The ISO Show

Data breaches have risen by 70% globally in Q3 of 2022, reenforcing the requirement for many to seek out Information Security solutions, especially those within the tech space. Today we speak to Triaster, who have been in operation since 1994, providing businesses with process mapping and execution software to help drive business improvement. Triaster's Business Operations Manager, Jane Duncan, explains why they sought to implement ISO 27001, what challenges they faced and what they learned during their certification journey. You'll learn Who are Triaster? Why Triaster Implemented ISO 27001 What did they learn from their experience? What benefits have they seen as a result of Implementing ISO 27001? Resources Triaster What is ISO 27001? Internal Auditing in plain English: A simple guide to super effective ISO Audits by Craig Cochran In this episode, we talk about: [00:54] Get to know Jane Duncan – Triaster's Business Operations Manager who has recently started fostering dogs for a local charity. [01:41] Who are Triaster? In short, they build software solutions that drive business improvement. They are a thought leader in their field and strive to create new software to meet business needs. [02:25] What was the main driver for achieving ISO 27001? In 2020, they had certified to the Quality Standard, ISO 9001, and saw the many benefits that come with ISO certification. They saw ISO 27001 as both an opportunity and a necessity due to their work within the IT industry. ISO 27001 is seen as a mark of trust and provides a central framework to improve data security. [04:28] How long did It take to implement ISO 27001? They started looking at certification bodies and consultants to help with implementation in March 2021. The project overall lasted six months, with their assessments taking place in September and October of the same year. They also chose to recertify to ISO 9001 at the same time – this aligned both Standards under one Integrated Management System. [06:35] If you are considering implementing multiple ISO's, it's recommended to integrate them into a single Management System. This reduces the costs of implementation and is overall easier to maintain. [07:17] What was the biggest gap identified in Triaster's initial Gap Analysis? They had a lack of security policies in place in addition to a lack of processes that would have mitigated potential data security risks. [08:00] What was the biggest difference ISO 27001 made? They now do regular annual SWOT and PESTLE's that are evaluated at Management Reviews. Risks identified during those reviews are added to a risk register and are used to develop the necessary objectives and controls needed to mitigate future risk. [08:38] Other differences include the ability to track non-conformities, security risks and opportunities for improvement. They also have the confidence to prove their data security credentials to clients and have the required documentation to back it up. Tendering processes are also made easier by having ISO 27001 as it is often a requirement that can now be ticked off. [09:25] Triaster use Infrastructure partner (who are also ISO 27001 certified) and can now hold them accountable for the services they provide. [09:50] Jane states that they are now a much better business following the Implementation of both ISO 9001 and ISO 27001 – continually improving their processes and scrutinising working practices. [10:54] All of the same security practices can be done by those who are homeworking at Triaster [11:05] What has been the main lesson learned? The process if certification is a journey – it's about continually improving and truly adopting the ethos of Information Security into every aspect of the business. [11:52] What are the main benefits? They hope their clients can see their efforts and have confidence in Triaster's ability to keep their data secure. They also now have the processes in place that drive continual Improvement. [12:33] Jane's top tip: Document what you do as a business and look for gaps. Also, certification is a journey, and you shouldn't stop striving to improve once you achieve certification. [13:00] What book would you recommend and why? Internal Auditing in plain English: A simple guide to super effective ISO Audits by Craig Cochran [14:15] Jane's favorite quote: "No one is you, and that is your superpower" We'd love to hear your views and comments about the ISO Show, here's how: Share the ISO Show on Twitter or Linkedin Leave an honest review on iTunes or Soundcloud. Your ratings and reviews really help and we read each one. Subscribe to keep up-to-date with our latest episodes: Stitcher | Spotify | YouTube |iTunes | Soundcloud | Mailing List

All companies have a legal obligation to comply with existing legislation – it's the law! Failure to comply to legal requirements can be costly in terms of fines and reputational damage if an incident occurs. So, it's in your best interest to ensure you can identify all applicable compliance requirements. Most ISO's specify a requirement to identify legal compliance requirements, and in our experience, the most effective way to do so is through the creation of a Legal Register. Mel is joined by Sarah Ball, A QHSE Consultant here at Blackmores, to discuss how you can create your own Legal Register and keep up-to-date with changes in legislation. You'll learn The importance of Legal Compliance How to identify what legislation is applicable to you What is a Legal Register? How can you create a legal Register? How can you keep up with changes in Legislation? Resources isologyhub gov Productivity Ninja In this episode, we talk about: [01:06] Why do you need to comply with Legislation – quite simply, it is the law! It can be very costly for you in both a financial and reputational respect. [01:25] There is a requirement for identifying legal compliance requirements in most ISO's i.e. ISO 45001 (Health and Safety) and ISO 14001 (Environmental) [02:33] A Legal Register is not a requirement of any ISO – but we find it is the most effective way of documenting and keeping track of changes in applicable legislation. [03:05] Why is it so important to manage legal compliance? Besides the financial and reputational cost of not complying with the law – it's a way to protect your business. The law is there for a reason and it is often times to protect individuals or communities. [04:35] You will need to take a proactive approach to find out what legislation is applicable to you. [05:40] How can you identify your legal obligations? Firstly, do some basic research, start by visiting reputable industry authorities as they will likely have some guidance available i.e. The HSE Website or the Legislation.gov website. There are also subscription services available that give you an overview of what may be applicable to you and notify you of any updates. Finally, you can look to a specialist consultancy to help you. [09:05] We do have a module on Legal Compliance available in the isologyhub! [10:05] Why is it important to have a legal register? You will have to keep track of a lot of legislation! By documenting it, you have full visibility and can identify any gaps. You can also assign accountability against each piece of legislation, so the responsibility can be shared and managed. [11:40] Your brain is for thinking and processing, not remembering. By documenting information, you create a 'second brain' to free up your brain for more important tasks – We recommend checking out the 'Productivity Ninja' series of books for more helpful organisation and prioritisation tips! [12:28] What does a Legal Register look like? It's typically a table of information – we use spreadsheets but any format is fine. Key columns we use identify the name of the legislation or contractual obligation, a link to the legislation, the requirements and purpose (what does this legislation mean to you?), A link to any further guidance and description of what good looks like to you i.e an example of evidence of compliance. You could include a column for accountability. [16:00] How do you create a Legal Register? First, set up your table, next go out and find your applicable legislation, confirm and document your requirements in regard to the legislation, then assign accountability within the organisation. You may want to consult stakeholders to complete the obligations and figure out what good looks like. It is also good practice to do a legal compliance audit to ensure you are meeting obligations and identify any gaps. [17:50] You can document other requirements in the Legal Register – this can include Service Level Agreements or even any ISO standards you're certified to. It is advised to add any contractual requirements with customers or possibly landlords or suppliers. If you are a trade body that has a code of conduct, we recommend you include that too. [21:00] Sarah's top tip: When creating new processes or updating existing ones, it's always good to look back at the Legal Register and check that any changes you're making aren't going to affect anything in terms of compliance. We'd love to hear your views and comments about the ISO Show, here's how: Share the ISO Show on Twitter or Linkedin Leave an honest review on iTunes or Soundcloud. Your ratings and reviews really help and we read each one. Subscribe to keep up-to-date with our latest episodes: Stitcher | Spotify | YouTube |iTunes | Soundcloud | Mailing List

We have over 17 years experience of implementing various ISO's – and we'd like to share some insight into our proven methodology. Our regular listeners may be familiar with the term 'isology' from previous episodes where we've highlighted our online platform – the isologyhub. But what is isology exactly? Put simply, isology is our 7-step method for implementing any ISO Standard. Join Mel this week as she breaks down each of the 7 steps, including the planning, creation and review of an ISO Management System. You'll learn Our experience implementing ISO's The origin of isology What is isology? The seven steps of isology Resources isologyhub How to choose a Certification Body In this episode, we talk about: [00:31] An overview of isology – a methodology for implementing any ISO. Find out more over on the isologyhub [01:08] How the isology methodology was created – 17 years in the making with the help of our consultants. [01:33] A brief overview of the 7 Steps of isology [03:05] 1st Step - Plan: Get a copy of the Standard, determine your scope, timescales, leadership commitment, resources and selecting a Certification Body. Some choose to implement the system but leave out the badge. There are ISO's that aren't certifiable but good to have i.e. ISO 20400 Sustainable Procurement. [05:38] 2nd Step – Discover: Time to understand what you have in place already and what you're missing – this is done through a Gap Analysis. [06:35] 3rd Step - Expose: This is where we look at risks and opportunities related to your desired Standard (both internally and externally). This is typically done through a SWOT and PESTLE. A Risk Register may be created to capture the findings to be addressed later. Companies are also encouraged to create a Legal Register to keep track of all their statutory, regulatory and contractual requirements. [08:41] 4th Step - Create: Time to review the requirements of the Standard in terms of documentation – and create what's needed. This includes capturing your way of working with documented Procedures – make sure you have the relevant staff involved in their creation. [10:05] 5th Step - Launch: Once the Management System has found it's home (usually an intranet or SharePoint) – you need to communicate it. Consider the type of launch you want and who will be involved. Make sure you encourage engagement with the Management System. [11:18] 6th Step - Engage: There's little point in having a Management System if people don't know about it or have little interest in it. You should train your staff on the Management system, so that they are aware of your policies and procedures and where to find key documents. You must verify compliance through Internal Audits – this is a requirement of any ISO Standard. [13:09] 7th Step - Review: Time to take a step back and look at what's been achieved and what's been highlighted as areas for improvement through your Internal Audits. There's a set list of criteria in each ISO Standard to help you plan an agenda for the Review. We'd love to hear your views and comments about the ISO Show, here's how: Share the ISO Show on Twitter or Linkedin Leave an honest review on iTunes or Soundcloud. Your ratings and reviews really help and we read each one. Subscribe to keep up-to-date with our latest episodes: Stitcher | Spotify | YouTube |iTunes | Soundcloud | Mailing List

ISO 22716 sets out the framework for a quality management system for anyone involved in the manufacture of cosmetics and other healthcare related products. While this Standard's focus is on the manufacture of cosmetics specifically, many of the requirements can apply to any manufacturing process, especially those that involve a risk of contamination. This Standard sets out clear guidance to help you ensure you align with Good Manufacturing Practices (GMP), but how do you go about implementing it? In our last episode of the ISO 22716 series, we bring back Derek Hall once again to share his experience with implementing ISO 22716 and offer some top tips to get you started. You'll learn What considerations do you need for every aspect of the manufacturing process? How you can apply ISO 22716's principles to your own processes Derek's experience with his clients Resources isologyhub Blackmores ISO 22716 Implementation In this episode, we talk about: [01:10] If you want a recap on the Standard – Watch our first episode in the ISO 22716 series [01:50] Key considerations for Personnel: Establish an Organisational Chart (with clear references for the responsibility and authority of quality issues), use a Skills matrix to help determine where training gaps are, develop procedures and processes to control what people can and can't do in certain locations. [08:33] Key considerations for Premises: Manufacturers should consider how the building is designed and laid out, ensure that there is a good flow for materials, have effective filling and packaging areas, introduce efficient sanitation programs, what can you do to minimise mix-ups? [10:45] Key considerations for Premises: Manufacturing areas should only be accessed by authorised personnel, you should have effective measures in place to prevent pests – this includes the exterior as well as the interior of your buildings! You might want to consider external contractors for pest control. [13:05] Key considerations for Equipment: Ensure all equipment is fit for purpose, efficient and has the ability to be cleaned thoroughly, make sure any calibrations are assessed and documented, equipment should be laid out in a way to ensure a flow of materials, make sure there is a clear segregation of manufacturing and storage areas. [16:45] Key considerations for Raw Materials and Packaging Materials: – Raw materials should be well stored and clearly labelled, source your materials from trusted and accredited suppliers, have a controlled and quality approved list of suppliers and vendors (Do these suppliers provide proof of quality? Set out your minimum requirements for quality and ensure suppliers fulfill these) [19:15] Key considerations for Production: All raw materials and manufacturing batches should be identified by a unique code for control and traceability, regular quality control inspections should take place, determine what methods are used to ensure that products meet customer expectations, samples should be taken during set stages of manufacturing to check for quality. [21:20] Key considerations for Finished Products: Finished products should not be stored on the floor (use pallets), do what you can to minimise contamination during storage, ensure all staff know how to store products correctly and what to do if there is contamination, have defined acceptance criteria for products, have clear labelling, any faulty products should be labelled as 'quarantined' or 'rejected' and moved to a designated area. [24:48] Key considerations for Quality Control: Ensure all raw materials, components, bulk product and packed products pass established quality tests, obtain Certificates of Analysis, have acceptance criteria forms – fill these out at all relevant stages. [26:30] Any products out of specification should be investigated by authorised personnel, only those responsible for product quality can decide to destroy or reprocess products. [27:25] Key considerations for Wastes: Identifiy different types of waste, ensure these wastes are disposed of in a timely and sanitary manner, have processes in place for collection, transportation, storage and disposal of waste. [28:48] Key considerations for Wastes: Where necessary, allocate a code in line with the European Waste Catalogue, ensure that correct waste carriers licenses are received and maintained. [29:19] Key considerations for Subcontracting: You can subcontract a lot of aspects i.e. cleaning, pest control, packaging ect. Ensure that any subcontractors are reviewed and approved, have clearly defined written agreements in place that outline roles and responsibilities (this can be a contract or just strictly in writing) [32:10] Key considerations for Deviations: Deviations can happen anywhere, have a regime in place to investigate complaints, in the case of serious deviations that could affect health and safety – ensure you have an effective recall process in place. [33:25] Key considerations for Complaints and Recalls: All complaints should be communicated to the plant, all complaints should be investigated and followed-up, if a recall needs to happen – ensure that appropriate steps are taken to recall and then take corrective action. [12:05] Key considerations for Change Control: Have a change management system in place to document any changes (and define if they are fixes, enhancements or major revisions), you need to establish who can: request, approve, develop, test and implement these changes. [36:35] Key considerations for Internal Audits: Internal audits need to be carried out in regular intervals, a minimum of 1 a year (but we recommend more!), track findings and document any corrective actions taken in a Continual Improvement Log. [38:17] Key considerations for Documentation: Documents are used through the whole process – ensure all documents used are approved, signed and dated by authorised personnel, key documents should be version controlled. We'd love to hear your views and comments about the ISO Show, here's how: Share the ISO Show on Twitter or Linkedin Leave an honest review on iTunes or Soundcloud. Your ratings and reviews really help and we read each one. Subscribe to keep up-to-date with our latest episodes: Stitcher | Spotify | YouTube |iTunes | Soundcloud | Mailing List

ISO 22716 sets out the framework for a quality management system for anyone involved in the manufacture of cosmetics and other healthcare related products. While this Standard's focus is on the manufacture of cosmetics specifically, many of the requirements can apply to any manufacturing process, especially those that involve a risk of contamination. As discussed in last weeks' episode, having ISO 22716 is essential if you are manufacturing or distributing within the EU. Besides being a legal requirement for certain regions, what other benefits can ISO 22716 offer? Today, Mel is joined by Derek Hall, a Senior Consultant here at Blackmores, to explain some of the key internal and external benefits of ISO 22716 and how it can work in tandem with other ISO Standards. You'll learn The internal benefits of ISO 22716 The external benefits of ISO 22716 How can ISO 22716 work with other ISO Standards? Resources isologyhub Blackmores ISO 22716 Implementation In this episode, we talk about: [00:50] Adoption of standards such as 22716 are often key requirements of Stakeholders [01:15] One general benefit of implementing ISO 22716 is the ability to win new business by virtue of displaying compliance to EU regulations. [01:40] What are the internal benefits? Firstly, it ensures you're legally compliant [02:10] ISO 22716 put controls in place that can reduce risk and hazards with product manufacture, storage and distribution. [02:35] There can be tangible cost savings – Derek highlights a few clients who have taken a step back to correct and improve their internal processes, which in turn resulted in cost savings. Compliance can also help to avoid any fines [03:29] It can help to avoid products being wrongfully distributed – which can be a very costly mistake, both in time, money and reputation. [04:20] ISO 22716 can integrate seamlessly with other ISO Standards such as ISO 9001 (Quality Management), ISO 14001 (Environmental Management) and ISO 45001 (Health and Safety Management). They are all based on a similar framework and are designed to work together [06:15] ISO Standards can act as a roadmap for managing a business – especially for micro businesses [08:05] ISO Standards are all scalable and can apply to any size of business. So, if you were to acquire more sites, you can simply roll out your management system across the expanding business [08:43] ISO 22716 is very clearly laid out and easy to follow [09:30] What are the external benefits? It's an internationally recognised Standard, and can be used for various marketing and tendering opportunities [10:47] ISO 22716 is a mark of quality and displays a brands commitment to delivering quality products [11:10] It promotes ethical behavior through your supply chain [11:50] It promotes regulatory credibility – Ensures your products meet regulatory requirements [12:05] It gives assurance that your product ingredients also meet legal requirements [12:40] Some ISO Standards can reduce insurance costs – This is something we'll explore in future episodes! We'd love to hear your views and comments about the ISO Show, here's how: Share the ISO Show on Twitter or Linkedin Leave an honest review on iTunes or Soundcloud. Your ratings and reviews really help and we read each one. Subscribe to keep up-to-date with our latest episodes: Stitcher | Spotify | YouTube |iTunes | Soundcloud | Mailing List

ISO 22716 sets out the framework for a quality management system for anyone involved in the manufacture of cosmetics and other healthcare related products. While this Standard's focus is on the manufacture of cosmetics specifically, many of the requirements can apply to any manufacturing process, especially those that involve a risk of contamination. On the surface, ISO 22716 may be considered a niche Standard, so why it is still so widely adopted? Today, Mel is joined by Derek Hall, a Senior Consultant here at Blackmores, to discuss the key drivers behind ISO 22716, including legal EU requirements and other related regulations. You'll learn Why is ISO 22716 used as an industry Standard? What is ISO 22716's relation to the Cosmetic Regulation (EC) No. 1223/2009? Who are these regulations applicable to? Other regulations and Standards applicable to cosmetics manaufacturing Resources isologyhub Blackmores ISO 22716 Implementation In this episode, we talk about: [00:42] A brief summary of ISO 22716 – watch the last episode for a full summary [01:25] Do you still need to comply with EU directives? Short answer – Yes, especially if you sub-contract parts of your manufacturing process / packaging or export product within the EU. [02:00] Why was the Cosmetic Regulation (EC) No 1223 created? To streamline and modernize current legislation across Europe for Cosmetics (though this can also include hygiene products i.e. soaps, toothpaste, deodorants ect) [03:30] What is the Cosmetic Regulation (EC) No 1223? This regulation establishes rules to be complied with by any cosmetic product made available on the market – to ensure a high-level of protection of human health [04:21] ISO 22716 is the central pillar of the Cosmetic Regulation (EC) No 1223 [05:02] A bit of background to the EU adoption of ISO 22716 – On April 21st 2011 – ISO 22716 officially became the Good Manufacturing Practices Standard for cosmetic product across Europe. This created a harmonised approach that ensured cosmetic products are safely manufactured, stored and shipped. [05:58] The whole regulation came into effect in July 2013. The laws for each nation had to follow this regulation – which included any relevant Standards or guidance affecting the cosmetic industry. This requirement also applies to any cosmetic manufacturers outside the EU that want to import into the EU. [07:36] Who are the regulations applicable to? Anyone involved in the cosmetic products chain (European and non-European). This includes raw materials producers, product assembly, distributors, exporters ect [08:05] ISO 22716 provides guidance for most parts involved in cosmetic production i.e. production, control, storage and shipment. However, it does not cover: safety for personnel (this may fall more under ISO 45001), protection for the environment, is not appliable to research & development and not appliable to the distribution of finished product [09:55] ISO 22716 is almost 20 years old – so environmental considerations weren't as much at the forefront of product manufacturing as they are today. Any manufacturers should be doing what they can about their impact regardless of current regulations (new versions may add guidance around this, so keep up-to-date with regulatory changes) [11:45] Other applicable standards include: The two part ISO 16128 Standard: ISO 16128-1: Guidelines on technical definitions and criteria for natural and organic cosmetic ingredients and products ISO 16128-2: Describes approaches to calculate natural, natural origin, organic and organic origin indexes that apply to the ingredient categories [13:58] COSMOS (standard Cosmetics Organic and Natural Standard) was created by many different International parties including BDIH (Germany), COSMEBIO & ECOCERT (France), ICEA (Italy), AISBL (Belgium) and Soil Association (UK). Its purpose is to define common requirements and definitions for organic and / or natural cosmetics. [15:25] Standards are created collaboratively by technical committees made up of global experts of their respective fields – they take years to develop to establish best practice [16:09] ISO 22716 has been approved by many regulatory bodies around the world, including the ICCR (The International Cooperation on Cosmetic Regulation), FDA (Food and Drug Administration), JCIA (The Japan Chemical Industry Association) and ASEAN Consultative Committee for Standards [17:10] Through current regulations, there is increased responsibility in regards to: Ingredients toxicity, product labelling, more comprehensive product file and compulsory notification of new products introduced to the EU [21:00] The current regulations have specific requirements for ingredient toxicity and product labelling We'd love to hear your views and comments about the ISO Show, here's how: Share the ISO Show on Twitter or Linkedin Leave an honest review on iTunes or Soundcloud. Your ratings and reviews really help and we read each one. Subscribe to keep up-to-date with our latest episodes: Stitcher | Spotify | YouTube |iTunes | Soundcloud | Mailing List

ISO 22716 sets out the framework for a quality management system for anyone involved in the manufacture of cosmetics and other healthcare related products. This is not only limited to production but also the control, storage, and transportation of products, including the purchase of raw materials, components and packaging material. While this Standard's focus is on the manufacture of cosmetics, many of the requirements can apply to any manufacturing process, especially those that involve a risk of contamination. Today, Mel is joined by Derek Hall, a Senior Consultant here at Blackmores, to talk through the main structure of the Standard and how it can be applied. You'll learn What is ISO 22716? Who does ISO 22716 apply to? How is ISO 22716 structured? How ISO 22716 can be applied Resources isologyhub Blackmores ISO 22716 Implementation The Checklist Manifesto In this episode, we talk about: [00:35] A description of ISO 22716 Good Manufacturing Practices – A supporting Standard for the manufacture of cosmetics [01:20] Why are we talking about such a niche standard? It's one of our most popular standards via website enquiry, so we'd like to share our knowledge 😊 [02:20] There is an EU directive pushing for the adoption of this Standard where applicable [03:00] A more in-depth summary of ISO 22716 – Why it's so important and why it was made [04:01] What does ISO 22716 cover? Guidelines and practical advice on the management of the human, technical and administrative factors affecting product quality. [04:58] A summary of the 17 clauses within ISO 22716 [07:55] What are the core elements of ISO 22716? Personnel, Premises and Equipment, Operations and Material Management, Quality Control and Cosmetics Quality Management System [08:50] Personnel – Key considerations include: Restricted areas free from food and drink, visitor supervision, personnel authorisation, personnel uniforms (removal of rings, hair restraints, safety glasses, gloves ect) [11:25] Premises and Equipment: The layout of buildings and equipment placement need to be controlled, controls for sanitisation and cleaning, guidance for storage, proper access to materials and equipment. [13:27] Premises: Pest control – should be very controlled to prevent contamination. This can be controlled via the building layout and cleaning controls. A pest control program should be created and followed. This extends to the exterior of your building too! [15:45] Equipment: Automated systems should be controlled in-line with ISO 22716. Equipment should be suitable for purpose and capable of regular cleaning and maintenance to avoid contamination. [17:02] Materials Management and Operation: How well do you control your materials? What controls do you have in place for manufacturing and packaging? How good is your storage? What is your delivery process? Do you keep documentation of all your purchasing and quality checks? [18:15] Materials Management and Operation: Stock – Consider how you manage and store stock, include regular checks to ensure it's all well within date. The Operations area in particular aligns with ISO 9001 – Quality Management. [19:40] Materials Management: You need to set the criteria for quality during different stages of manufacturing i.e. specifications for raw materials, components and packaging material. This should also include release parameters. [21:00] Materials Management criteria can be set out in a checklist. Mel mentions 'The Checklist Manifesto' as a recommended read [24:15] Materials Management: Make sure you store in a way that avoids any contamination or mix-ups. Ensure all containers are stored off the floor. Use clear labelling to show if they are accepted, rejected or quarantined [25:37] Operations: Should be carried out according to manufacturing documentation i.e. suitable equipment, product formula, details of the product process ect. [27:15] Quality Control: Consists of sampling, specification testing, out of spec investigations and release. You may subcontract out quality control – in which case, you must ensure you get proof that they are conducting adequate tests. [29:13] For subcontractors – Ensure you have a written contract OR agreement in place. If your subcontractor is subcontracting along the work, you need to ensure that process is controlled [31:32] Deviations: These can happen at any point in operation and can be both internal and external in origin [32:09] Complaints and Recall: You need to have processes in place to log and deal with complaints and recall. You should also regularly test your product recall process [33:20] Change Control: Making sure you have effective processes and documentation to control any changes to existing operation. I.e. if you get different machinery that changes mixing times [34:50] Internal Audits: You need to have an internal audit program in place and have competent independent personnel that can carry those audits out. This could be sub-contracted out [36:10] Documentation: You will be documenting all throughout the manufacturing process, it's integral. Ensure all staff know the importance of it and how to complete it correctly. We'd love to hear your views and comments about the ISO Show, here's how: Share the ISO Show on Twitter or Linkedin Leave an honest review on iTunes or Soundcloud. Your ratings and reviews really help and we read each one. Subscribe to keep up-to-date with our latest episodes: Stitcher | Spotify | YouTube |iTunes | Soundcloud | Mailing List

Today we're joined by Phil Bailey, Managed Services Director at PMC Retail, to talk about PMC's experience with ISO 27001, from implementation to on-going maintenance. PMC is a leading retail IT services and solutions provider, who recognised the growing need for formal Information Security certification. They succeeded in achieving certification to ISO 27001 in 2021, now over a year down the line, we catch up with Phil to find out what they've learned, benefits of certification and some tips for those looking to implement ISO 27001. You'll learn Who are PMC retail? How do PMC currently manage their ISO 27001 certification? How has the ISO Support Plan helped? What have they learned from implementing the standard? What are the benefits of implementing ISO 27001? ISO 27001 Top tips from Phil Resources PMC Retail The magic of thinking big by David J. Schwartz Blackmores ISO Support In this episode, we talk about: [01:03] An interesting fact about Phil – He started in electronic engineering and was involved the build of a system designed to measure the mirrors used in a telescope that was carried on the Discovery shuttle! [01:44] Who are PMC Retail? Started out consultancy to retailers, which has since branched out. [03:49] An example of one of PMC's projects – Pulling together legacy systems, updating them to newer technologies while maintaining the legacy data. [04:40] Learn about Phil's role at PMC [05:45] PMC now certified to ISO 27001 – One of the most popular ISO's globally in recent years. It's becoming something of a mandatory requirement in the tech space when bidding for contracts [06:31] How do PMC manage their ISO 27001 certification – Created a small team dedicated to the task of achieving certification – along with some help from us 😊 Following certification they onboarded a Compliance Governance Manager to keep up with Internal Audits and other ISO maintenance. [08:25] How has the ISO Support plan helped? – Blackmores helped to implement the standard, and were very familiar with their system and way of working. Great to have a wealth of knowledge to tap into. [09:00] PMC managed to implement the standard in just 6 months! [10:25] What did PMC learn from their experience? It wasn't an easy task! Getting leadership commitment from the start made a huge difference. [11:50] The benefits PMC have experienced by implementing and maintaining ISO 27001: Being able to identify risks and put actions in place to mitigate them. Certification demonstrates a robust security infrastructure to third parties. Establishes more credibility to customers and partners. They are able to see a pathway for business growth, utilising the certification. [14:30] ISO 27001 has helped to collate and bolster their existing Information Security structure – Having a library of resources, unified policies and procedures, company wide Objectives, and better understanding of measuring & managing risks. [16:15] PMC ensure that staff complete annual training – as required by the Standard. [17:10] Phil stresses that you can't just stay still with Information Security is concerned, you need to be aware of new risks and make sure those in your business are also aware and know how to react. [18:00] Top tips from Phil: Get Leadership commitment early on. Build yourself a Management Team. Get help from an experienced external party. It's not a walk in the park, and needs focus to achieve in a reasonable amount of time. [19:42] Phil's book recommendation: The magic of thinking big by David J. Schwartz. [21:42] Phil's favorite quote: "You're never too old to set a new goal, or too old dream another dream" We'd love to hear your views and comments about the ISO Show, here's how: Share the ISO Show on Twitter or Linkedin Leave an honest review on iTunes or Soundcloud. Your ratings and reviews really help and we read each one. Subscribe to keep up-to-date with our latest episodes: Stitcher | Spotify | YouTube |iTunes | Soundcloud | Mailing List

The work doesn't stop once you get ISO certified, there is a requirement to complete an annual surveillance audit to ensure your Management System continues to meet the requirements of the standard(s). Last week Mel covered some basic preparation you can do ahead of a Surveillance Audit, but what should you expect on the actual audit day? Today, Mel shares 10 top tips to help you prepare and ensure your next surveillance audit runs as smoothly as possible. You'll learn What is a Surveillance Audit? What to expect during the Surveillance Audit Considerations for remote vs on-site audits What evidence do you need to have prepared? Resources isology Hub Blackmores ISO Support In this episode, we talk about: [00:36] A description of a Surveillance Audit [02:00] A summary of the 10 top tips [02:40] There is no right or wrong way to prepare for a Surveillance Audit – but the following tips will be applicable regardless of the standard your certified to [03:30] Tip 1: Be Prepared – A summary of what Mel covered in the previous episode [05:40] Tip 2 – The opening Meeting – Be sure to have all people involved in the audit present at the meeting. It's advised to have a member of the leadership team present. Here the Auditor will explain the different types of audit findings. [08:00] Tip 3 – Audit questions – Similar to your Stage 1 and 2 Assessment, you will be asked a lot of questions. Try to be specific with your answers, and don't be afraid to ask for clarification. Don't worry if you don't know the answers to certain questions outside of your area of expertise, simply direct them to the correct individual who can answer. You are within your rights to seek clarification on findings – Do not argue with the auditor, simply ask for justification on findings if you're confused as to why they're being raised. [13:05] Tip 4: Keep on track – It's everyone's best interest to stick to the Agenda. [13:35] Tip 5: On-site Surveillance audits – Do a floor walk before the auditor arrives to check that you're following your procedures. Make sure reception knows that the Auditor is arriving, and follows any of your standard visitor procedures. Try to book a room to base the audit in to avoid them overhearing any unnecessary chatter and to allow the auditor and auditees some privacy. [16:05] Tip 6: Remote Surveillance Audits – Ensure that you follow any company remote working procedures. Ensure you have a good wi-fi connection, all attendees should be visible on camera but be muted when not speaking. Make sure everyone has access to the necessary documents while off-site. [17:15] Tip 7: The Auditor – They are human, and they are here to support you to ensure you are doing what you say you're doing. They are experts on their Standards and it's advised to foster a friendly relationship with them. But please be aware that they shouldn't be sending you reports from personal email addresses, be left unattended on-site and shouldn't be talking any information off-site – show evidence on screen / in-person during the audit. [20:20] Tip 8: The closing Meeting – Held at the end of the day. Listen to the feedback and findings from the auditor – they are there to help you improve. Feel free to ask for further clarification if needed. It's advised to have everyone at the opening meeting present at the closing meeting. [22:38] Tip 9: Evidence needed – You will typically need, audit schedule, audit reports and Management Review Minutes. You may also need various policies and procedures. Ensure that all documents are version controlled and any applicable branding is consistent. [24:10] Tip 10: Enjoy it! – If you're doing everything you say you're doing, then you should enjoy showing off your Management System. The resulting report should be seen as an opportunity to continually improve – the auditor only wants the best for your business. We'd love to hear your views and comments about the ISO Show, here's how: Share the ISO Show on Twitter or Linkedin Leave an honest review on iTunes or Soundcloud. Your ratings and reviews really help and we read each one. Subscribe to keep up-to-date with our latest episodes: Stitcher | Spotify | YouTube |iTunes | Soundcloud | Mailing List

The work doesn't stop once you get ISO certified, there is a requirement to complete an annual surveillance audit to ensure your Management System continues to meet the requirements of the standard(s). Surveillance audits must be carried out by a Certification Body, during which they will typically look at your Management Review, your preventative and corrective actions process, Internal auditing process and the implementation of any recommendations that have come out of an Internal audit. Today, Mel explains how you can prepare for a Surveillance audit and gives examples of some key considerations ahead of the Auditor arriving on site. You'll learn What is a Surveillance Audit? Why there is a requirement for an annual surveillance audit What you need to prepare ahead of a surveillance audit Resources isology Hub Blackmores ISO Support What to expect during your first ISO Assessment In this episode, we talk about: [00:59] A description of a Surveillance Audit [01:30] The purpose of a Surveillance Audit – Ensuring your Management System meets ISO Standard requirements and as an opportunity to demonstrate continual improvement [02:40] There is no right or wrong way to prepare for a Surveillance Audit – but the following tips will be applicable regardless of the standard your certified to [03:30] Tip 1: Check that you have an Agenda for the visit – This should be provided at the end of your last report from the Certification Body [04:25] A brief overview of how the certification cycle works – A 3 year plan is usually provided to you by your Certification Body [05:50] Ensure that you go ahead with a UKAS accredited Certification Body [06:18] Tip 2: Confirm locations – make sure you know where the auditor is being sent and to prepare staff on site about the impending visit. This can also allow you to book out time for specific people that may be required during the audit [07:10] Tip 3: Ensure you book out time for any required key members of staff – it is also advised that you book out a meeting room for the day [08:45] Be prepared for the Auditor to walk around your site – Especially if they're assessing ISO 45001 (Health and Safety) and ISO 27001 (Information Security) [09:40] Double check if the auditor visit is on-site or remote [10:30] Tip 4 – Check that you have all the relevant Management System records in place – and that they're up-to-date [10:50] Examples of what documentation the Auditor will typically look at [13:00] Tip 5 – Make sure you've closed out any opportunities for improvement and non-conformities from your last internal audit [14:30] Tip 6 – Check if there have been any changes to your business that may effect the scope of certification i.e. New products or services with no controls in place yet or a new site [16:00] Tip 6: Confirm the auditor's visit and check if they have any accessibility or dietary needs. [16:30] Tip 7: Warn any relevant reception / security staff about the visit so they know to expect the auditor. Ensure they go through any of your typical security procedures i.e. getting an access card, signing visitor book ect [17:42] Tip 8: Send an email to all staff to remind them about the surveillance visit – good to do this a day or two ahead of the visit [19:45] Tip 9: Do a floor walk – Ensure that any of the physical controls you have in place are working as intended We'd love to hear your views and comments about the ISO Show, here's how: Share the ISO Show on Twitter or Linkedin Leave an honest review on iTunes or Soundcloud. Your ratings and reviews really help and we read each one. Subscribe to keep up-to-date with our latest episodes: Stitcher | Spotify | YouTube |iTunes | Soundcloud | Mailing List