Start a new topic and get direct answers from the Expert Advice Community.
CREATE NEW TOPIC +Search results
11294 results
Guest
Guest
Create New Topic As guest or Sign in
Assign topic to the user
-
OH&S risk assessment
Answer:
There are two main sources of OH&S risks:
1. risks emerging from OH&S hazards, legal and other requirements and effectiveness of existing controls;
2. risks related to establishment, implementation, operation and maintenance of the OH&SMS
For example, you can have a low awareness among employees regarding the hazards and this can lead to not applying operational controls and there is a higher risk of OH&S incidents due to the low awareness. This can be perceived as a risk from the internal context of the organization and as an action to address this risk, the organization can plan and develop awareness raising sessions for employees in order to ensure the operational controls are applied properly.
For more information, see: What are the new requirements for risks and opportunities according to ISO 45001? https://advisera.com/45001academy/blog/2018/04/25/what-are-the-new-requirements-for-risks-and-opportunities-according-to-iso-45001/ -
Cleaning of laboratory instruments
Answer:
The standard has requirements for maintenance of the infrastructure (clause 6.3) and laboratory instruments can fit into this category as a process equipment (clause 6.3 b)). This clause requires organization to document requirements for maintenance activities (in your case cleaning) including the interval of performing these activities and records of the maintenance activities.
This means that you should have some record of the cleaning activities. This record can contain information on the date of the cleaning, person who performed the cleaning and optionally the type of the cleaning activities. Depending on the type of instruments you have and frequency of cleaning, you can have either separate record for each instrument or you can have one record for group of instruments.
Here you can download free preview of our Record of Infrastructure Maintenance https://advisera.com/13485academy/documentation/record-of-infrastructure-maintenance-iso-13485-2016/ -
Lista de verificación en auditoria interna
Respuesta:
La lista de preguntas debe hacerse para garantizar que:
- los procesos, productos y servicios provistos externamente se ajustan a los requisitos
- la organización aplica controles a los procesos, servicios o productos provistos externamente
- la organización determina y aplica criterios para la evaluación, selección, seguimiento del desempeño y reevaluación de proveedores externos
- la organización retiene información documentada de estas actividades
- la organización se comunica correctamente con los proveedores externos
Aquí puede descargar una vista previa gratuita de nuestra - Lista de verificación de auditoria interna: https://advisera.com/9001academy/es/documentation/lista-de-verificacion-para-auditoria-interna/
Para obtener más información acerca de la auditoría interna, puede ver este artículo: Lista de verificación de la au ditoría ISO 9001: https://advisera.com/9001academy/knowledgebase/iso-9001-audit-checklist/
También puede asistir a este curso en línea gratuito: curso de auditor interno ISO 9001: 2015: https://advisera.com/es/formacion/curso-auditor-interno-iso-9001/ -
Data breaches
Answer:
Article 4 – Definitions of the EU GDPR (https://advisera.com/gdpr/definitions/) defines personal data as “any information relating to an identified or identifiable natural person (‘data subject’); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person;” so this definitely includes the account number as we ll as credit card number.
As regards to data breaches, notifying data breaches was not required under the old directive but is now under the EU GDPR under certain circumstances that relate to the likelihood of the breach affecting the rights and freedom of the data subjects. So, unless there is no risk to the data subject a controller can choose not to notify a breach. However, if we are talking about financial data is most likely that there would be a risk for the affected data subjects thus the breach would need to be reported.
To learn more about data breaches check out our webinar “A How-to Guide for GDPR Data Breach Notifications” (https://advisera.com/eugdpracademy/webinar/a-how-to-guide-for-gdpr-data-breach-notifications-free-webinar-on-demand/) -
Scope definition
Answer: Regarding section 2.4 of the ISMS scope document, you do not have to state each asset of IT infrastructure separately. It is sufficient to state the type of assets as you mentioned. It is also important to include the networks involved (e.g., Organization's LAN, or data center sub-network).
Included in the template there are comments with examples you can use to define your ISMS scope.
These articles will provide you further explanation about scope definition:
- How to define the ISMS scope https://advisera.com/27001academy/knowledgebase/how-to-define-the-isms-scope/
- Problems with defining the scope in ISO 27001 https://advisera.com/27001academy/blog/2010/06/29/problems-with-defining-the-scope-in-iso-27001/ -
ISO management system certification
Answer: First you have to implement ISO 27001 / ISO 22301 according the steps described in the toolkit you bought. After implementation, you have to look for a certification body to audit your system and issue a certificate in case the system is complaint with standards requirements.
2 - Once I work on completing all the documents in the documentation toolkit what happens then? Do I submit them to Advisera and you submit it to ISO or do I need to submit them to ISO myself?
Answer: During implementation you can submit some of your documents to us for review, so we can evaluate their compliance to the standards and suggest improvements when needed, but it is your organization that has to go through the process to select an certification body and submit your management system to the certification process. We are not authorized to issue certificates, since we are not a certification body.
This article will provide you further explanation about choosing a certif ication body:
- How to choose a certification body https://advisera.com/blog/2021/01/11/how-to-choose-an-iso-certification-body/
3 - How long on average does it take to become certified when the documents are submitted?
Answer: The time to go through all the certification process will vary depending on the size and complexity of the management system scope, but generally it takes between one to four months (mostly depending if the organization goes through a pre-certification audit or not).
- Becoming ISO 27001 certified – How to prepare for certification audit https://advisera.com/27001academy/iso-27001-certification/
- ISO 27001/ISO 22301: The certification process [free webinar on demand] https://advisera.com/27001academy/webinar/iso-27001iso-22301-certification-process-free-webinar-demand/
4 - Will someone from the body come to my company to conduct an assessment?
Answer: The certification process is conducted in two phases: a document review, which not necessarily requires the presence of the certification auditor in the organization, and the main audit, which is performed in the organization to asses the compliance of implemented processes and controls.
5 - Will my company receive certifications?
Answer: If your system is fully complaint with the standard's requirements, you will get the certificate.
6 - Can my company start to use the certifications in marketing or to secure new deals?
Answer: One of the benefits of certified systems is that you can use the certification as a market tool, to demonstrate you can protect information (regarding ISO 27001) / ensure business continuity (regarding ISO 22301). Together with the certification you also will receive from the certification body orientations about how to use the elements such as logos and certification information to promote your business. -
What is an environmental aspect?
Answer:
Any organization interacts with the environment. An environmental aspect is the way the activities or products or services of an organization interact or can interact with the environment. For example, a manufacturing plant consumes electricity and raw materials, discharges effluents and air emissions and generates wastes. The products must be transported and are used by consumers. During those steps the interactions with the environment continue to happen.
The following material will provide you information about environmental aspects:
- ISO 14001 – 4 steps in identification and evaluation of environmental aspects - https://advisera.com/14001academy/knowledgebase/4-steps-in-identification-and-evaluation-of-environmental-aspects/
- Environmental aspect identification and classification - https://advisera.com/14001academy/blog/2019/08/27/key-iso-14001-benefits-to-customers/nowledgebase/environmental-aspect-identification-and-classification/
- free online training ISO 14001:2015 Foundations Course - https://advisera.com/training/iso-14001-internal-auditor-course/
- book - THE ISO 14001:2015 COMPANION – A A Straightforward Guide to Implementing an EMS in a Small Business - https://advisera.com/books/the-iso-14001-2015-companion/ -
Evidences of a strategic orientation
Answer:
It can be clear to an objective observer what is the strategic orientation of an organization. Assuming a strategy requires making choices, particularly, making trade-offs. An organization with a strategic orientation will assume to be good in some things and not so good at others. For example, if an organization has a strategic orientation of being a very competitive low-price supplier it cannot be, at the same type, a very competitive supplier of innovative products and services. Having said that, I believe that in most cases that is not possible or not clear for an objective observer because the strategic orientation is not cle ar for the organization or is not translated into the QMS documentation. Last month, when preparing the checklist for an audit, I looked into the quality policy and realized that they had only statements that anyone can subscribe, no strategic orientation there. Like “We want satisfied customers”
The following material will provide you information about strategic orientation:
ISO 9001 – Aligning quality objectives of the QMS with the strategic direction of the company - https://advisera.com/9001academy/blog/2017/03/07/aligning-quality-objectives-of-the-qms-with-the-strategic-direction-of-the-company/
You can look for strategic orientation example in this link https://advisera.com/books/wp-content/uploads/sites/9/2017/09/Discover-ISO-9001-through-practical-examples-EN-LookInside.pdf
- free online training ISO 9001:2015 Foundations Course – https://advisera.com/training/iso-9001-foundations-course/
- book - Discover ISO 9001:2015 Through Practical Examples - https://advisera.com/books/discover-iso-9001-2015-through-practical-examples/ -
Leadership and commitment evidences
Answer:
Objective evidence to demonstrate leadership can be gathered through interviews, observation and documented information. For example:
evaluating alignment between information and other evidences shown during interviews with the practices, real performance and documented information;
evaluating participation in communication and awareness events;
ensuring that the QMS is integrated in the business management system;
ensuring resources for the operation and improvement of the QMS;
ensuring that actions are taken when there is a gap between real and desired performance
For example, if your organization demonstrates lack of critical resources to satisfy customers or the conformity of products or services, the auditor will be in the presence of an evidence of lack of commitment with the QMS.
The following material will provide you information about leadership and commitment:
ISO 9001 – How to comply with new leadership requirements in ISO 9001:2015 - https://advisera.com/9001academy/knowledgebase/how-to-comply-with-new-leadership-requirements-in-iso-90012015/
- free online training ISO 9001:2015 Foundations Course – https://advisera.com/training/iso-9001-foundations-course/
- book - Discover ISO 9001:2015 Through Practical Examples - https://advisera.com/books/discover-iso-9001-2015-through-practical-examples/ -
Risk Assessment
Answer: The probability of occurrence can be identified by means such as historical data (either from the own organization or from available data from organization's industry), statistical models, or by expert opinion.
This article may provide you more information about identification of probability of occurrence: - How to assess consequences and likelihood in ISO 27001 risk analysis https://advisera.com/27001academy/iso-27001-risk-assessment-treatment-management/#assessment
2. How to identify the Chance of non-detection ?
Answer: For equipment you may find information about failure rates (or false negatives) on documentation provided by manufacturers. Regarding procedural controls, tests and simulations involving users, technical staff can provide information to help identify chances of a procedural control fail without detection.