Start a new topic and get direct answers from the Expert Advice Community.
CREATE NEW TOPIC +Search results
11294 results
Guest
Guest
Create New Topic As guest or Sign in
Assign topic to the user
-
Processor/Controller
Thank you! -
Filling a template
For example:
Asset name:
Laptop Nr 1
Laptop Nr 2
...
Laptop Nr 20
or
Asset name:
Laptops
Mobile phones
System software
Development software
Answer: You can group your assets in classes, using separated classes only when you have to consider different treatments to the same type of asset (e.g. you have development laptops and management laptops, or corporate phones and personnel phones, etc.).
By the way, included in your toolkit, you have access to video tutorials that can help you fill the risks assessment table. -
BCP sites
Answer: ISO 22301 does not require separated sites for each critical activities/departments when defining BCP plans, so this decision is up to each organization, considering its available resources and defined recovery objectives, but I should say that this is a very unusual situation, and most of time a single BCP site is enough to support a BCP plan.
This article will provide you further explanation about BCP site:
- Disaster recovery site – What is the ideal distance from primary site? https://advisera.com/27001academy/knowledgebase/disaster-recovery-site-what-is-the-ideal-distance-from-primary-site/
This material will also help you regarding BCP site:
- Book Becoming Resilient: The Definitive Guide to ISO 22301 Implementation https://advisera.com/books/becoming-resilient-the-definitive-guide-to-iso-22301-implementation/ -
Terminology of ISO 9001 - shall word
Answer:
Please check at the end of clause 0.1 of ISO 9001:2015 what is written about the “shall” word, shall is a requirement. How do I, as an auditor, audit clause 7.1.1 shall? I do not ask directly, I look for evidences. For example, looking into process performance indicators, complaints, devolutions and recalls I can get evidences that help me answer to questions like: Do the organization has enough resources? Do they have the right team? Are resources being well used? Is productivity OK? Are support structures OK?
More than direct questions an auditor might be look ing into evidences that support the answers to the checklist questions.
The following material will provide you information about terminology:
- Explanation of the basic terminology in ISO standards - https://advisera.com/27001academy/blog/2015/01/12/explanation-of-the-basic-terminology-in-iso-standards/
- free online training ISO 9001:2015 Foundations Course – https://advisera.com/training/iso-9001-foundations-course/
- book - Discover ISO 9001:2015 Through Practical Examples - https://advisera.com/books/discover-iso-9001-2015-through-practical-examples/ -
Product safety and process validation
Answer:
The product safety requirements in clause 8.1.3 is asking for controls on product safety but is based on assessing the risks posed by the product through the life cycle. For instance, if your product includes a battery that could induce a shock on someone installing or using it, then what control processes do you need to plan and implement (such as safety caps to avoid shock, instructions in a user manual, safety processes in your production, etc.) If, however, you assess that there are no safety concerns for your product (such as a simple machining) then your assessment of the hazards would show not risks to be managed, and you can state this. This is why the requirement is stated, "as appropriate to the organization and the product".
In clause 8.5.1.3 on production process verification the requirement is simply stating that you need to perform any activities necessary to ensure that the processes you are using are able to give you products that meet customer and legal requirements. The note is just there to give you some ideas on how this can be done (notes are never requirements), such as the capability studies or capacity studies, but these are not required by AS9100 Rev D if they are not applicable to your processes or required by customers.
For more information see our whitepaper on https://info.advisera.com/9100academy/free-download/clause-by-clause-explanation-of-as9100-rev-d -
Documenting context of the organization and interested parties
Answer: ISO 27001 does not require documenting context of the organization, and this is especially not recommended for smaller organizations - you only need to take into context of the organization when defining the scope and doing the risk assessment. You can read more here: Explanation of ISO 27001:2013 clause 4.1 (Understanding the organization) https://advisera.com/27001academy/knowledgebase/how-to-define-context-of-the-organization-according-to-iso-27001/
You should document interested parties in List of legal, regulatory and contractual requirements, in folder 02 of the ISO 27001 Toolkit.
I would recommend that you keep this information separate from the Information Security Policy because otherwise you might need to update the Policy too often.
See also: What should you write in your Information Security Policy according to ISO 27001? https://advisera.com/27001academy/blog/2016/05/30/what-should-you-write-in-your-information-security-policy-according-to-iso-27001/ -
Quality Manual and IMS Manual
Answer:
By IMS Manual I understand “Integrated Management System Manual”. Since ISO 9001 and ISO 14001 no longer consider a Manual as a mandatory document, what you have must be OK.
The following material will provide you information about quality manual in ISO 9001:2015:
- ISO 9001 – The future of the Quality Manual in ISO 9001:2015 - https://advisera.com/9001academy/knowledgebase/the-future-of-the-quality-manual-in-iso-90012015/
- free online training ISO 9001:2015 Foundations Course – https://advisera.com/training/iso-9001-foundations-course/
- book - Discover ISO 9001:2015 Through Practical Examples - https://advisera.com/books/discover-iso-9001-2015-through-practical-examples/ -
Determining causes in internal audits
Answer:
And I am with you in that struggle!!! The auditor should not identify root causes or determine the corrective action. By doing that the auditor loses its independence and objectivity. Now the auditor is responsible for the corrective action. Imagine that the correc tive action is implemented correctly but the non-conformance still continues to happen, what will be its position?
Finding the root cause and determining the corrective action should be manager’s responsibility. Your internal auditors can approve or disapprove, before starting the implementation, but never substitute managers.
The following material will provide you information about internal audits:
- ISO 9001 – 13 Steps for ISO 9001 Internal Auditing using ISO 19011 - https://advisera.com/9001academy/knowledgebase/13-steps-for-iso-9001-internal-auditing-using-iso-19011/
- How to deal with nonconformities in an ISO 9001 certification audit - https://advisera.com/9001academy/blog/2015/06/09/how-to-deal-with-nonconformities-in-an-iso-9001-certification-audit/
- free online training ISO 9001:2015 Foundations Course – https://advisera.com/training/iso-9001-foundations-course/
- book - Discover ISO 9001:2015 Through Practical Examples - https://advisera.com/books/discover-iso-9001-2015-through-practical-examples/ -
Form identification
Answer:
Can you design a form that has all the possibilities and then, cross all non-applied fields in each product?
Having the same form code for several forms according to the product family seems to me a solution with weak points. We want that people unequivocally identify which form to use in each case.
The following material will provide you information about documented information:
- ISO 9001 – New approach to document and record control in ISO 9001:2015 - https://advisera.com/9001academy/blog/2015/06/30/new-approach-to-document-and-record-control-in-iso-90012015/
- free online training ISO 9001:2015 Foundations Course – https://training.advisera .com/course/iso-90012015-foundations-course/
- book - Discover ISO 9001:2015 Through Practical Examples - https://advisera.com/books/discover-iso-9001-2015-through-practical-examples/ -
PDCA, process approach and risk based thinking in ISO 45001
Since ISO 45001 adopted the same High Level Structure and Annex XL as ISO 9001, ISO 14001 and many other management system standards, the same principle is applied regarding the PDCA. Firs you need to plan your system, whi ch includes determining the context, the policy, addressing risks and opportunities, determining OH&S hazards, setting the objectives and provide resources, basically you need to cover clauses from 4 to 7.
Do phase is defined by the clause 8, where you need to establish and apply operational controls in order to mitigate occupational health and safety hazards.
Check phase is located in clause 9, and it requires organization to conduct internal audits, compliance evaluation and management review in order to determine conformity of the OH&SMS to requirements of the standard, legal requirements and overall effectiveness of the OH&SMS, as well as effectiveness of the operational control and actions to address risks and opportunities.
Finally the act phase is defined in the clause 10, which defines requirements for continual improvement, corrective actions and nonconformists.
For more information, see: The importance of the Plan-Do-Check-Act cycle in OHSAS 18001 https://advisera.com/45001academy/blog/2015/11/25/the-importance-of-the-plan-do-check-act-cycle-in-ohsas-18001/