Start a new topic and get direct answers from the Expert Advice Community.
CREATE NEW TOPIC +Search results
11294 results
Guest
Guest
Create New Topic As guest or Sign in
Assign topic to the user
-
Incident vs. problem management
Answer:
Aim of the Incident management is to enable the user to use greed services, as soon as possible. This means, sometimes, to implement - temporary fixes (i.e. workarounds).
On the other side, goal of the Problem management is to prevent incidents by finding the root cause of one or more incidents.
Read these article to find out more about these processes:
"Incident Management in ITIL – solid foundations of operational processes" https://advisera.com/20000academy/blog/2013/05/21/incident-management-itil-solid-foundations-operational-processes/
"ITIL Incident Management" https://advisera.com/20000academy/knowledgebase/itil/-incident-management/
"ITIL and ISO 20000 Problem Management – Organizing for problem resolution" https://advisera.com/20000academy/blog/2014/07/29/itil-iso-20000-problem-management-organizing-problem-resolution/
"ITIL Problem Management: getting rid of problems" https://advisera.com/20000academy/blog/2013/08/05/itil-problem-management-getting-rid-problems/ -
BCM Templates vs BCM Software
Answer: Some pros and cons we can mention are:
- Software tools are more expensive, but provide you more control and management capabilities, like access control and searching functionalities.
- Templates are cheaper and more adequate to work with non-structured information (like policies text), but they are less efficient and effective in large environments.
This article will provide you further explanation about tools selection:
- When to use tools for ISO 27001/ISO 22301 and when to avoid them https://advisera.com/conformio/blog/2021/06/24/toolkit-vs-conformio-which-is-more-applicable-for-my-company/ -
Incident vs accident
As far as my 'limited' understanding goes, OSHA is now using only the phrase accident as description for the impact phase. The phrase "incident" now refers to near miss incidents.
However, accident, to my opinion, refers to something that could not be prevented like an act of God so to speak an incident refers to a preventable loss after the contact phase.
Is it at all possible for you to provide clarity on this?
Answer:
As defined by OHSAS 18001 "incident is work-related event in which an injury or ill health (regardless
of severity) or fatality occurred, or could have occurred". On the other hand, "An accident is an incident which has given rise to injury, ill health or fatality". As we can see, from the definitions, terms incident and accident are not limited to "act of God" events and cover any event related to injuries or ill heath.
For more information, see: How to be prepared for a health and safety incident https://advisera.com/18001academy/blog/2016/12/21/how-to-be-prepared-for-a-health-and-safety-incident/ -
Scope of ISO 9001 vs scope of QMS
Answer:
In the text of ISO 9001:2015 there are two sections explaining scopes. Clause 1 Scope explains the scope of the standard itself, its applicability to any type of organization regardless of the type, size and products and services it provides. This clause does not contain any requirements for QMS.
On the other hand, clause 4.3 Determining the scope of the quality management system defines requirements for organization to determine and document scope of its QMS (Quality Management System) as well as the requirements of what the scope statement should include (i.e products and services being covered by the scope).
For more information, see: How to define the scope of the QMS according to ISO 9001:2015 https://advisera.com/9001academy/knowledgebase/how-to-define-the-scope-of-the-qms-according-to-iso-90012015/ -
Documenting clauses 4 and 5 without Quality Manual
Answer:
Clauses 4 and 5 do not have so many requirements for documentation. If the organization doesn't have the need to document them above the requirements of the standard, it can only create document about the scope of the QMS (Quality Management System) where it will define the scope and the exclusions and Quality Policy which is the only requirement for documentation in clause 5.
Also, the fact that the manual is no longer a mandatory document doesn't mean that it is forbidden. If the organization finds it useful for its QMS, it can keep it as a part of the documentation.
For more information, see: New approach to document and record control in ISO 9001:2015 https://advisera.com/9001academy/blog/2015/06/30/new-approach-to-document-and-record-control-in-iso-90012015/ -
ISO 27001 certified organization in EU
Answer: You can find statistic about ISO certifications at ISO survey web page: https://www.iso.org/the-iso-survey.html
This link contain detailed files: https://isotc.iso.org/livelink/livelink?func=ll&objId=18808772&objAction=browse&viewType=1 -
Elaborating an asset inventory
Thanks, this definitely helps. Another question I have is about threats: One of the obvious threats for an information system is "interruption of service". Is it wise to differentiate on the length of the interruption? For instance "interruption of service for less that 8 hours" and "interruption of service for more than 8 hours". Because the first may result in an acceptable risk, whereas the second is unacceptable. -
Control of outsourcing partner
Answer:
The purpose of controlling the outsourcing partner is to ensure that the product or service they deliver is compliant with your requirements. The simplest way of controlling outsourcing partner is by controlling quality of the product or service they deliver to your organization along with other requirements that you've imposed on them (e.g. deadlines).
Other way of control is to define processes and activities that the outsourcing partner needs to perform in order to deliver the product or service, or to perform second-party audits of your provider to ensure the product or service to be delivered is compliant with your requirements.
The method and extent of the controls imposed on the outsourcing partner depends on many factors and the standard only requires organization to ensure that externally provided product, process or service is compliant with requirements of the organization.
For more informa tion, see: How to control outsourced processes using ISO 9001 https://advisera.com/9001academy/blog/2015/05/05/how-to-control-outsourced-processes-using-iso-9001/ -
Standard for safety in university workshops and lab
If we want only our Chemical Lab to be certified, not the entire facility in the campus, Is this possible. -
Filling a SoA document
Answer: ISO 27001 does not requires responsibilities to be included in the SoA, so you do not need to include this information because of the standard. Some organizations decide to include this information in the SoA so it becomes easier for them to identify who is responsible for each control (all information could be found in a single document). Of course, if you decide for this approach, if a control is considered not applicable, them you should left the field blank.