Start a new topic and get direct answers from the Expert Advice Community.
CREATE NEW TOPIC +Search results
11294 results
Guest
Guest
Create New Topic As guest or Sign in
Assign topic to the user
-
Basics of implementation of IATF 16949
Answer:
Basics of implementation of IATF is for sure quality management system or implementation of ISO 9001. IATF or former TS 16949 was the technical specification for ISO 9001 which means that standard requirements were higher and more specific for the automotive industry. Core Tools this standard requires are Advanced Product Quality Planning (APQP); Failure Mode and Effects Analysis (FMEA), Measurement Systems Analysis (MSA), Statistical Process Control (SPC) and Product Part Approval Process (PPAP). Implementation of core tools can help business to improve and achieve continual improvement if they are used in good way.
I suggest you find out more about the basics of implementation in this article:
-How to write the IATF 16949 Quality Manual https://advisera.com/16949academy/blog/2017/05/31/how-to-write-the-iatf-16949-quality-manual/
For core tools please take a lo ok at What are the five core tools of IATF 16949? https://advisera.com/16949academy/blog/2017/08/23/what-are-the-five-core-tools-of-iatf-16949/ -
Supervisory authority for data protection
Answer:
The EU GDPR states that is compulsory for a legal entity to appoint a DPO only if (a) the processing is carried out by a public authority or body, except for courts acting in their judicial capacity; or (b) the core activities of the legal entity consist of processing operations which, by their nature, their scope and/or their purposes, require regular and systematic monitoring of data subjects on a large scale; or (c) the core activities of the legal entity of processing on a large scale of special categories of data pursuant to Article 9 of the EU GDPR and personal data relating to criminal convictions and offences referred to in Article 10 of the EU GDPR.
Also since the organization is in Sri Lanka and India, you first need to identify if the EU GDPR is applicable. The key to understanding when EU GDPR is applicable is understanding the meaning of “in the Union.” The EU GDPR will only apply to personal data regarding individuals within the Union, while the nationality or habitual residence of those individuals is irrelevant. For example, a company based in the EU which is processing the data of Japanese individuals located in Japan will still need to comply with the EU GDPR. Consequently, the Japanese individuals will be benefiting from all rights according to the EU GDPR, even if these rights do not exist in their own nation’s laws.
When the data is processed outside of the EU by companies which are also outside the EU, then this is not considered to be “in the Union”. For example, the EU GDPR will not be applicable for a school which is based in the United States just because there is a possibility that one or several of its students would be EU citizens. In this case, the processing does not take place “in the Union,” nor is the individual “in the Union”.
If your customer falls under both criteria above it would need to appoint a representative in the EU and the competent Supervisory Authority would be the one where the representative is established.
To learn more about the duties of a DPO check out our EU GDPR Data Protection Officer Course (https://advisera.com/training/eu-gdpr-data-protection-officer-course/). -
ISO 27001 requirements and implementation
Answer:
To understand ISO 27001 requirements I suggest you these materials:
- What is ISO 27001 https://advisera.com/27001academy/what-is-iso-27001/
- Clause-by-clause explanation of ISO 27001 https://info.advisera.com/27001academy/free-download/clause-by-clause-explanation-of-iso-27001
To understand how to implement ISO 27001 I suggest you this material:
- ISO 27001 implementation checklist https://advisera.com/27001academy/knowledgebase/iso-27001-implementation-checklist/
- ISO 27001: An overview of the ISMS implementation process [free webinar on demand] https://advisera.com/27001academy/webinar/iso-27001-overview-isms-implementation-process-free-webinar-demand/
These materials will also help you regarding ISO 27001 requirements and implementation:
- Book Secure & Simple: A Small-Business Guide to Implementing ISO 27001 On Your Own https://advisera.com/books/secure-and-simple-a-small-business-guide-to-implementing-iso-27001-on-your-own/
- Free online training ISO 27001 Foundations Course https://advisera.com/training/iso-27001-foundations-course/ -
ISO 45001 Consultation process
Answer: The ISO 45001:2018 standard does not have a specific requirement to have a workers’ representative assigned for the OH&SMS. Throughout the standard, the term ‘workers’ representatives’ is used, but always with the addition of the term ‘where they exist’. This is done because legal requirements in some jurisdictions require workers’ representatives for OH&S and if these representatives do exist they need to be included into the OH&SMS processes.
2. We made a survey to ask workers about the way that they preferred to communicate with them and they select E-mail, is it enough for participation with workers to use E-mail for asking them or informing?
Answer: Clause 5.4 on consultation and participation of workers is clear that a process needs to be put in place to meet certain requirements about getting the input of workers for the OH&SMS as well as informing them of OH&SMS information, telling you what needs to be done and not how to do it. So, if the email process you i dentified meets the requirements that are identified in clause 5.4 then this is an acceptable way of defining this process.
If you need some help in identifying all of the necessary documentation for ISO 45001:2018 see this free whitepaper “Checklist of mandatory documentation required by ISO 45001”: https://info.advisera.com/45001academy/free-download/checklist-of-mandatory-documentation-required-by-iso-45001 -
Certification of ISO consultants
Answer:
There is no particular “official” or legal requirements for someone to become an ISO 9001 consultant. Having said that, put yourself in the shoes of a potential customer. Would you prefer to work with someone without a CV, without any references, or would you prefer to work with someone with some experience or study about the job? I believe that a potential customer prefers to work with a consultant with a certification.
That is why Advisera developed such course for ISO 9001, ISO 14001 and ISO 27001 consultants. Course with a part based on the standard and the more important part based on good practices for developing, executing and controlling a management system implementation project. For example, for ISO 9001, check - free online training ISO 9001:2015 Lead Implementer Course - https://advisera.com/training/iso-9001-lead-implementer-course/ -
Requirement for Policy for Business Continuity
Dejan said the [Strategy for business continuity] I can exclude if we don’t want to become compliant with ISO 22301. This means to me it isn’t part of ISO 27001. What about the [policy for business continuity]: is it also just a part of ISO 22301 or is it a part of ISO 27001 too (for example A.17 out of the ISO 27001 standard —but for that Dejan said the emergency management plan is enough and covers chapter A.17). Which part of the standard talks about having a [policy for business continuity]? I can’t find the policy in the toolkit either.
Answer:
ISO 27001 does not require a Policy for Business Continuity. This policy is a requirement only for ISO 22301. Since one of the objectives of the toolkit is to avoid excessive work on documents we did not include such policy in ISO 27001 documentation toolkit (the Disaster Recovery Plan template included in the toolkit is enough to cover the requirements of ISO 27001 A.17.).
This article will provide you furthe r explanation about implementing business continuity in an ISO 27001 ISMS:
- How to use ISO 22301 for the implementation of business continuity in ISO 27001 https://advisera.com/27001academy/blog/2015/06/15/how-to-use-iso-22301-for-the-implementation-of-business-continuity-in-iso-27001/ -
GDPR EU Representation
Answer:
You are only exempted for appointing a representative if the processing, which is occasional, does not include on a large scale the processing of special categories of data, as referred in Article 9(1) or processing of personal data relating to criminal convictions and offences referred in Article 10, and is unlikely to result in a risk to the rights and freedoms of natural persons, taking into account the nature, context, scope and purposes of the processing; or if you are a public authority or body (which is not the case). -
Defining scope
Answer:
According to ISO 27001, an ISMS scope must be defined in terms of information, locations or business units to be protected, considering the organization's objectives and context.
For small and mid-size organizations (up to 100 employees) often it is better to include all the organization in the scope, because the effort to keep only a part of the organization in the scope is not worthy. For bigger organizations defining a smaller scope may be better to reduce the costs and effort to what really matters for business objectives.
These articles will provide you further explanation about defining scope:
- How to define the ISMS scope https://advisera.com/27001academy/knowledgebase/how-to-define-the-isms-scope/
- Problems with defining the scope in ISO 27001 https://advisera.com/27001academy/blog/2010/06/29/problems-with-defining-the-scope-in-iso-27001/
These materials will also help you regarding defining scope:
- Book Secu re & Simple: A Small-Business Guide to implementing ISO 27001 On Your Own https://advisera.com/books/secure-and-simple-a-small-business-guide-to-implementing-iso-27001-on-your-own/
- Free online training ISO 27001 Foundations Course https://advisera.com/training/iso-27001-foundations-course/ -
Internal audit - Plan & Report
Answer:
Conducting an internal audit can be done following these steps found in ISO 19011:
1 – Initiate the Audit
2 – Review the Documents
3 – Develop Audit Plan
4 – Assign Work to Auditors per Plan
5 – Prepare Working Papers
6 – Determine the Audit Sequence
7 – Conduct Opening Meeting
8 – Review Documents and Communicate
9 – Carry out the Audit
10 – Generate Audit Findings
11 – Present Findings and Conclusions
12 – Formally Distribute Audit Report
13 – Follow Up on Actions / Corrective Actions
You can find more information about this in these articles:
- 13 steps for ISO 9001 internal auditing using ISO 19011: https://advisera.com/9001academy/knowledgebase/13-steps-for-iso-9001-internal-auditing-using-iso-19011/
- Five main steps in ISO 9001 internal audit: https://advisera.com/9001academy/knowledgebase/five-main-steps-in-iso-9001-internal-audit/
The internal audit plan is a document to record and inform necessary employees of an audit that will happen. The Audit Plan should include the purpose, scope, criteria, and objectives for the audit, as well as identify audit datea and Audit Team members.
Regarding the Internal Audit Report, it is the document used to report on the findings of an internal audit. The following elements need to be included in an audit report:
- Audit objective
- Audit scope
- Audit client
- Audit days and places
- Audit criteria
- Audit findings
- Audit conclusions
Again, the best practice for audit report content can be found in ISO 19011 - Guidelines for quality and/or environmental management systems auditing.
For more information about the audit report, see this article - Writing a good QMS intrenal audit report: https://advisera.com/9001academy/blog/2015/03/17/writing-a-good-qms-internal-audit-report/
You can find more information about an audit report here - Writing a good QMS internal audit report: https://advisera.com/9001academy/blog/2015/03/17/writing-a-good-qms-internal-audit-report/
There materials can help you to learn more about internal audit in ISO 9001:2015:
- Book - ISO Internal Audit Plain English Guide: https://advisera.com/books/iso-internal-audit-plain-english-guide/
- ISO 9001:2015: Internal Auditor Course: https://advisera.com/training/iso-9001-internal-auditor-course/ -
Audit meetings
Answer:
The need for opening and closing meetings on internal audits are more related to audit complexity than the number of employees (company turnover would not be a good criteria). Good criteria to decide for performing opening and closing meetings on internal audits are if the audit scope falls under the responsibility of more than one person (e.g., the audit scope involves two or more unrelated departments or process), or if there is a great number of people involved in the audit (e.g., there is an audit team, or the auditor will be working with multiple guides from the auditee).
This way the auditor will ensure alignment between all personnel involved in the audit and will save time not repeating the same information multiple times during the audit.
This article will provide you further explanation about internal audits:
- Qualifications for an ISO 27001 Internal Auditor https://advisera.com/27001academy/blog/2015/03/30/qualifications-for-an-iso-27001-internal-auditor/
By the way, the opening and closing meeting are explained in our Lead Auditor course.