Start a new topic and get direct answers from the Expert Advice Community.
CREATE NEW TOPIC +Search results
11277 results
Guest
Guest
Create New Topic As guest or Sign in
Assign topic to the user
-
Which standard to use in internal audits
You're welcomed -
Competence requirement for job position
Answer:
The requirements for competency (appropriate level of education, experience, training) is usually not included in the procedure but other documents in such as job description. The standard requires the organization to ensure that any person(s) under its control performing tasks that can impact on OH&S is (are) competent on the basis of appropriate education, training or experience, but it doesn't require organization to document competency requirements for each job position.
In order to check whether the facility manager has appropriate level of competency, and again the standard only refers to the competence regarding occupational health and safety, you need to speak with the facility manager superior or HR department and see what are the re quirements and does this person meets these requirements.Also, if some operational controls are related to this job position and require training, you need to see if there is a record that demonstrates that this person had this training, and knows how to apply these particular operational controls.
For more information, see: The importance of training and awareness in OHSAS 18001 https://advisera.com/18001academy/blog/2015/07/01/the-importance-of-training-and-awareness-in-ohsas-18001/ -
Documented information vs documents and records
Answer:
"Documented information" is the term that covers both documents and records and there is a little hint on how to determine whether the standard is requiring a document or a record. When you come across a phrase "maintain documented information", it means that you need to create a document, e.g. quality policy, the term "retain documented information as an evidence" means that you need to create a record, e.g. record about management review.
For more information, see: A new approach to documented information in ISO 14001:2015 https://advisera.com/14001academy/blog/2015/08/24/a-new-approach-to-documented-information-in-iso-140012015/
These materials will also help you regarding documentation:
- Book Managing ISO Documentation: A Plain English Guide https://advisera.com/books/managing-iso-documentation-plain-english-guide/
- Free online training ISO 14001:2015 Foundations Course https://training.a dvisera.com/course/iso-14001-foundations-course/
- Conformio (online tool for ISO 14001) https://advisera.com/conformio/ -
Internal Audit - Technical Knowledge
Although high level of technical knowledge is desirable, it is not mandatory for an ISO 27001 internal auditor, because he can work together with an expert in the field being audited to provide the necessary support.
An internal auditor must have knowledge about ISO 27001 standard and audit process and techniques, which can be acquired through attending ISO 27001 audit-related courses.
These articles will provide you further explanation about ISO 27001 internal auditor:
- Qualifications for an ISO 27001 Internal Auditor https://advisera.com/27001academy/blog/2015/03/30/qualifications-for-an-iso-27001-internal-auditor/
- How to become ISO 27001 Lead Auditor https://advisera.com/27001academy/knowledgebase/how-to-become-iso-27001-lead-auditor/
These materials will also help you regarding ISO 27001 internal auditor:
- ISO Internal Audit: A Plain English Guide https://advisera.com/books/iso-internal-audit-plain-english-guide/
- ISO 27001:2013 Internal Auditor Course https://advisera.com/training/iso-27001-internal-auditor-course/ -
Audit Plan
The audit plan is written considering all departments, processes, and/or locations included in the ISMS scope (all scope must be audited). Starting from these you can decide to perform a single audit to cover all scope, or multiple audits considering smaller parts of the scope on each one, to verify compliance with the standard's requirements as well as with other requirements established in the ISMS.
This article will provide you further explanation about audit plan:
- How to make an Internal Audit checklist for ISO 27001 / ISO 22301 https://advisera.com/27001academy/knowledgebase/how-to-make-an-internal-audit-checklist-for-iso-27001-iso-22301/
These materials will also help you regarding audit plan:
- ISO Internal Audit: A Plain English Guide https://advisera.com/books/iso-internal-audit-plain-english-guide/
- ISO 27001:2013 Internal Auditor Course https://advisera.com/training/iso-27001-internal-auditor-course/ -
Internal Audit - Lack of Documentation
If the documentation that is missing is mandatory to start the audit, or if by making it available during the audit the audit team cannot assure the related processes are being performed as planned, then the internal audit should not be performed. In any other cases the audit team can adjust the audit plan to cover the processes related to the missing document at the end of the audit, giving time for the documentation to be ready to be evaluated.
But you should note that this situation must be informed and recorded either at the audit opening meeting as well as at the audit closing meeting. This way the audit team can make the situation and results clear to all involved.
In case you want to perform this internal audit before the implementation of a standard is done, then it would be better to perform the Gap analysis instead of internal audit. For more information about gap analysis and internal audit, please see this article: Gap analysis vs. internal audit in ISO 9001 https://advisera.com/9001academy/blog/2015/02/17/gap-analysis-vs-internal-audit-iso-9001//
This arti cle will provide you further explanation about internal audit:
- How to prepare for an ISO 27001 internal audit https://advisera.com/27001academy/blog/2016/07/11/how-to-prepare-for-an-iso-27001-internal-audit/
These materials will also help you regarding internal audit:
- ISO Internal Audit: A Plain English Guide https://advisera.com/books/iso-internal-audit-plain-english-guide/
- ISO 27001:2013 Internal Auditor Course https://advisera.com/training/iso-27001-internal-auditor-course/ -
Address for certification
Answer: I don't know the legal requirements of your country to start a company, but in terms of certification you should have at least one dedicated office location (company's headquarters), where the people accountable for the company can be found. This dedicated office can be the home address of the founder / CEO of the company. You can present this address as company's address and all other locations can be considered remote locations and can be audited accordingly. -
Cybersecurity and ISO 9001
Answer: Cybersecurity is the protection of computer systems from situations that can prevent them to fulfill their intended objectives, and ISO 9001 is a standard related to quality management, with focus on meeting customer's requirements and ensure their satisfaction.
That said, cybersecurity can be related to ISO 9001:2015 if your organization depends on computer systems to meet the customer's requirements. This dependency can be either stated explicitly by the customer, or it can be identified by the organization itself as a critical success factor to meet customers demands.
For cybersecurity implementation you can use ISO 27001, which can use ISO 9001 as support. For more infotmation about ISO 27001 and ISO 9001, please see:
- Using ISO 9001 for implementing ISO 27001 https://advisera.com/27001academy/blog/2010/03/08/using-iso-9001-for-implementing-iso-27001/
- ISO 27001 implementa tion: How to make it easier using ISO 9001 [free webinar on demand] https://advisera.com/27001academy/webinar/iso-27001-implementation-make-easier-using-iso-9001-free-webinar-demand/ -
Scheduled releases
Answer:
I assume you mean the project that have planned releases. If that's the case, it is under control of Release and Deployment Management (which is part of the Service Transition, according to ITIL).
Release and Deployment Management is explained in more details in the articles:
"ITIL Transition – All about testing in Release and Deployment Management" https://advisera.com/20000academy/blog/2015/11/17/itil-transition-all-about-testing-in-release-and-deployment-management/