Start a new topic and get direct answers from the Expert Advice Community.
CREATE NEW TOPIC +Search results
11294 results
Guest
Guest
Create New Topic As guest or Sign in
Assign topic to the user
-
MAO vs RTO
Answer: MAO and RTO are similar things, but not the same. MAO is maximum outage for a particular activity, whereas RTO is targeted time for recovery, and is usually shorter then MAO.
It works like this: first you define MAOs for all your activities, then see if there are any interdependencies, and once you realize that e.g. activity A depends on activity B, you will need to decrease the activity B's RTO to the time that will fit the MAO of the activity A.
This principle is explained further in this article: How to implement business impact analysis (BIA) according to ISO 22301 https://advisera.com/27001academy/knowledgebase/how-to-implement-business-impact-analysis-bia-according-to-iso-22301/ -
ISO 9001:2015 to AS9100 Rev D transition
1. Is AS9102 part of AS9100?
2. Is there a Standard that we need to purchase...such as I did for ISO 9001? If so, what do I use for reference to make sure I get the correct one?
3. Does the revised AS9100D include everything I would need to get us started and take us through the most current for certification?
4. Is there duplication that can be omitted or copied from the ISO 9001:2015 for certification for AS9100?
5. Is there any other information that would be helpful to me to present to upper management?
Answer:
The changes from ISO 9001:2015 to AS9100 Rev D is to include some additional requirements for the aerospace indus try onto the QMS you already have in place, here3 are the answers to your questions.
1. AS9102 is a separate standard that defines how to do first article inspections (FAI), including the forms to complete. This is referenced in AS9100 Rev D but is not formally required by AS9100. The AS9102 document is one way to do the required FAI, but unless it is a requirement of a customer to follow this specific process you can perform FAI as it suits your company.
2. You will need to get the AS9100 Rev D standard which was released in 2016. This can be found at www.sae.org, or other standard suppliers. The same can be said for AS9102, always get the most recent version of a standard.
3. The AS9100 Rev D standard includes everything. It actually includes all of ISO 9001:2015 with the additional requirements written in bold and italics so that you can see what has been added.
4. As hinted at above, the AS9100 standard uses the ISO 9001:2015 standard requirements in their entirety and simply adds to them, in fact by being certified to AS9100 Rev D you are also certified to ISO 9001:2015. So, if you are going from ISO 9001:2015 to AS9100 then the QMS you have will simply need to have some additions. For instance, a process for prevention of counterfeit parts, and some additional things to include in your corrective action process.
5. I would consider looking through our whitepaper on the AS9100 clauses, which can be compared to what you already have for ISO 9001 to see what sort of things are added. https://info.advisera.com/9100academy/free-download/clause-by-clause-explanation-of-as9100-rev-d -
Response to AS9100 certification NC
Answer:
While it is true that AS9100 does not specify a timeline that you need to close a corrective action, certification bodies do have their own rules about responding to non-conformances found in certification audits. They are not able to certify your company if they have found a problem and you have not completely fixed that problem (i.e. closed the corrective action); if you only have a plan to fix the problem they cannot grant certification. An expectation to have the certification audit non-conformances fixed and closed in 30 days is a standard timeline from certification bodies, I have not seen expectations that give m ore time.
I would recommend looking at this 9001Academy blog post on how to proceed once a corrective action is identified as it is applicable to the AS9100 QMS as well: https://advisera.com/9001academy/blog/2016/09/20/how-to-proceed-once-qms-corrective-action-is-defined/ -
Benefits of ISO 27001
Answer: You need to show to your director what are the benefits of ISO 27001, which basically are 4: Compliance, Marketing edge, Lowering expenses and putting your business in order. To know more about these benefits, please see this article “Four key benefits of ISO 27001 implementation” : https://advisera.com/27001academy/knowledgebase/four-key-benefits-of-iso-27001-implementation/
This free webinar can be also interesting to know how to obtain the management support “ISO 27001 benefits: How to obtain management support” : https://advisera.com/27001academy/webinar/iso-27001-benefits-how-to-get-management-buy-in-free-webinar-on-demand/ -
Documenting risks and opportunities
2. How do we document risk and opportunities from environmental aspect?
Answer:
1. You don´t need to document risks and opportunities at department level, you just have to identify the risks and opportunities that are present for your EMS, decide which need to be addressed, and keep documentation of the risks and opportunities you will address.
2. You can create a formal Risk Register within the EMS where identification, discussion, actions, outcome, and monitoring can all be listed and results clearly evaluated. Again you just need to document those risks that arise from environmental aspects and need to be addresed.
These materials can help you with the risks andopportunities:
- Article - Risks and opportunities in ISO 14001:2015: what they are and why they are important: https://advisera.com/14001academy/blog/2016/03/07/risks-and-opportunities-in-iso-140012015-what-they-are-and-why-they-are-important/
- Article - ISO 14001 r isks and opportunities vs environmental aspects: https://advisera.com/14001academy/blog/2016/06/06/iso-14001-risks-and-opportunities-vs-environmental-aspects/
- Book - The ISO 14001:2015 companion: https://advisera.com/books/the-iso-14001-2015-companion/
- ISO 14001:2015 Foundations Course: https://advisera.com/training/iso-14001-internal-auditor-course/ -
Inventory of processing activities
1. Do we need a separate inventory for Processing activities for data of our clients (As Processor)? If so should we adapt this document or is there a separate document.
2. Does processing of employee data (of our own employees) also need to be added to the inventory?
Answers:
1. The “Inventory of Processing Activities” has two separate sheets. The controller sheet is to be used to capture the processing activities where you act as a data controller and the processor sheet should be used for the processing activities where you act as a data processor. Art. 30 - Records of processing activities (https://advisera.com/eugdpracademy/gdpr/records-of-processing-activities/) requires that under certain circumstances both controller and processors keep these kind of records.
2. Processing activities related to your own employees such as recruitment, onboarding, payroll, time management etc. need to be captured in the “Inventory of Processing Activities” in the controller sheet. -
Lawful grounds for processing employee biometric data
There is no need for the employees to sign the Privacy Notices, it is enough for you to send an email with the Privacy Notice enclosed or provide a link to the Privacy Notice. It would also be advisable for you to publish the Privacy Notice on your intranet page to be available to all employees. -
An expanding scope
Answer:
In principle, what your client requests is feasible. The scope of a quality management system (QMS) is not necessarily equal to the scope of a company’s activities. Sometimes organizations do it like this: they start with a QMS with a limited scope and certify it. Later, they update the scope and include new activities in the QMS. In your situation, I would document the different scopes and transition schedule and would speak with the certification body, even before starting the implementation project. Certification bodies can help with those issues.
The following material will provide you information about quality management scope:
- ISO 9001 – How to define the scope of the QMS according to ISO 9001:2015 - https://advisera.com/9001academy/knowledgebase/how-to-define-the-scope-of-the-qms-according-to-iso-90012015/
- free online training ISO 9001:2015 Foundations Course – https://advisera.com/training/iso-9001-foundations-course/
- book - Discover ISO 9001:2015 Through Practical Examples - https://advisera.com/books/discover-iso-9001-2015-through-practical-examples/ -
AS9100 Certification Fees
1. Inspectors site visit,
2. Certification cost etc.?
Scope of work:
· Aircraft Spares Depot
· Abu Dhabi, United Arab Emirates.
Answer:
In general, for any QMS in any location, you will hire a certification body to audit your QMS and provide your certification. The fees for the process typically cover a three-year period: Year 1 – Documentation audit, Certification audit and certification, Year2 – Surveillance audit, Year 3 – Surveillance audit. These fees will differ between certification bodies and might include travel costs as well for each on site audit. They should not include any consulting services since the certification auditors are not supposed to consult on any QMS they will be auditing. It is best to check with a couple different certification bodies in your area to see the differences in fees.
This downloadable checklist includes the implementation and certification steps you will need fo r yoru AS9100 implementation: https://info.advisera.com/9100academy/free-download/project-checklist-for-as9100-rev-d-implementation -
ISO 17024 online ISO 20000 Lead Auditor training
Answer:
I wouldn't point to particular organization, but there are some accredited training institutions that are quite popular and accredited, like: PECB, IRCA, Exemplar Global (formerly RABQSA), etc.
This article provides more information about accreditation:
"Accreditation vs. certification vs. registration in the ISO world" https://advisera.com/articles/accreditation-vs-certification-vs-registration-in-the-iso-world/