Start a new topic and get direct answers from the Expert Advice Community.
CREATE NEW TOPIC +Search results
11294 results
Guest
Guest
Create New Topic As guest or Sign in
Assign topic to the user
-
Análisis de riegos y auditor interno
1.- cual es el método más recomendado para el análisis de riesgo?
2.- Se requiere tener en la organización un Auditor Lìder certificado? O con un Auditor interno es suficiente?
Respuesta:
1. El método que recomiendo para la identificación y análisis de los riesgos y oportunidades es el más sencillo de llevar a cabo para la organización. Podría simplemente organizarse una reunión con el personal más relevante de la organización, que incluya alta y media dirección y realizarse un análisis DOFA (debilidades, oportunidades, fortalezas y amenazas).
La determinación de los riesgos puede realizarse de forma individual o junto con otros elementos como los aspectos ambientales, los requisitos legales y el contexto de la organización.
Para más información sobre análisis de riesgos, vea estos artículos:
- Gestión de riesgos en ISO 14001:2015: qué, por qué y cómo: https://advisera.com/14001academy/es/knowledgebase/gestion-de-riesgos-en-iso-140012015-que-por-que-y-como/
- Riesgos y op ortunidades vs. aspectos ambientales en ISO 14001: https://advisera.com/14001academy/blog/2016/06/06/iso-14001-risks-and-opportunities-vs-environmental-aspects/#
2. No es necesario tener un auditor líder certificado para llevar a cabo las tareas de auditoria interna sino auditor interno con la experiencia necesaria y cualificación para realizar la auditoria interna.
En este artículo puedes encontrar las competencias necesarias que debe poseer un auditor interno - Qué competencias debería de tener u auditor interno de ISO 14001? (disponible en inglés): https://advisera.com/14001academy/blog/2016/07/04/what-competences-should-an-iso-14001-internal-auditor-have/#
Este curso puede ser de utilidad para saber más sobre ISO 14001:2015: https://advisera.com/training/es/course/curso-fundamentos-iso-14001/ -
Audits and sampling
Answer:
Every audit compares reality with audit criteria. Reality is very wide, and no one can audit reality exhaustively. So, every audit is performed by taking samples of reality and comparing them with audit criteria to get audit evidences. When designing your sample take care to assure that samples are representative and unbiased. Good audit practice should ensure that you audit program includes all processes. All processes must be audited, but for example you can audit the Commercial Process and take the internal market as a sample, leaving for another future audit the external market.
The following material will provide you information about audits:
- ISO 9001 – What is the ISO 9001 audit program, and how does it work? - https://advisera.com/9001academy/blog/2017/01/24/what-is-the-iso-9001-audit-program-and-how-does-it-work/ at-is-the-iso-9001-audit-program-and-how-does-it-work/
- 13 Steps for ISO 9001 Internal Auditing using ISO 19011 - https://advisera.com/9001academy/knowledgebase/13-steps-for-iso-9001-internal-auditing-using-iso-19011/
- free online training ISO 9001:2015 Internal Auditor Course - https://advisera.com/training/iso-9001-internal-auditor-course/
- book - Discover ISO 9001:2015 Through Practical Examples - https://advisera.com/books/discover-iso-9001-2015-through-practical-examples/ -
Register of Data Subject Access Requests
Answer:
There is not mention in the EU GDPR on how long the data subject requests should be kept. However, you are free to decide upon a retention period that would at least give you the possibility to defend your legal rights if necessary. So, a good start would be to keep them for a period which is close to the statute of limitation under national law, in Romania that period is three years.
To learn more about the EU GDPR check out our free webinar “EU GDPR Foundations Course” (https://advisera.com/training/eu-gdpr-foundations-course//) -
ISO 20000 scope
Answer:
Yes, providing IT services ti internal customers is valid scope for the ISO 20000 certification.
More details about scope - in the article " How to define the scope of the SMS in ISO 20000" https://advisera.com/20000academy/blog/2015/06/02/how-to-define-the-scope-of-the-sms-in-iso-20000/ -
Controlling changes
Answer:
As far as I understand the question, I believe you are talking about clause 6.3 Planning of changes. During a defined period, certain procedures will not be followed and an alternative controlled way of working will be in place.
The following material will provide you information about planning and controlling changes:
- ISO 9001 – QMS Change Management in 7 steps - https://advisera.com/9001academy/blog/2016/11/29/qms-change-management-in-7-steps/
- free online training ISO 9001:2015 Foundations Course – https://advisera.com/training/iso-9001-foundations-course/
- book - Discover ISO 9001:2015 Through Practical Examples - https://advisera.com/books/discover-iso-9001-2015-through-practical-examples/ -
Competences for Business Continuity Manager
Answer: ISO 22301 does not define minimum requirements for education, only that personnel involved with business continuity management has the proper competencies to fulfill their duties, which can be evidenced in terms not only of education, but also in terms of skills and experience.
Considering that, among common competences for Business Continuity Manager we can mention:
- Business Impact Analysis
- Risk Management
- Project management
- Business continuity frameworks (e.g., ISO 22301 standard, BCI Good Practice Guidelines, etc.)
- BCMS audit
- Communication
Some competencies can be found in the following courses:
- ISO 22301 lead implementer course
- ISO 22301 lead auditor course
This article will provide you further explanation about Competences for Business Continuity Manager:
- The challenging role of the ISO 22301 BCM Manager htt ps://advisera.com/27001academy/blog/2016/03/21/the-challenging-role-of-the-iso-22301-bcm-manager/
This material will also help you regarding Competences for Business Continuity Manager:
- Book Becoming Resilient: The Definitive Guide to ISO 22301 Implementation https://advisera.com/books/becoming-resilient-the-definitive-guide-to-iso-22301-implementation/ -
Configuration Management in AS9100 Rev D
I do not know of any special configuration management standards applicable to South Africa, however, ISO 10007 is an internationally recognized configuration management standard which is referenced in AS9100 RevD.
For more information on Configuration Management in AS9100 Rev D see this article: https://advisera.com/9100academy/blog/2017/05/08/understanding-configuration-management-in-as9100-rev-d/ -
Applying life cycle perspective:
Answer:
The life cycle perspective should be applied during the identification of environmental aspects. For every environmental aspects one should consider what happens before and after our organization. For example, in the case of your industry and for the case of ready-mix concrete that you mention, does your suppliers use legal raw-materials? In my country it was common to illegally grab sand without any environmental considerations, does the cement used is produced by a company that respects environmental laws and regulations?
More exampl es:
during construction land is removed - what is its destination?
during renovation, construction-demolition residues are generated – what is its destination?
The following material will provide you information about applying life cycle perspective:
- ISO 14001 – Lifecycle perspective in ISO 14001:2015 – What does it mean? - https://advisera.com/14001academy/blog/2017/02/20/lifecycle-perspective-in-iso-140012015-what-does-it-mean/
- How does product life cycle influence environmental aspects according to ISO 14001:2015? - https://advisera.com/14001academy/blog/2016/03/21/how-does-product-life-cycle-influence-environmental-aspects-according-to-iso-140012015/
- Using ISO 14001:2015 to identify environmental aspects in the construction industry - https://advisera.com/14001academy/blog/2015/11/10/using-iso-140012015-to-identify-environmental-aspects-in-the-construction-industry/
- free online training ISO 14001:2015 Foundations Course - https://advisera.com/training/iso-14001-internal-auditor-course/
- book - THE ISO 14001:2015 COMPANION – A A Straightforward Guide to Implementing an EMS in a Small Business - https://advisera.com/books/the-iso-14001-2015-companion/ -
Key performance indicators and ISO 9001
Answer:
Key performance indicator is not a terminology used by ISO 9001:2015, although very common. Clause 4.4.1 c) mentions performance indicators, indicators to monitor and measure process performance. According to the strategic orientation of an organization, some processes will be more critical than others for organizational success or competitiveness. Performance indicators of those processes will be key performance indicators. For example, for an organization that bets on its ability to innovate, indicators about the performance of the innovation process will be key performance indicators.
The following material will provide you information about key performance indicators:
- ISO 9001 – How to define Key Performance Indicators for a QMS based on ISO 9001 - https://advisera.com/9001academy/24/define-key-performance-indicators-qms-based-iso-9001/-iso-9001/
ISO 90 01 document template: Matrix of Key Performance Indicators - https://advisera.com/9001academy/documentation/matrix-key-performance-indicators/
- free online training ISO 9001:2015 Foundations Course – https://advisera.com/training/iso-9001-foundations-course/
- book - Discover ISO 9001:2015 Through Practical Examples - https://advisera.com/books/discover-iso-9001-2015-through-practical-examples/ -
Consent
Answer:
Consent is one of the most widely used for marketing. Under certain circumstances legitimate interest may work as well.
However, If you intend to process personal data for the purposes of direct marketing by electronic means (by email, text, automated calls etc) legitimate interests may not always be an appropriate basis for processing. This is because the e-privacy laws on electronic marketing – currently the Privacy and Electronic Communications Regulations (PECR) – require that individuals give their consent to some forms of electronic marketing.
If you want to find out more about consent and marketing check out our webinar “How GDPR Affects Marketing Practices” (https://advisera.com/eugdpracademy/webinar/how-gdpr-affects-marketing-practices-free-webinar-on-demand/)