Start a new topic and get direct answers from the Expert Advice Community.
CREATE NEW TOPIC +Search results
11294 results
Guest
Guest
Create New Topic As guest or Sign in
Assign topic to the user
-
Different Audits in ISO 14001
Answer:
In order to effectively implement ISO 14001:2015 you need to conduct an internal audit to look for any non conformity and apply the necessary corrective actions. Also if you want to be certified in ISO 14001:2015 you will have to successfully pass the certification audit by an external certification body. Once you get the certification you´ll need to maintain your different processes to keep updated your QMS which is demonstrated during the surveillance audits, usually conducted once every year during the following years until the recertification audit.
These materials can help you to better understand audits:
- Article -Certification audits vs surveillance audits in ISO 14001: https://advisera.com/14001academy/blog/2016/07/11/certification-audits-vs-surveillance-audits-in-iso-14001/
- Article - 5 Tips to help you prepare for your ISO 14001 surveillance audit: https://advisera.com/14001academy/blog/2015/11/23/5-tips-to-help-you-prepare-for-your-iso-14001-surveillance-audit/
- Article - ISO 14001 certification: https://advisera.com/14001academy/blog/2019/08/27/key-iso-14001-benefits-to-customers/nowledgebase/iso-14001-certification/
- Book - The ISO 14001:2015 companion: https://advisera.com/books/the-iso-14001-2015-companion/
- ISO 14001 Lead Implementer Course: https://advisera.com/training/iso-14001-lead-implementer-course/ -
FAI requirements in AS9100 Rev D
Answer:
The requirements in AS9100 Rev D around first article inspection are found in clause 8.5.1.3 “Production process verification” which requires you to verify that production processes meet requirements, and use a representative item from the first production run of a new part to verify that everything involved produces a part that meets standards. It then notes that this activity can be referred to as FAI. This includes no requirements for what needs to be in a report for this activity.
The AS9100 Rev D standard also give reference to AS9102 in annex C which is a standard for first article inspection. This standard does include how to do this including reference dimensions, but unless this is a requirement of the customer it is not something that is needed per AS9100. What is included in the FAI report comes down to what customer requirements have been placed on you.
One other thing that may help you is this whitepaper titled “Clause-by-clause explanation of AS9100 Rev D”, https://info.advisera.com/9100academy/free-download/clause-by-clause-explanation-of-as9100-rev-d -
Auditing in AS9100 Rev D
Answer:
There are a number of past blog articles that can help you to work on auditing a QMS such as “6 main steps in the internal audit process according to AS9100 Rev D” (https://advisera.com/9100academy/knowledgebase/6-main-steps-in-the-internal-audit-according-to-as9100-rev-d/) and “developing an internal audit checklist for AS9100 Rev D” (https://advisera.com/9100academy/knowledgebase/developing-an-internal-audit-checklist-for-as9100-rev-d/). For a more detailed look at using the ISO 19011 standard for management system auditing the article from 9001Academy titled “13 steps for ISO 9001 internal audit using ISO 19011” (https://advisera.com/9001academy/knowledgebase/13-steps-for-iso-9001-internal-auditing-using-iso-19011/) may also be helpful.
One other tool tha t can help is this whitepaper titled “Clause-by-clause explanation of AS9100 Rev D”, https://info.advisera.com/9100academy/free-download/clause-by-clause-explanation-of-as9100-rev-d -
Inventory list
Answer:
If you have identified that control A.8.1.1 Inventory of assets is applicable, you have to include only assets that are related to the information your ISMS is intended to protect. Most probably IT assets will be included, as well as cabinets where physical documents are stored. Besides those assets that are used to store, process and transmit information, you can keep other organizations assets out of the inventory.
This article will provide you further explanation about asset inventory:
- How to handle Asset register (Asset inventory) according to ISO 27001 https://advisera.com/27001academy/knowledgebase/how-to-handle-asset-register-asset-inventory-according-to-iso-27001/
If you want to see how an asset inventory looks like, a nd see examples of assets for this inventory, I suggest you to take a look at the free demo of our Inventory of Assets at this link: https://advisera.com/27001academy/documentation/inventory-of-assets/ -
Certification scope
Answer:
You can limit your certification scope according to your needs, but you have to evaluate if the administrative effort to have a separated scope is worthy. In most cases, for small and medium business, or in cases where keeping a separated scope is too complex, the best approach is to certify all the services or the organization as a whole.
These articles will provide you further explanation about defining scope:
- How to define the I SMS scope https://advisera.com/27001academy/knowledgebase/how-to-define-the-isms-scope/
- Problems with defining the scope in ISO 27 -
SoA changes
If an external auditor reveals any changes to the SoA during e.g. a surveillance audit, the certification will not be valid and a new certification process needs to be stated since the scope has changed. My understanding that an SOA is a working document that should be updated as needed as the business changes. Can you let me know which is correct and point to reference material that describes this?
Answer:
Your understanding about SoA is correct. This is a living document that must be updated as needed. Sometimes this need to update is to reflect changes in risks not necessarily related to changes in the scope. In this case you have to record the decision made to update the SoA, and related information (e.g., update the risk assessment regarding the new risks). During a surveillance audit, the auditor will verify if the change in the SoA was done according the standard requirements and implemented documentation.
When changes in the SoA are in fact related to changes in the scope, besides the previous mentioned steps, you have to communicate this situation to your certification body so you can define how to approach this situation, because the certification scope will have to be updated. In some cases this will require an immediate surveillance audit, but in most cases this can be verified on the next external audit. For the additional scope you have to ensure the same steps taken that were performed to implement the ISMS.
This article will provide you further explanation about SoA:
- The importance of Statement of Applicability for ISO 27001 https://advisera.com/27001academy/knowledgebase/the-importance-of-statement-of-applicability-for-iso-27001/ -
Controlled vs. uncontrolled copies of IMS documents
Answer:
Basically you have two options:
- Provide controlled IMS documents only in electronic format and printed copies for uncontrolled documents
- Provide controlled copies for all IMS documents
In the first case you can state that IMS documents are uncontrolled in hard copy, so the contents are for reference only. This means that the information on the document is just valid at the moment of issuance and the who issued the hard copy is not reponsible for any change made to the document.
These materials can help you to learn more about document control in IMS:
- Article - New approach to document and record control in ISO 9001:2015: https://advisera.com/9001academy/blog/2015/06/30/new-approach-to-document-and-record-control-in-iso-90012015/
- Article - A new approach to documented information in ISO 14001:2015: https://advisera.com/14001academy/blog/2015/08/24/a-new-approach-to-documented-information-in-iso-140012015/
- Book - Managing ISO documentation: a plain English guide: https://advisera.com/books/managing-iso-documentation-plain-english-guide/
- ISO 9001 Lead Implementer Course: https://advisera.com/training/iso-9001-lead-implementer-course/ -
Acceptable use policy
Answer:
For this type of situation, I suggest you to take a look at the free demo of our Acceptable Use Policy at this link: https://advisera.com/27001academy/documentation/it-security-policy/
With this policy you can define clear rules for the use of the information system and other information assets and services like instant messaging/videoconferencing. -
ISO and PCI-DSS Assessor
Answer:
First it is important to understand that ISO lead auditor certification and PCI-DSS assessor certification go through different paths.
To become an ISO lead auditor you have to attend a Lead Auditor course about the standard you want to work on (e.g., ISO 27001 lead auditor course, ISO 9001 lead auditor course, etc.), be approved in an exam, and gain experience in auditing for a certification body.
For more information, see:
- How to become ISO 27001 Lead Auditor https://advisera.com/27001academy/knowledgebase/how-to-become-iso-27001-lead-auditor/
- To become a PCI-DSS assessor, please see: https://www.pcisecuritystandards.org/program_training_and_qualification/qsa_certification -
Defining good quality objectives
Answer:
The Quality Objectives derive from the Quality Policy. Good Quality Objectives derive from a good Quality Policy. A good Quality Policy takes into account the purpose and context of an organization and highlights the vectors in which an organization has to exceed to follow its strategic orientation. Those vectors written in the Quality Policy, however well-intentioned they may be, are simply written words, to be easy to monitor and evaluate the effectiveness of what is being done, it is essential to translate those words into performance challenges: The Quality Objectives. For example, if an organization competes on price, Quality Objectives should include challenges related with costs, with defects and with on-time delivery. But for an organization that competes on innovation, Quality Objectives should include challenges related with product performance, with time to market, with brand awareness.
The following material will provide you information about Quality Objectives:
- ISO 9001 – How to Write Good Quality Objectives - https://advisera.com/9001academy/knowledgebase/how-to-write-good-quality-objectives/
- What has changed with quality objectives in ISO 9001:2015? - https://advisera.com/9001academy/blog/2018/05/08/what-has-changed-with-quality-objectives-in-iso-90012015/
- free online training ISO 9001:2015 Foundations Course - https://advisera.com/training/iso-9001-foundations-course/
- book - Discover ISO 9001:2015 Through Practical Examples - https://advisera.com/books/discover-iso-9001-2015-through-practical-examples/