a) is appropriate to the purpose and context of the organization and supports its strategic direction; Nonconformity: Quality policy is not appropriate to the purpose and context of the organization and supports its strategic direction. How CAN I CLOSE THOSE GAPS”
Answer:
It is very difficult to give a precise help with so little information. Last Tuesday I visited a company and they had their quality policy on the wall. I noticed that the text did not mention neither the name of the company, neither what they do. That text could be used for any company in any economic sector.
When I help na organization write their quality policy I make several questions:
How does your organization wins its most desirable customers? What do they value the most? Are there relevant interested parties that help you win businesses? What do they value the most? The answers to these questions help you assess the strategic orientation of your organization.
Then, when I work with the top management of an organization to write the quality policy I follow this recipe:
Who we are and what is our business (for example, our business is not what we manufacture but the results that our customers get);
To whom do we work;
In what kind of challenges do we need to be the best;
And include the two commitments of the standard (continual improvement and meeting customer and regulatory requirements)
For example:
” Company name" is an industrial company specialized in comfort footwear.
We serve customers who need a supply of comfort footwear for professional uses.
In order to better serve our customers, we believe that we must seek to continuously improve:
Our ability to develop, to be able to respond quickly to requests for samples;
A language of product that differentiates us and supports the promise of comfort;
The ace card of being a manufacturer and being able to be faster and more flexible in production;
The fulfillment of our commitments."
The following material will provide you information about quality policy:
When developing a scope statement, the important is that the extent of the QMS should be clear and not misleading. The presented proposal seems to comply with the requirements of clause 4.3
The following material will provide you information about internal audits:
Answer:
Clause 8.3 is both for the development of products and services. But as far as I understand your organization develops products for cleaning operations. When you develop a new cleaning product clause 8.3 applies. When you test samples with different products in order to give the best advice, you are working around clause 8.2. So, I agree with your interpretation.
The following material will provide you information about design and development:
An audit to a quality management system has two purposes, auditing:
conformity – is the organization working according to its own requirements and to ISO 9001 requirements;
effectiveness – is the organization meeting its objectives.
Also, audits are about the quality management system, not about the quality of products and services. That is why organizations are n ot allowed to put the logo of certification in contact with the products they manufacture. What is audited is not the product but, for example, if manufacture and quality control activities were performed and decisions made according to planned. About that phrase “ensure that they actually are the right processes”, ISO 9001 uses the word determine instead of identifying. There are no right processes waiting to be discovered. Process definition is an act of management. Determining means establishing the processes by research or calculation, there is will in there. Identify processes means recognizing, discovering processes among the available processes. The truth is, there are no available processes waiting to be discovered. Organizations should decide which processes they need. Conformity and effectiveness are the critical evaluation criteria.
The following material will provide you information about internal audits:
Answer:
When I think about waste management I draw a flowchart about each major waste life cycle. Something like: where it is generated, when it is collected to an internal collection station, labeled and stored, and how it is handled (can be internal recycle, can be internal re-use, can be transport to an authorized waste operator and in that case, we need contact and fill legal documents).
For each step I think about how to transmit, how to show the correct practices – I can use a written document, a work instruction; I can use a series of drawings or pictures, what some call a kamishibai; I can use short films, I can use games people play to learn how to act.
In the particular case of cruise ships, I imagine, without experience, that they have their own incineration plants as a way of handling wastes.
The following material will provide you information about waste management:
Answer:
ISO9001 has changed drastically since it was referred to as Iso 9000, and the style of auditing has also changed to a process audit approach. The latest change with ISO 9001:2015 has made even further changes, and the additions for AS9100 (the aerospace requirements for a QMS which add onto ISO 9001) have even changed in the latest revision.
I suggest you look over our whitepaper which goes over the clausesof AS9100 Rev D: https://info.advisera.com/9100academy/free-download/clause-by-clause-explanation-of-as9100-rev-d
Non-EU based controller
· DPAs with processors
· Privacy notices to individuals
· Safeguards for transfer of data – if the EU processor transfers data to another non-EU processor, who exactly should have safeguards in place such as for example SCC and Privacy Shield certification: the controller himself or the specific processors that are transferring data between them?
· EU representative
Anything else you can add?
Answer:
Since you are dealing with sensitive personal data you should also focus on preventing and if necessary notify any data breaches and do not forget about Data Protection Impact Assessments.
If the EU GDPR is applicable for your university than I would say that a Privacy Policy would need to be created to raise awareness and prove compliance. But first you need to check in which areas is the GDPR applicable because is most likely it would be applicable in limited cases.
We are interested in moving into an AS 9100 certification as well, so I want a strong QMS governing my ISO 9001:2015 in order to have a smooth transition into the new cert.
Answer:
We have a complete audit checklist which includes more than 100 questions to ensure each requirement of the ISO 9001 standard is implemented and maintained within the QMS, and includes the ability for the company to add additional questions to suit additional company needs. You can download a free preview here - Internal Audit Checklist: https://advisera.com/9001academy/documentation/internal-audit-checklist/
Yes, our templates are designed to be fully compliant with the standards they cover. This internal audit checklist covers the main requirements of ISO 22301 and ISO 27001 and the controls from ISO 27001 Annex A.
You can take a look to the free demo of the Internal audit checklist at this link: https://advisera.com/27001academy/documentation/internal-audit-checklist/
From this free demo you can check if it can fulfil your needs.