Start a new topic and get direct answers from the Expert Advice Community.
CREATE NEW TOPIC +Search results
11275 results
Guest
Guest
Create New Topic As guest or Sign in
Assign topic to the user
-
Documents required for total productive maintenance
Answer:
IATF 16949 requires organization to document the system for total productive maintenance. Basically, you need to document the following:
- process equipment
- resources for machine, equipment and facility maintenance
- packaging and preservation of equipment
- applicable customer requirements
- documented maintenance objectives
- use of preventive maintenance methods
- periodic overhaul
For more information about mandatory documented information in IATF 16949, see: List of mandatory documents required by IATF 16949:2016 https://advisera.com/16949academy/knowledgebase/list-of-mandatory-documents-required-by-iatf-16949-2016/ -
IAF MD 9, ISO 13485 and ISO 9001
Answer:
There are no any restrictions on implementing ISO 13485, IAF MD 9 and ISO 9001 at the same time and integrating them into one single management system. Having integrated management system that covers several standards will decrease number of audit days compared to certifying these standards separately.
New ISO 13485 has more specific requirements regarding the design, production, sales and post delivery activities and, in my opinion it is better that the previous one. The standard is applicable to the distributors, and in some countries ISO 13485 i s a legal requirement for both manufacturers and distributes of medical devices, so if your country o customers requires it, you should implement it.
ISO 13485 is basically ISO 9001 adopted to medical device industry and I think it provides more value to medical device industry than the universal ISO 9001.
For more information, see: ISO 9001 vs. ISO 13485 https://advisera.com/9001academy/blog/2015/01/21/iso-9001-vs-iso-13485/ -
Documentação ISO 9001:2015
A nova revisão do ISO 9001: 2015 não requer nenhum procedimento, mas alguns registros e documentos. Em vez de seis procedimentos obrigatórios, existem agora seis documentos obrigatórios que não precisam ser na forma de um procedimento. No entanto, é uma boa prática ter alguns procedimentos que o ajudarão a ajudar a organização a cumprir os requisitos do padrão.
Para obter mais informações, consulte os seguintes artigos:
- "Lista de documentos obrigatorios requeridos pela ISO 9001:2015": https://advisera.com/9001academy/pt-br/knowledgebase/lista-de-documentos-obrigatorios-requeridos-pela-iso-90012015/
- "Inforgrafico ISO 9001:2015 vs versao 2008 o que mudou": https://advisera.com/9001academy/pt-br/knowledgebase/infografico-iso-90012015-vs-versao-2008-o-que-mudou/
Esses materiais também irão ajudá-lo em relação à documen tação ISO 9001:
- Livro "Gerenciando documentação ISO" (available in English, Spanish, German and Italian): https://advisera.com/books/managing-iso-documentation-plain-english-guide/
- Treinamento on-line gratuito: "Curso de fundamentação ISO 9001" (available in English, Spanish, and Italian): https://advisera.com/es/formacion/curso-fundamentos-iso-9001/
- Conformio (Ferramenta online para ISO 9001): https://advisera.com/conformio/ -
Who should be included in management review meetings
thank you sir. we are in a dilemma about this since we are still in the process of implementing ISO 9001:2015. Problem is, they have include Auditors to attend the MRM to present and clarify findings. Thus, that part of the MR Procedure authorizes the attendance of Internal Auditors. -
AS9100 Internal Audit Frequency
What is your take on the internal audit requirements for AS9100D and even ISO 9001 2015; do the entire QMS once a year OR 3-5 years cycle?"
Answer:
The internal audit process is an important tool that is used to take a close look at how your processes are working, even if you are using key performance indicators for the process to know how it is working. The internal audit takes a closer look at the details of the processes to ensure that they are adhered too, and to ensure that any corrective actions or improvement activities taken for the process are effective. So, while it is not specified in either AS9100 Rev D or ISO 9001:2015 at what frequency to perform internal audits (such as annually) it does mention that you need to plan your internal audits frequency by taking into consideration the importance of the processes, changes in the organisation and results of previous audits.
So, that being said, I would never recommend a 3 - 5 year cycle for internal audits. If you are not looking at a process for 3 yea rs how do you know if any corrective actions or improvements are effective or that changes to other parts of the organisation have not affected the process. If you found a problem in one audit how effective would it be to wait 3 years to look at that process again? Even the certification bodies have a schedule of three years where the do the entire QMS the first year, audit main processes (internal audit, management review, corrective action, etc) and some of the QMS the second year, audit the main processes and the remainder of the QMS the third year and then perform a complete QMS audit for the re-certification the following year (and starting the cycle over).
So, I am a big believer that having an annual audit schedule that includes all QMS processes, and important or problematic processes more than once if needed, so that you can gain the benefits of the audits. I also believe that this schedule needs to be maintained, meaning having an update to add a process that has changes or experienced problems. Having a cycle of 3 - 5 years before you re-audit a certain process in the QMS could lead to problems, and you will not get the biggest benefit from your internal audits. -
Determining the scope of EMS
Where do you see the place of purchase in ISO 14001? In my company this department get all the information and requirements from the development department, so I do not see a smart contribution.
Asking because of determining the scope. And purchasing in our situation is outside, on the group level.
Thank you in advance for answer
Answer:
Purchasing process is important part of the organization and clause 8.1 has significant part about the control of outsourced processes and externally provided products and services. Even if the purchasing is conducted on the higher level, the part of the organization you want to put under the EMS (Environmental Management System) scope still makes purchasing requests and it needs to define those requirements in terms of environmental protection and operational control.
I don't say it cannot be done, but think it is beneficial for the EMS to include the purchasing process in the scope.
For more information, see: How to determine the scope of the EMS according to ISO 14001:2 015 https://advisera.com/14001academy/blog/2016/02/01/how-to-determine-the-scope-of-the-ems-according-to-iso-140012015/
These materials will also help you regarding the EMS scope:
- Free online training ISO 14001:2015 Foundations Course https://advisera.com/training/iso-14001-internal-auditor-course/
- Conformio (online tool for ISO 14001) https://advisera.com/conformio/ -
Information Security control and revision over third parties
Answer: For verifying the compliance of an outsourced service like Office 365 you should use as reference the terms of service for the provision of the service. In this term of service you should look for clauses referring to which and how information controls will be implemented and how the provider will demonstrate to the customer that the controls are implemented and working properly.
From this point you can ask for evidences of how the controls are implemented and how they are being verified and evaluated either by the provider (e.g. by means of an internal or external audit of the provider's premises) and by the organization (e.g. through a review of audit reports sent by the provider to the person responsible by the service in your organization).
In case big providers do not provide enough security, then you should consider switching to smaller providers with you can specify the security clauses they need to comply to.
This article will provide you further explanation about handling suppliers:
- 6-step process for handling supplier security according to ISO 27001 https://advisera.com/27001academy/blog/2014/06/30/6-step-process-for-handling-supplier-security-according-to-iso-27001/
- Which security clauses to use for supplier agreements? https://advisera.com/27001academy/blog/2017/06/19/which-security-clauses-to-use-for-supplier-agreements/
This article will provide you further explanation about internal audit:
- How to make an Internal Audit checklist for ISO 27001 / ISO 22301 https://advisera.com/27001academy/knowledgebase/how-to-make-an-internal-audit-checklist-for-iso-27001-iso-22301/
This material will also help you regarding internal audit:
- ISO Internal Audit: A Plain English Guide https://advisera.com/books/iso-internal-audit-plain-english-guide/ -
SOA content
Answer: Basically you have to put the reason why the control is applicable or not to your organization.
To justify the application of a control you can state it is applicable because:
- of the results of risk assessment (e.g., applicable because the risk number xxxx);
- it should comply with a legal requirement (e.g., applicable to ensure compliance with law, industry regulation or contract);
- of a top management decision
In general the justification to not apply a control is related to the fact that there is not unacceptable risk related to that control, or that Top Management has accepted the risk as it is.
These articles will provide you further explanation about SOA content:
- The importance of Statement of Applicability for ISO 27001 https://advisera.com/27001academy/knowledgebase/the-importance-of-statement-of-applicability-for-iso-27001/
- 4 mitigation options in risk treatment according to ISO 27001 https://advisera.com/27001academy/b log/2016/05/16/4-mitigation-options-risk-treatment-according-iso-27001/
These materials will also help you regarding SOA content:
- Book Secure & Simple: A Small-Business Guide to Implementing ISO 27001 On Your Own https://advisera.com/books/secure-and-simple-a-small-business-guide-to-implementing-iso-27001-on-your-own/
- Free online training ISO 27001 Foundations Course https://advisera.com/training/iso-27001-foundations-course/ -
ISO 27001 4 Context Of the Organization
Hi Rhandleal,
The scope is IT Infrastructure along with HR Administration. -
Providing evidence for requirements regarding interested parties
Answer:
The auditor will try to determine whether you identified relevant interested parties and their needs and expectations and how you are meeting those needs and expectations. Although it is not required by the standard, the best way to provide evidence that you've identified interested parties and their needs and expectations is to document them in some kind of record or register.
For more information, see: How to determine interested parties and their requirements according to ISO 9001:2015 https://advisera.com/9001academy/blog/2015/11/10/how-to-determine-interested-parties-and-their-requirements-according-to-iso-90012015/