analysis Tool - https://advisera.com/9001academy/iso-9001-gap-analysis-tool/
- free online training ISO 9001:2015 Foundations Course – https://advisera.com/training/iso-9001-foundations-course/
- book – Discover ISO 9001:2015 Through Practical Examples – https://advisera.com/books/discover-iso-9001-2015-through-practical-examples/ -
ISO 27001 toolkit content
- A.6.1.1 – A.6.1.6
- A.7.3
- A.8.1.3 & A.8.1.4
- A.9.4
- A.11 is also somewhat incomplete
- A.12.1.3 and 12.1.4
- A.12.4 – A.12.7
- A.18 is missing completely
I previously thought, that the missing parts may be part of an update. Can you tell me more about the missing parts of the ISO?
Answer:
First of all, sorry for this confusion. It is important to note that every control does not need to be documented, and to avoid unnecessary administrative work the toolkit includes only all the mandatory + all most common documents.
In the root folder of the toolkit you'll find a document called “List of Documents” that explains which control/clause is covered by which document, and which documents are mandatory.
Documents which cover some of controls you mentioned can be found here:
- A.6.1.2 - this control is covered by document "Incident Management Procedure", located in Folder "08 Annex A – Security Controls" sub-folder "A.16 Information Security Incident Management"
- A.8.1.3 & A.8.1.4 - these controls are covered by documents "IT Security Policy", located in Folder "08 Annex A – Security Controls" sub-folder "A.8 Asset Management" and "Supplier Security Policy", located in Folder "08 Annex A – Security Controls" sub-folder "A.15 Supplier Relationships"
- A.9.4.1 this control is covered by documents "Information Classification Policy", located in Folder "08 Annex A – Security Controls" sub-folder "A.8 Asset Management" and "Access Control Policy", located in Folder "08 Annex A – Security Controls" sub-folder "A.9 Access Control"
- A.9.4.3 this control is covered by documents "Password Policy", located in Folder "08 Annex A – Security Controls" sub-folder "A.9 Access Control" and "Access Control Policy", located in Folder "08 Annex A – Security Controls" sub-folder "A.9 Access Control"
- A.12.4 - these controls are covered by document "Security Procedures for IT Department", located in Folder "08 Annex A – Security Controls" sub-folder "A.12 Operations Security"
- A.18 – controls from this section are covered in the toolkit in folder "02 Procedure for identification of requirements”
In case your implementation requires controls not included in mentioned documents covered by the toolkit, you can contact us by email or schedule a meeting and we can provide the support to develop these documents. -
SWOT Analysis and ISO 27001
Answer:
First it is important to note that a SWOT analysis is not mandatory for ISO 27001, but it can help for the identification of organizational context and requirements of interested parties.
Considering that, the SWOT analysis used for ISO 9001 certification can be used for ISO 27001, provided that you now include an information security perspective on the information already gathered.
These articles will provide you further explanation about organizational context and requirements of interested parties:
- How to define context of the organization according to ISO 27001 https://advisera.com/27001academy/knowledgebase/how-to-define-context-of-the-organization-according-to-iso-27001/
- How to identify ISMS requirements of interested parties in ISO 2 7001 https://advisera.com/27001academy/blog/2017/02/06/how-to-identify-isms-requirements-of-interested-parties-in-iso-27001/ -
Cumplir con el contexto de la organización
Respuesta:
La norma no exige ningún tipo de formato, es más no respecto al Contexto de la organización no requiere conservar ningún registro o documento. Dicho esto, le aconsejo que al menos guarde un acta de reunión donde se lleve a cabo algún análisis para determinar el contexto de la organización , como el análisis DOFA (debilidades, oportunidades, fortalezas y amenazas). También puede desarrollar un procedimiento para definir de manera sistemática cómo se aborda el contexto de la organización, aquí puede ver un ejemplo - Procedimiento para determinar el contexto de la organización y partes interesadas: https://advisera.com/9001academy/es/documentation/procedimiento-para-determinar-el-contexto-de-la-organizacion-y-partes-interesadas/
Estos materiales pueden ayudarle a entender el contexto de la organización:
- Artículo - Cómo identificar el contexto de la organización en ISO 9001:2015: https://advisera.com/9001academy/pt-br/kit-de-documentacao-da-iso-9001/nowledgebase/como-identificar-el-contexto-de-la-organizacion-en-iso-90012015/
- Libro - Discover ISO 9001:2015 through practical examples: https://advisera.com/books/discover-iso-9001-2015-through-practical-examples/
- Curso gratuito en línea - Curso de fundamentos de la norma ISO 9001:2015: https://advisera.com/es/formacion/curso-fundamentos-iso-9001/ -
Continual improvement programs
Answer:
CI program you have established can fulfill the first part of 10.3.1 clause because of performance indicators and their effectiveness, as Kaizen events and Just Do It initiatives, are typical Lean methods that lead to the increase of process effectiveness.
Also, consider Improvements in the manufacturing process to reduce process variation. This can be achieved by using Six Sigma as methodology as it is the methodology used for reducing variation in the process.
This clause additionally refers to risk analysis (such as FMEA) so please consider article: “What is FMEA and How to apply it in IATF 16949” https://advisera.com/16949academy/blog/2017/09/06/what-is-fmea-and-how-to-apply-it-in-iatf-16949/ -
Service Desk Manager
Answer:
Service Desk is related to many activities in scope of the organizations' ITSM (see the article about SD types: "ITIL Service Desk types" https://advisera.com/20000academy/blog/2014/05/06/itil-service-desk-types/).
Therefore, you as a Service Manager have to consider services, people involved in SD activities, customers/users, internal organization, processes, tools in use, etc. So, as you can see, many (sometimes different) areas have influence on your activities. You can find more details in following articles:
"Service Desk: Single point of contact" https://advisera.com/20000academy/knowledgebase/service-desk-single-point-contact/
"What is the job of the Service Desk Manager?" https://advisera.com/20000academy/blog/2016/09/20/what-is-the-job-of-the-service-desk-manager/ e-job-of-the-service-desk-manager/
"Service Desk staff – a window to the IT organization" https://advisera.com/20000academy/blog/2014/02/18/service-desk-staff-window-organization/