Start a new topic and get direct answers from the Expert Advice Community.
CREATE NEW TOPIC +Search results
11294 results
Guest
Guest
Create New Topic As guest or Sign in
Assign topic to the user
-
Using read-only documentation
Answer:
Yes, from an ISO 9001:2015 perspective it is possible to make information available to a limited internal audience on a read-only ba sis. You can train people on control of information. Many organizations use information available digitally, on a read-only basis. If someone prints that information a watermark appears on the paper stating that only the digital version is controlled, and paper versions are uncontrolled copies.
The following material will provide you with more information about document control:
- ISO 9001 - New approach to document and record control in ISO 9001:2015 - https://advisera.com/9001academy/blog/2015/06/30/new-approach-to-document-and-record-control-in-iso-90012015/
- Book – Managing ISO Documentation: A Plain English Guide - https://advisera.com/books/managing-iso-documentation-plain-english-guide/ -
Is European certification equal to ISO 13485 ?
We want to bring a new medical device class II to Canada from Europe. The device has CE certification by Directive 93/42/EEC. Is the European certification is equal to ISO 13485 standard or we need to apply for Canadian certification.
Answer:
The CE certification means that the Quality Management System (QMS) in place is compliance to ISO 13485 standard. As you are aware, each country has its own regulations, therefore, you still have to register for Canadian certification in order to market the device. But the QMS prepared earlier for CE certification could be useful for applying for Canadian certification. -
Integrated implementation
Answer:
If the content of the involved mandatory documents is the same, as in the case of the scope you've mentioned, you can merged them with no problem. In case they are not, or are only partially the same, you must consider if by merging them, they would not become too big or overly complex to handle. In these cases it is better to keep separated documents.
These materials will provide you further explanation about integrating management systems:
- How to implement integrated management system https://advisera.com/blog/2015/10/05/how-to-implement-integrated-management-systems/
- What to implement first: ISO 22301 or ISO 27001? https://advisera.com/27001academy/blog/2017/04/03/what-to-implement-first-iso-22301-or-iso-27001/
- Free webinar - ISO 27001 & ISO 22301: Why is it better to implement them together? https://advisera.com/27001academy/webinar/iso-27001-iso-22301-better-implement-together-free-webinar-on-demand/ -
Certification coverage
Answer:
An ISO certification issued to AWS does not make your organization "automatically" certified. Your organization has to go through the certification process by itself, but the fact that your supplier already has the certification will help ease your certification process when implementing the necessary controls.
These articles will provide you further explanation about the certification process:
- What is ISO 27001 https://advisera.com/27001academy/what-is-iso-27001/
- ISO 27001 implementation checklist https://advisera.com/27001academy/knowledgebase/iso-27001-implementation-checklist/
These materials will also help you regarding the certification process:
- ISO 27001/ISO 22301: The certification process [free webinar on demand] https://advisera.com/27001academy/webinar/iso-27001iso-22301-the-certification-process-free-webinar/ 01iso-22301-certification-process-free-webinar-demand/
- Book Secure & Simple: A Small-Business Guide to Implementing ISO 27001 On Your Own https://advisera.com/books/secure-and-simple-a-small-business-guide-to-implementing-iso-27001-on-your-own/
- Free online training ISO 27001 Foundations Course https://advisera.com/training/iso-27001-foundations-course/ -
Information assets classification
Answer: Good practice suggests that information assets classification should be done through a four-steps process:
- information assets should be entered in an Inventory of Assets, so you know which assets to protect
- information assets should be classified, considering their value to the organization and the impact if compromised
- information assets should be labeled, so people can identify its classification
- information assets should be handled in a secure way, considering their classification level
This article will provide you further explanation about information classification:
- Information classification according to ISO 27001 https://advisera.com/27001academy/blog/2014/05/12/information-classification-according-to-iso-27001/
2. How can I identify info assets?
Answer: To properly identify info assets you have to consider your ISMS scope and the objectives of your ISMS, because from them you can identify which assets you have to protect. For example, if one obje ctive of the ISMS is to ensure the protection of the customer support service running on your organization's headquarter, you will know you have to consider the hardware, software and databases located on the headquarter's premises.
This article will provide you further explanation about asset inventory:
- How to handle Asset register (Asset inventory) according to ISO 27001 https://advisera.com/27001academy/knowledgebase/how-to-handle-asset-register-asset-inventory-according-to-iso-27001/ -
PDCA in AS9100 Rev D
Answer:
No, you do not need to do a PDCA document for AS9100 Rev D. The plan-do-check-act cycle is par of the standard, as referenced in the diagram at the start of the standard, but there is no requirement to have a PDCA process or to document it.
To better understand how PDCA works in AS9100 Rev D, see this article:
PDCA cycle in AS9100 Rev D, https://advisera.com/9100academy/knowledgebase/pdca-cycle-in-as9100-rev-d/ -
ISO 9001 vs ISO 27001
Answer:
You can find a comparison, clause by clause, of ISO 9001:2015 with ISO 27001:2013 following this link - ISO 9001:2015 vs. ISO 27001:2013 matrix: https://info.advisera.com/9001academy/free-download/iso-9001-2015-vs-iso-27001-2013-matrix
Also please look at this article - How to integrate ISO 9001 and ISO 27001 - https://advisera.com/9001academy/blog/2016/09/27/how-to-integrate-iso-9001-and-iso-27001/ you can find a list of what is common among both standards and extra-requirements of ISO 27001. -
Independence and internal audits
Answer:
Someone else should be auditing the Quality Department. Please check ISO 19011:2018 definition of the audit, “systematic, independent and…”.
Your organization should consider the possibility of another person, internal or external, with the necessary competencies, audit the Quality Department. Remember, the necessary competencies are defined by your own organization.
The following material will provide you more information:
ISO 9001 – Five Main Steps in ISO 9001 Internal Audit - https://advisera.com/9001academy/knowledgebase/five-main-steps-in-iso-9001-internal-audit/
- free online training ISO 9001:2015 Internal Auditor Course
– https://advisera.com/training/iso-9001-internal-auditor-course/
- book - ISO Internal Audit: A Plain English Guide - https://advisera.com/books/iso-internal-audit-plain-english-guide/ -
Auditing a department
Answer:
ISO 9001:2015 promotes the use of the process approach. So, if you need to audit, for example, two departments, you need to check in which processes those departments participate. Then, for each process consider:
And start writing your checklist: what evidences do you want to see, what do you want to ask, with whom do you want to speak, what about sampling, what will be the path for the audit and with audit teams with more than one auditor – decide who will audit what. After that exercise, you will be able to schedule the audit and write your audit plan.
The following material will provide you information about internal audits:
- ISO 9001 – Five Main Steps in ISO 9001 Internal Audit - https://advisera.com/9001academy/knowledgebase/five-main-steps-in-iso-9001-internal-audit/
- Free online training ISO 9001:2015 Internal Auditor Course - https://advisera.com/training/iso-14001-internal-auditor-course/ ernal-auditor-course/
- Free webinar How to perform an ISO 9001:2015 internal audit - https://advisera.com/9001academy/webinar/how-to-perform-an-iso-9001-2015-internal-audit-free-webinar-on-demand/
- Book - ISO Internal Audit: A Plain English Guide - https://advisera.com/books/iso-internal-audit-plain-english-guide/ -
Product safety
Answer:
Special approval of the PMEA & Control Plan should be done by the client who is buying the product, based on clause 4.4.1.2 of the IATF 16949.
For more information please read the following articles:
- Ensuring product safety according to IATF 16949: https://advisera.com/16949academy/blog/2017/09/20/ensuring-product-safety-according-to-iatf-16949/
- How to develop a Control Plan according to IATF 16949: https://advisera.com/16949academy/blog/2017/09/27/how-to-develop-a-control-plan-according-to-iatf-16949/ and
- What is FMEA, and how to apply it in IATF 16949: https://advisera.com/16949academy/blog/2017/09/06/what-is-fmea-and-how-to-apply-it-in-iatf-16949/