Different Standards

ISO 14000 is a series of environmental management standards developed and published by the ISO for organizations. The ISO 14000 standards provide a guideline or framework for organizations that need to systematize and improve their environmental management efforts. The ISO 14000 standards are not designed to aid the enforcement of environmental laws and do not regulate the environmental activities of organizations. Adherence to these standards is voluntary.

The ISO 14001 standard is the most important standard within the ISO 14000 series. ISO 14001 specifies the requirements of an environmental management system (EMS) for small to large organizations. An EMS is a systemic approach to handling environmental issues within an organization. The ISO 14001 standard is based on the Plan-Check-Do-Act (PDCA) cycle.

The Plan cycle deals with the beginning stages of an organization becoming ISO 14001-compliant. The Check cycle deals with checking and correcting errors. The Do cycle is the implementation and operation of the ISO 14001 standard within an organization. And the Act cycle is a cycle that never ends as an organization continually finds ways to improve their EMS.

ISO 14004:2016 provides guidelines on the elements of an environmental management system and its implementation, and discusses principal issues involved.

ISO 14001:2015 specifies the requirements for such an environmental management system. Fulfilling these requirements demands objective evidence which can be audited to demonstrate that the environmental management system is operating effectively in conformity to the standard.
What can be achieved

ISO 14001:2015 is a tool that can be used to meet internal objectives:
provide assurance to management that it is in control of the organizational processes and activities having an impact on the environment
assure employees that they are working for an environmentally responsible organization.

ISO 14001:2015 can also be used to meet external objectives:
provide assurance on environmental issues to external stakeholders – such as customers, the community and regulatory agencies comply with environmental regulations support the organization’s claims and communication about its own environmental policies, plans and actions provides a framework for demonstrating conformity via suppliers’ declarations of conformity, assessment of conformity by an external stakeholder – such as a business client – and for certification of conformity by an independent certification body.

The entire process can take several months to several years depending on the size of the organization. If an organization is already ISO 9001 certified, the implementation of ISO 14001 does not take as long.

The Technical Committee (TC) behind ISO 14000 is TC 207.

ISO 45001 is an occupational health and safety management standard. It defines a set of occupational health and safety (OH&S) management requirements for occupational health and safety management systems (OHSMS).

OHSAS 18001 2007 was developed by the OHSAS Project Group, a consortium of 43 organizations from 28 countries. This consortium includes national standards bodies, registrars (certification bodies), OH&S institutes, and consultants.

This new OHSAS 18001 2007 standard was officially published during July of 2007. It cancels and replaces OHSAS 18001 1999. Since it was first published in 1999, OHSAS 18001 has rapidly become the most widely used international OH&S management standard. OHSAS 18001 applies to all types of organizations. It doesn’t matter what size they are or what they do.

The purpose of OHSAS 18001 is to help organizations to manage and control their OH&S risks and to improve their OH&S performance. They can achieve this purpose by developing an OHSMS that complies with OHSAS 18001.

An OHSMS is a network of interrelated elements. These elements include responsibilities, authorities, relationships, functions, activities, processes, practices, procedures, and resources. These elements are used to establish OH&S policies, plans, programs, and objectives.

If you don’t already have an occupational health and safety management system (OHSMS), you can use this OHSAS 18001 standard to establish one. And once you’ve established your organization’s OHSMS, you can use it to manage and control your OH&S risks and to improve your OH&S performance.

OHSAS 18001 expects organizations to comply with all of the requirements that make up the standard. According to the standard, your OHSMS must comply with every OHSAS 18001 requirement (Part 4 of the standard).

However, the size and complexity of OHSMSs vary quite a bit. How far you go is up to you. The size and complexity of your OHSMS, the extent of your documentation, and the resources allocated to your system will depend on many things. How you meet each of the OHSAS 18001 requirements, and to what extent, depends on many factors, including:

1. The size of your organization
2. The location of your organization
3. The nature of your organization’s culture
4. The nature of your organization’s activities
5. The nature of your organization’s legal obligations
6. The nature and scope of your organization’s OHSMS
7. The content of your organization’s OH&S policy
8. The nature of your organization’s OH&S hazards
9. The nature of your organization’s OH&S risks
OHSAS 18001 is designed to be used for certification (registration) purposes. However, OHSAS 18001 does not require certification. You can be in compliance without being formally certified (registered). You can self-assess (self audit) your OHSMS and simply declare that it complies with the OHSAS 18001 standard (if it actually does).
OHSMS development plan includes
1. Define the scope of your OHSMS.
2. Define your organization’s OHSMS policy.
3. Develop a methodology to identify hazards and assess risks.
4. Establish procedures to identify hazards and assess risks.
5. Identify your organization’s hazards and assess your risks.
6. Establish procedures to evaluate and select OH&S controls.
7. Evaluate the adequacy of your existing OH&S controls.
8. Select OH&S controls that reduce your OH&S risks.
9. Document the results of your control selection process.
10. Identify relevant legal and nonlegal OH&S requirements.
11. Respect all relevant legal and nonlegal OH&S requirements.
12. Establish unique OH&S objectives for your organization.
13. Establish programs to achieve your OH&S objectives.
14. Appoint a member of top management to manage OH&S.
15. Ensure the competence of those who influence OH&S.
16. Identify your OH&S training and awareness needs.
17. Establish OH&S training and awareness procedures.
18. Implement OH&S training and awareness procedures.
19. Establish procedures to manage OH&S communications.
20. Establish procedures to manage OH&S participation.
21. Document your organization’s unique OHSMS.
22. Control your organization’s OH&S documents and records.
23. Implement controls to manage OH&S hazards and risks.
24. Establish an OH&S emergency management process.
25. Monitor and measure your organization’s OH&S performance.
26. Record the results of your OH&S monitoring and measuring.
27. Evaluate compliance with legal and nonlegal requirements.
28. Record the results of your OH&S compliance evaluations.
29. Establish procedures to investigate OH&S incidents.
30. Establish nonconformity management procedures.
31. Perform regular internal audits of your OHSMS.
32. Review your OHSMS at planned intervals.
33. Update and improve your OHSMS.

ISO 22000 is a generic food safety management system standard. It defines a set of general food safety requirements that apply to all organizations directly or indirectly involved in the food chain. It doesn’t matter how complex the organization is or what size it is, ISO 22000 can help ensure the safety of its food products.

The food chain consists of the entire sequence of stages and operations involved in the creation and consumption of food products. This includes every step from initial production to final consumption. More precisely, it includes the production, processing, distribution, storage, and handling of all food and food ingredients.

The food chain also includes organizations that do not directly handle food. These include organizations that produce feed for animals that produce food and for animals that will be used as food. It also includes organizations that produce materials that will eventually come into contact with food or food ingredients.

ISO 22000 can be used by:
• Primary producers- Farms, Ranches, Fisheries, Dairies

• Processors – Fish processors, Meat processors, Poultry processors, Feed processors

• Manufacturers – Soup manufacturers, Snack manufacturers, Bread manufacturers, Cereal manufacturers, Dressing manufacturers, Beverage manufacturers, Seasoning manufacturers, Packaging manufacturers, Frozen food manufacturers, Canned food manufacturers, Confectionery manufacturers, Dietary supplement manufacturers,
• Food service providers – Grocery stores , Restaurants , Cafeterias , Hospitals , Hotels , Resorts , Airlines , Cruise ships , Seniors lodges , Nursing homes
• Other service providers – Storage service providers, Catering service providers , Logistics service providers , Transportation service providers , Distribution service providers , Sanitation service providers, Cleaning service providers
• Product suppliers – Suppliers of tools, Suppliers of utensils, Suppliers of equipment, Suppliers of additives, Suppliers of ingredients, Suppliers of raw materials, Suppliers of cleaning agents, Suppliers of sanitizing agents, Suppliers of packaging materials, Suppliers of other food contact materials

ISO 22000 uses HACCP. HACCP stands for Hazard Analysis and Critical Control Point. It was developed by the Codex Alimentarius Commission. HACCP is a methodology and a management system. It is used to identify, prevent, and control food safety hazards. HACCP management systems apply the following methodology:

1. Conduct a food safety hazard analysis.
2. Identify your critical control points (CCPs).
3. Establish critical limits for each critical control point.
4. Develop procedures to monitor critical control points.
5. Design corrective actions to handle critical limit violations.
6. Create a food safety record keeping system.
7. Validate and verify your system.

This methodology is used to develop an HACCP plan. An HACCP plan is a document that describes how an organization plans to manage and control its food safety hazards. An HACCP plan contains at least the following information:
1. Critical control points (CCPs)
2. Hazards that will be controlled at each CCP
3. Control measures that will be used at each CCP
4. Critical limits that will be applied at each CCP
5. Procedures that will be used to monitor CCPs
6. Actions that will be taken when limits are violated

ISO 22000 shows organizations how to combine the HACCP plan with prerequisite programs (or programmes) and operational prerequisite programs into a single integrated food safety management strategy.

Prerequisite programs (PRPs) are the conditions that must be established throughout the food chain and the activities and practices that must be performed in order to establish and maintain a hygienic environment. PRPs must be suitable and be capable of providing food that is safe for human consumption. PRPs are also referred to as good hygienic practices, good agricultural practices, good production practices, good manufacturing practices, good distribution practices, and good trading practices.
Operational prerequisite programs (OPRPs) are prerequisite programs (PRPs) that are essential. They are essential because a hazard analysis has shown that they are necessary in order to control specific food safety hazards. OPRPs are used to reduce the likelihood that products will be exposed to hazards, that they will be contaminated, and that hazards will proliferate. OPRPs are also used to reduce the likelihood that the processing environment will be exposed to hazards.

Food Safety Management System development plan includes:
1. Demonstrate a commitment to food safety.
2. Document your organization’s food safety policy.
3. Support the establishment of a complete FSMS.
4. Define the scope and boundaries of your FSMS.
5. Plan the establishment of your organization’s FSMS.
6. Document FSMS responsibilities and authorities.
7. Appoint your organization’s food safety team leader.
8. Appoint your organization’s food safety team.
9. Establish food safety communication arrangements.
10. Provide the resources that your FSMS needs.
11. Provide competent food safety personnel.
12. Provide training and awareness programs.
13. Provide infrastructure and work environment.
14. Establish your prerequisite programs (PRPs).
15. Perform a food safety hazard analysis.
16. Document your food safety hazards.
17. Specify acceptable hazard levels.
18. Assess your food safety hazards.
19. Select measures to control hazards.
20. Establish operational prerequisite programs (OPRPs).
21. Prepare your organization’s unique HACCP plan.
22. Establish a product lot traceability system.
23. Develop food safety emergency procedures.
24. Identify and correct nonconforming products.
25. Evaluate data and take corrective actions.
26. Control products that are potentially unsafe.
27. Control your monitoring and measuring methods.
28. Validate your food safety control measures.
29. Verify that your FSMS has been implemented.
30. Evaluate the results of your verification activities.
31. Perform regular internal audits of your FSMS.
32. Carry out food safety management reviews.
33. Document your organization’s unique FSMS.
34. Control food safety management documents.
35. Control your food safety management records.
36. Continually update and improve your FSMS.
The Technical Committee (TC) behind ISO 22000 is TC 34.

Information is Life and blood for any organisation. It is a valuable asset to be protected, particularly in light of the increased significance of e-business and e-communication. An Information Security Management System (ISMS) allows for systematic security improvement, both within an organization and outside of it. Information security is a success factor for any organization. That is why it is necessary to minimize risks caused by the loss of assets, system breakdowns, breakins into the system from outside, manipulation as well as partial or complete loss or misuse of data that is, information. The results of such a risk analysis are taken into account when making plans for business continuity.

In October 2005, British Standard BS 7799 part 2 was adopted by ISO, re-badged and released as the new international standard ISO/IEC 27001:2005. ISO 27001 standard is the only one of its kind to date that defines requirements for the implementation of a management system for information security and against which organizations seek independent certification of their Information Security Management Systems

The information security controls from ISO 17799:2005 are noted in an appendix to ISO 27001. Organizations adopting ISO 27001 are free to choose whichever specific information security controls are applicable to their particular information security situations. As with ISO 17799, the key to selecting applicable controls is to undertake a comprehensive assessment of the organization’s information security risks. With the release of ISO 27001, BS 7799 Part 2 has been withdrawn just as BS 7799 part 1 was withdrawn and replaced by ISO 17799.

Application of ISMS is very crucial to organisations depending on IT – like BPO Companies Software Developers, Banks, Financial Institutions, Government Organisations, Organisation Implementing ERP, etc..

Beginning in 1994 with the successful launch of QS 9000 by Daimler Chrysler, Ford and GM, the Automotive OEM’s recognized the increased value that could be derived from an independent quality system registration scheme and the efficiencies that could be realized in the supply chain by commonizing system requirements.

In 1996, the success of these efforts led to a move towards the development of a globally accepted and harmonized quality management system requirements document. From this, the International Automotive Task Force (IATF) was formed to lead the development effort. It is an ad hoc group of OEM’s and automotive trade associations whose common goal is to improve the quality of products to automotive customers worldwide, along with a recognition scheme and training to support third party assessments of automotive suppliers. IATF members include the Big 3 and other OEM’s and industry groups.

The result of the IATF’s efforts, in conjunction with the International Organization for Standardization (ISO) has been the introduction of ISO/TS 16949:2002 quality management systems requirements documents. ISO/TS 16949 forms the requirements or the application of ISO 9001 for automotive production and relevant service part organizations. ISO/TS 16949 used the ISO 9001 Standard as the basis for their development and included the requirements from these Standards with specific ’adders’ for the automotive supply chain. The 2002 revision of TS builds off the ISO 9001:2000 document

The quality system requirement for the oil and gas sector

An SA 8000 certificate proves that your Social Accountability System has been measured against a best practice standard and found compliant. Issued by a third party certification body/registrar, the certificate lets customers know they can trust that you have implemented the necessary internal processes to ensure basic human rights for your employees.

SA 8000 is a comprehensive, global, verifiable standard for auditing and certifying compliance with corporate responsibility. It is applicable to both small and large companies that want to demonstrate to customers and other stakeholders that they care. The heart of the standard is the belief that all workplaces should be managed in such a manner that basic human rights are supported and that management is prepared to accept accountability for this.

An international perspective

The standard was initiated by Social Accountability International (SAI). SAI is a non-profit organisation dedicated to the development, implementation, and oversight of voluntary verifiable social accountability standards.The SA 8000 system is modelled after the established ISO 9001 and ISO 14001 standards for Quality and Environmental Management Systems. The standard was developed and field-tested by the non-profit Council on Economic Priorities (CEP), and assisted by an international Advisory Board including representatives of prominent corporations, human rights organisations, certification professionals, academics, and labour.

The standard is based on a number of existing international human rights standards including the United Nation’s Universal Declaration of Human Rights and the UN Convention on the Rights of the Child. SA 8000 provides transparent, measurable, verifiable standards for certifying the performance of companies in nine essential areas:

1. Child Labour. Prohibits child labour (under age 15 in most cases). Certified companies must also allocate funds for the education of children who might lose jobs as a result of this standard.
2. Forced Labour. Workers cannot be required to surrender their identity papers or pay “deposits” as a condition of employment.
3. Health and Safety. Companies must meet basic standards for a safe and healthy working environment, including drinkable water, restroom facilities, applicable safety equipment, and necessary training.
4. Freedom of Association. Protects the rights of workers to form and join trade unions and to bargain collectively, without fear of reprisals.
5. Discrimination. No discrimination on the basis of race, caste, national origin, religion, disability, gender, sexual orientation, union membership, or political affiliation.
6. Disciplinary Practices. Forbids corporal punishment, mental or physical coercion and verbal abuse of workers.
7. Working Hours. Provides for a maximum 48-hour work week, with a minimum one day off per week, and a cap of 12 hours overtime per week remunerated at a premium rate.
8. Compensation. Wages paid must meet all minimum legal standards and provide sufficient income for basic needs, with at least some discretionary income.
9. Management. Defines procedures for effective management implementation and review of SA 8000 compliance, from designating responsible personnel to keeping records, addressing concerns and taking corrective actions

The CMM describes the principles and practices underlying software process maturity. It is intended to help software organizations improve the maturity of their software processes in terms of an evolutionary path from ad hoc, chaotic processes to mature, disciplined software processes. The focus is on identifying key process areas and the exemplary practices that may comprise a disciplined software process. The maturity framework provided by CMM establishes a context in which:

• Practices can be repeated, if you don’t repeat an activity there is no reason to improve it. There are policies, procedures, and practices that commit the organization to implementing and performing consistently.
• Best practices can be rapidly transferred across groups. Practices are defined sufficiently to allow for transfer across project boundaries, thus providing some standardization for the organization.
• Variations in performing best practices are reduced. Quantitative objectives are established for tasks; and measures are established, taken, and maintained to form a base-line from which an assessment is possible.
• Practices are continuously improved to enhance capability (optimizing).

Structure of CMM

Maturity Levels 

A layered framework providing a progression to the discipline needed to engage in continuous improvement (It is important to state here that an organization develops the ability to assess the impact of a new practice, technology, or tool on their activity. Hence it is not a matter of adopting these, rather it is a matter of determining how innovative efforts influence existing practices. This really empowers projects, teams, and organizations by giving them the foundation to support reasoned choice.)

Key Process Areas 

Key process area (KPA) identifies a cluster of related activities that, when performed collectively, achieve a set of goals considered important.

Goals 

The goals of a key process area summarize the states that must exist for that key process area to have been implemented in an effective and lasting way. The extent to which the goals have been accomplished is an indicator of how much capability the organization has established at that maturity level. The goals signify the scope, boundaries, and intent of each key process area.

Common Features 

Common features include practices that implement and institutionalize a key process area. These five types of common features include: Commitment to Perform, Ability to Perform, Activities Performed, Measurement and Analysis, and Verifying Implementation.

Key Practices 

The key practices describe the elements of infrastructure and practice that contribute most effectively to the implementation and institutionalization of the key process areas.

People CMM

Some argue the CMM focuses too heavily on process or technology, not people. Furthermore, those organizations deemed mature indicated that their progression to this state required significant changes in managing people, and their continuing improvement in their organizational capability required them to address issues regarding their people assets and human resources management. In response to this growing concern the SEI is developing a People Capability Maturity Model (P-CMM). The P-CMM, whose structure is provided in following figure, is an adaptation of CMM concepts focused on developing the organization’s human capabilities, especially the talent in software and information systems development. The motivation for the P-CMM is to radically improve the ability of software organizations to attract, develop, motivate, organize, and retain the talent needed to steadily improve software development capability.

The strategic objectives pursued in the P-CMM are to: 

• improve the capability of software organizations by increasing the capability of their staff,
• ensure that software development capability is an attribute of the organization rather than of a few individuals,
• align the motivation of the staff with those of the organization, and
• retain assets (i.e., people with extensive skills and capabilities) within the organization.

The P-CMM includes practices in the areas of: 

• staffing (includes recruiting, selection and planning)
• managing performance
• training
• compensation
• work environment
• career development
• organizational and individual competence
• mentoring and coaching
• team and culture development

GLOBALGAP is a private sector body that sets voluntary standards for the certification of agricultural products around the globe.

The GLOBALGAP standard is primarily designed to reassure consumers about how food is produced on the farm by minimising detrimental environmental impacts of farming operations, reducing the use of chemical inputs and ensuring a responsible approach to worker health and safety as well as animal welfare.

GLOBALGAP serves as a practical manual for Good Agricultural Practice (G.A.P.) anywhere in the world. The basis is an equal partnership of agricultural producers and retailers who wish to establish efficient certification standards and procedures.

The GLOBALGAP website is a comprehensive knowledge base for all interested parties: producers, suppliers, retailers, journalists and consumers. With its clear and easy navigation www.globalgap.org incorporates exhaustive information on the GLOBALGAP standard and its modules and applications.