Start a new topic and get direct answers from the Expert Advice Community.
CREATE NEW TOPIC +Search results
11294 results
Guest
Guest
Create New Topic As guest or Sign in
Assign topic to the user
-
SMART objectives for processes
Answer:
SMART objectives is not an ISO 9001:2015 mandatory requirement, it is a good practice.
S – specific. Both are specific objectives, as long as “critical spares” are defined.
M – measurable. Both are measurable objectives, one can count how many times critical spares were not in stock, and how many times purchased materials had quality problems during reception or found during transformation.
A – attainable. Personally, I start wondering if 100% is a reasonable target, perhaps too demanding, perhaps too expensive. I would like to see past performance before setting the bar so high. So, without further data, I would recommend care about the targets. Some people use the A for agreed (objectives should be negotiated and accepted by both parts, top management and the person responsible for meeting the objective).
R – responsible. You should add who is going to be responsible for each objective. Who is going to lead the transformation needed to get that target performance. Some people use the R for realistic (same as achievable or attainable).
T – time framed. You should add a time frame for each objective. How long it will take to meet the target.
The following material will provide you more information about smart objectives:
- ISO 9001 – How to Write Good Quality Objectives - https://advisera.com/9001academy/knowledgebase/how-to-write-good-quality-objectives/
- Free webinar – Measurement, analysis, and improvement according to ISO 9001:2015 - https://advisera.com/9001academy/webinar/measurement-analysis-and-improvement-according-to-iso-9001-2015-free-webinar/
- Enroll for free in the ISO 9001:2015 Foundations Course –https://advisera.com/training/iso-9001-foundations-course/
- book - Discover ISO 9001:2015 Through Practical Examples - https://advisera.com/books/discover-iso-9001-2015-through-practical-examples/ -
Gage R&R
Answer:
Gage R&R stands for Gage Repeatability and reproducibility and it is mandatory when you perform Measurement System Analysis (MSA).
When Gage R&R study fails that means you don’t have the process under control as per Control plan. So, MSA is not valid if Gage R&R fails. It means people who are doing measurement had a lot of variation and process is not stable.
So, based on your case it is non-conformance for clause 7.1.5.1.1 Measurement System Analysis.
A supplier needs to show that Gage R&R has pass ed. There is no opportunity for reusing of any old Gage R&R study because it refers only to measurement done at the specific time.
Please see further explanation at How to establish Measurement System Analysis (MSA) - https://advisera.com/16949academy/blog/2017/11/08/how-to-establish-measurement-system-analysis-according-to-iatf-16949/
Also, you may use our Procedure for Control of Gauges - https://advisera.com/16949academy/documentation/procedure-for-control-of-gauges/ -
Supplier survey's responsibility
Answer:
Supplier surveys can be done by any department in any organization. ISO 9001:2015 does not mandate that it should be done by a particular department. Each organization should appoint responsibility according to its own particular case.
The following material will provide you with information about supplier surveys:
- ISO 9001 – How to evaluate supplier performance according to ISO 9001:2015 - https://advisera.com/9001academy/blog/2015/10/27/how-to-evaluate-supplier-performance-according-to-iso-90012015/
- Enroll for free in the ISO 9001:2015 Foundations Course - https://advisera.com/training/iso-9001-foundations-course/
- book - Discover ISO 9001:2015 Through Practical Examples - https://advisera.com/books/discover-iso-9001-2015-through-practical-examples/ -
Documented information control
Answer:
ISO 27001 does not prescribe in which format information must be, only that formats must be defined, so you can use your procedures as video recording, provided that you manage them fulfilling the requirements for documented information from clauses 7.5.2 and 7.5.3 (e.g., approval flow, records, preservation, etc.)
This material will also help you regarding documented information:
- Managing ISO Documentation: A Plain English Guide https://advisera.com/books/managing-iso-documentation-plain-english-guide/
- Document management in ISO 27001 & BS 25999-2 https://advisera.com/27001academy/blog/2010/03/30/document-management-within-iso-27001-bs-25999-2/ -
Filling template
Answer:
Here is a practical example of how to fill this template:
Consider that, a customer named Jon has a service level agreement with your company which defines, on clause 32-b, that access to all information provided by the customer to information system ABC are restricted to customer personnel only. In this case the person responsible for system ABC is the responsible to ensure compliance of the system to this requirement. Then your document would be like this:
Interested party: Customer Jon
Requirement: Clause 32-b (Information provided to system ABC are restricted to customer's personnel)
Document: Service level agreement
Person responsible for compliance: System ABC administrator
Deadline: when system ABC is made available for customer use -
Criminal background check
Answer:
If you or the company are in one of the EU Member States then the EU GDPR is applicable. This means that the company would need a legal ground to conduct the background check. Because, usually background checks reveal sensitive or criminal conviction data, the most common legal ground used in this type of situations is consent. So the hiring company should have asked for your consent before performing the background check. Moreover, they should have also explained to you via a privacy notice why the background check is needed, what data they would be processing about you, how long they would keep it as well as what are your rights as regards to your data. If the company hasn't done so, then they have indeed breached the provisions of the EU GDPR.
If you wa nt to find out more about consent, check out this article: Four main questions for obtaining and managing data subjects’ consent under GDPR (https://advisera.com/eugdpracademy/knowledgebase/four-main-questions-for-obtaining-and-managing-data-subjects-consent-under-gdpr/). -
ISO 27001 and GDPR trainings
Answer:
For information security these are some security practices you should consider (without more information about your context it is not possible to suggest additional alternatives):
- Authentication
- Network connection
- Access to device
- Physical security
- Data encryption
- Backup
- Software installation and patching
- Basic security “hygiene”
As for GDPR, we provide two free courses that can help you enhance the knowledge about the EU GDPR:
- EU GDPR Foundations Course (https://advisera.com/training/eu-gdpr-foundations-course//) (which is a more general course)
- EU GDPR Data Protection Officer Course (https://advisera.com/training/eu-gdpr-data-protection-officer-course/) (for more in depth knowledge ).
This article will provide you further explanation about security practices:
- 8 Security Practices to Use in Your Employee Training and Awareness Program https://advisera.com/27001academy/blog/2015/03/02/8-security-practices-to-use-in-your-employee-training-and-awareness-program/
This material will also help you with awareness and training:
- Free Security Awareness Training: https://advisera.com/training/awareness-session/security-awareness-training/ - this is a series of 25 videos that cover various topics related to security. -
Product safety characteristics
Answer:
Product safety is the new clause of IATF standard, but sure it was a requirement before just spread in other clauses.
The requirement states that all preventive actions that are used as a control of product safety during manufacturing should be included in the documented safety process. So, Anti rust oil applied for the preservation of the part is safety characteristic because it is used to prevent risk.
We suggest following articles for further explanation:
-Ensuring product safety according to IATF 16949: https://advisera.com/16949academy/blog/2017/09/20/ensuring-product-safety-according-to-iatf-16949/#comment-4232137428
-Product Safety Procedure: https://advisera.com/16949academy/documentation/product-safety-procedure/ -
Quality objectives and construction projects
Answer:
First, remember that good quality objectives should be consistent with the quality policy of your organization.
Yes, a good quality objective can be a decrease of nonconformities during construction projects.
2. “To conduct at least 3 internal audits per annum for the project. For every External NCR issued by the consultant, One internal NCR shall be issued. Can these be a Quality objective for a construction project?”
Answer:
These proposals can be considered as rules that your organization intends to follow. Not very demanding as quality objectives. What do clients want from your organization’s construction projects? What does your top management want from your organization’s construction projects? Satisfied clients? No delays? No defects? No overbudget? These ideas can be raw materials for your organization’s quality objectives.
The following mater ial will provide you with more information about quality objectives:
- ISO 9001 – How to Write Good Quality Objectives - https://advisera.com/9001academy/knowledgebase/how-to-write-good-quality-objectives/
- Free webinar – Measurement, analysis, and improvement according to ISO 9001:2015 - https://advisera.com/9001academy/webinar/measurement-analysis-and-improvement-according-to-iso-9001-2015-free-webinar/
- book - Discover ISO 9001:2015 Through Practical Examples - https://advisera.com/books/discover-iso-9001-2015-through-practical-examples/ -
ISO 27001 and SOC
Answer:
The main functions of a SOC are to monitor, detect, investigate, and respond to cyber threats. Considering that, the most probable ISO 2700 controls you have to consider for SOC are controls from sections A.12.4 Logging and monitoring, A.12.6 Technical vulnerability management, A.13.1 Network security management, and A.16.1 Management of information security incidents and improvements.
Regarding possible questions, I suggest you to take a look at these sections in our ISO 27001 Gap Analysis Tool at this link: https://advisera.com/27001academy/free-iso-27001-gap-analysis-tool/
These articles will provide you further explanation about controls from these sections:
- Logging and monitoring according to ISO 27001 A.12.4 https://advisera.com/27001academy/logging-according-to-iso-27001/
- How to use penetration testing for ISO 27001 A.12.6.1 https:/ /advisera.com/27001academy/blog/2016/01/18/how-to-use-penetration-testing-for-iso-27001-a-12-6-1/
- How to manage technical vulnerabilities according to ISO 27001 control A.12.6.1 https://advisera.com/27001academy/blog/2015/10/12/how-to-manage-technical-vulnerabilities-according-to-iso-27001-control-a-12-6-1/
- Using Intrusion Detection Systems and Honeypots to comply with ISO 27001 A.13.1.1 network controls https://advisera.com/27001academy/blog/2016/07/04/using-intrusion-detection-systems-and-honeypots-to-comply-with-iso-27001-a-13-1-1-network-controls/
- How to handle incidents according to ISO 27001 A.16 https://advisera.com/27001academy/blog/2015/10/26/how-to-handle-incidents-according-to-iso-27001-a-16/