Start a new topic and get direct answers from the Expert Advice Community.
CREATE NEW TOPIC +Search results
11275 results
Guest
Guest
Create New Topic As guest or Sign in
Assign topic to the user
-
Documented information vs documents and records
Answer:
"Documented information" is the term that covers both documents and records and there is a little hint on how to determine whether the standard is requiring a document or a record. When you come across a phrase "maintain documented information", it means that you need to create a document, e.g. quality policy, the term "retain documented information as an evidence" means that you need to create a record, e.g. record about management review.
For more information, see: A new approach to documented information in ISO 14001:2015 https://advisera.com/14001academy/blog/2015/08/24/a-new-approach-to-documented-information-in-iso-140012015/
These materials will also help you regarding documentation:
- Book Managing ISO Documentation: A Plain English Guide https://advisera.com/books/managing-iso-documentation-plain-english-guide/
- Free online training ISO 14001:2015 Foundations Course https://training.a dvisera.com/course/iso-14001-foundations-course/
- Conformio (online tool for ISO 14001) https://advisera.com/conformio/ -
Internal Audit - Technical Knowledge
Although high level of technical knowledge is desirable, it is not mandatory for an ISO 27001 internal auditor, because he can work together with an expert in the field being audited to provide the necessary support.
An internal auditor must have knowledge about ISO 27001 standard and audit process and techniques, which can be acquired through attending ISO 27001 audit-related courses.
These articles will provide you further explanation about ISO 27001 internal auditor:
- Qualifications for an ISO 27001 Internal Auditor https://advisera.com/27001academy/blog/2015/03/30/qualifications-for-an-iso-27001-internal-auditor/
- How to become ISO 27001 Lead Auditor https://advisera.com/27001academy/knowledgebase/how-to-become-iso-27001-lead-auditor/
These materials will also help you regarding ISO 27001 internal auditor:
- ISO Internal Audit: A Plain English Guide https://advisera.com/books/iso-internal-audit-plain-english-guide/
- ISO 27001:2013 Internal Auditor Course https://advisera.com/training/iso-27001-internal-auditor-course/ -
Audit Plan
The audit plan is written considering all departments, processes, and/or locations included in the ISMS scope (all scope must be audited). Starting from these you can decide to perform a single audit to cover all scope, or multiple audits considering smaller parts of the scope on each one, to verify compliance with the standard's requirements as well as with other requirements established in the ISMS.
This article will provide you further explanation about audit plan:
- How to make an Internal Audit checklist for ISO 27001 / ISO 22301 https://advisera.com/27001academy/knowledgebase/how-to-make-an-internal-audit-checklist-for-iso-27001-iso-22301/
These materials will also help you regarding audit plan:
- ISO Internal Audit: A Plain English Guide https://advisera.com/books/iso-internal-audit-plain-english-guide/
- ISO 27001:2013 Internal Auditor Course https://advisera.com/training/iso-27001-internal-auditor-course/ -
Internal Audit - Lack of Documentation
If the documentation that is missing is mandatory to start the audit, or if by making it available during the audit the audit team cannot assure the related processes are being performed as planned, then the internal audit should not be performed. In any other cases the audit team can adjust the audit plan to cover the processes related to the missing document at the end of the audit, giving time for the documentation to be ready to be evaluated.
But you should note that this situation must be informed and recorded either at the audit opening meeting as well as at the audit closing meeting. This way the audit team can make the situation and results clear to all involved.
In case you want to perform this internal audit before the implementation of a standard is done, then it would be better to perform the Gap analysis instead of internal audit. For more information about gap analysis and internal audit, please see this article: Gap analysis vs. internal audit in ISO 9001 https://advisera.com/9001academy/blog/2015/02/17/gap-analysis-vs-internal-audit-iso-9001//
This arti cle will provide you further explanation about internal audit:
- How to prepare for an ISO 27001 internal audit https://advisera.com/27001academy/blog/2016/07/11/how-to-prepare-for-an-iso-27001-internal-audit/
These materials will also help you regarding internal audit:
- ISO Internal Audit: A Plain English Guide https://advisera.com/books/iso-internal-audit-plain-english-guide/
- ISO 27001:2013 Internal Auditor Course https://advisera.com/training/iso-27001-internal-auditor-course/ -
Address for certification
Answer: I don't know the legal requirements of your country to start a company, but in terms of certification you should have at least one dedicated office location (company's headquarters), where the people accountable for the company can be found. This dedicated office can be the home address of the founder / CEO of the company. You can present this address as company's address and all other locations can be considered remote locations and can be audited accordingly. -
Cybersecurity and ISO 9001
Answer: Cybersecurity is the protection of computer systems from situations that can prevent them to fulfill their intended objectives, and ISO 9001 is a standard related to quality management, with focus on meeting customer's requirements and ensure their satisfaction.
That said, cybersecurity can be related to ISO 9001:2015 if your organization depends on computer systems to meet the customer's requirements. This dependency can be either stated explicitly by the customer, or it can be identified by the organization itself as a critical success factor to meet customers demands.
For cybersecurity implementation you can use ISO 27001, which can use ISO 9001 as support. For more infotmation about ISO 27001 and ISO 9001, please see:
- Using ISO 9001 for implementing ISO 27001 https://advisera.com/27001academy/blog/2010/03/08/using-iso-9001-for-implementing-iso-27001/
- ISO 27001 implementa tion: How to make it easier using ISO 9001 [free webinar on demand] https://advisera.com/27001academy/webinar/iso-27001-implementation-make-easier-using-iso-9001-free-webinar-demand/ -
Scheduled releases
Answer:
I assume you mean the project that have planned releases. If that's the case, it is under control of Release and Deployment Management (which is part of the Service Transition, according to ITIL).
Release and Deployment Management is explained in more details in the articles:
"ITIL Transition – All about testing in Release and Deployment Management" https://advisera.com/20000academy/blog/2015/11/17/itil-transition-all-about-testing-in-release-and-deployment-management/ -
Defining scope for ISO 14001 based EMS
Answer:
THe scope of Environmental Management System (EMS) is a simple statement on to what processes, products and services and locations your EMS is applied to. It can be as simple as "EMS of XYZ Company applies to following processes [...], services [...] and locations [...]." THis statement can be documented as a separate document or included in the Environmental Manual or any other document which you see fit.
For more information, see: How to determine the scope of the EMS according to ISO 14001:2015 https://advisera.com/14001academy/blog/2016/02/01/how-to-determine-the-scope-of-the-ems-according-to-iso-140012015/
These materials will also help you regarding EMS scope:
- Free online training ISO 14001:2015 Foundations Course ht tps://advisera.com/training/iso-140012015-foundations-course/
- Conformio (online tool for [write the relevant standard]) https://advisera.com/conformio/ " -
Exclusion of ISO 9001 requirements in call centre
Answer:
Clause 8.3 is referring to both product and services, but if the organization doesn't develop new services, it can exclude clause 8.3 from the scope of its QMS (Quality Management System). Property belonging to the customer has nothing to do with the clause 8.3, this clause can be excluded regardless of whether the company is using customer property in its processes or not. Clause 8.5.3 is dealing with requirements regarding customer property and it can also be excluded if the organization does not use such property.
For call centre, you can also consider excluding clause 7.1.5 Monitoring and measuring resources, 8.5.6 Release of products and services and 8.5.5 Post-delivery activities. For any exclusion made, you need to provide and document justification.
For more information, see: What clauses can be excluded in ISO 9001:2015? https://advisera.com/9001academy/blog/2015/07/07/what-clauses-can-be-excluded-in-iso-90012015/2015/
These materials will also help you regarding ISO 9001 implementation:
- Book (eBook) Discover ISO 9001:2015 Through Practical Examples https://advisera.com/books/discover-iso-9001-2015-through-practical-examples/
- Free online training ISO 9001:2015 Foundations Course https://advisera.com/training/iso-9001-foundations-course/
- Conformio (online tool for ISO 9001) https://advisera.com/conformio/