2020-Q2-08 - DOCUMENT CONTROL

ISO9001/2015 Document Control Audit

Date

Wednesday, April 22, 2020

Audit Number

2020-Q2-08

Name of Auditor

Lucy Bennett-Poole

Audit Subject

DOCUMENT CONTROL

Scope & Objective of Audit The requirements for document control are stated in section 7.5.3 of the ISO9001:2015 standard.

The objective of this audit is to ensure that :1. It is available for use where and when required 2. It is adequately protected DEFINITION OF DOCUMENTED INFORMATION documented information refers to information that must be controlled and maintained. Therefore, it expects that you also maintain and control the medium as well as the information.

For the purposes of This Audit Process, PWS has defined the following information as Documented Information:-

1: Customer details - All details concerning our customers incl contacts, addresses 2. Account Information - All accounts data incl Sales Orders, Invoices and Credit Notes, Purchase orders to suppliers.

3. Supplier details - All details concerning our suppliers incl contacts, addresses.

4. Staff Files - All HR Documentation is considered confidential and must therefore be treated as Documented Information.

GDPR - How does PWS gain permission from the client to retain their company data?

On quotation for contract renewal, when a customer accepts a quote, they are agreeing for us to keep any / all details relating to our services on file for the duration of that contract. Should the customer not renew their contract, all data is de-activated from our database and no-one is able to access it. The MD is the only person who can re-activate it and this would only be done if the customer came back to us.

1

SAGE. All Sales Orders, Invoices, Credit notes and Purchase orders are stored on Sage. Is the Auditor con dent and it it proven that the documents stored within SAGE are only accessible by authorised personnel?

Yes

SAGE. All Sales Orders, Invoices, Credit notes and Purchase orders are stored on Sage. Is the Auditor con dent that all system data is backed up securely and is fully recoverable in the event of it being required?

YES

What System is in place for PWS Systems and document back up.

LIVEDRIVE

Is this Method of back up guaranteed by the manufacturer? What assurances are in place to ensure all data is retrievable as and when required.

'STATEMENT FROM LIVEDRIVE' Transfer security Your files are transferred securely from your device to our servers using the strongest available TLS encryption.

Data Protection Act Fully compliant with EU privacy laws, registered under the Data Protection Act and with the ICO (Information Commissioner’s Office).

PCI compliant Livedrive stores, transmits and processes card details according to the Payment Card Industry Data Security Standard (PCI-DSS).

Obfuscated data Customer file information is masked when on our servers so it cannot be identified or linked to a particular account.

Distributed data Individual customer data is split across multiple independent systems with no single system containing enough to retrieve an individual file via any unauthorized methods.

Two factor authentication (2FA) 2FA increases security by requiring users to type in a unique code displayed on their mobile/tablet, in addition to their password, when logging into Livedrive. This can be turned on in the "Privacy and Security" section of the web portal.

How long are hard copy invoices and related documents stored for on PWS Premises?

7 Years

How are these hard copies stored?

Palletised and shrink wrapped. On expiring 7 years they are shredded.

2

Statement of Finding PWS method in place for the control of documented information is more than sufďŹ cient. All aspects of the business are recoverable and all procedures for storing hard copies are being followed.

Corrective Action Required Result of Audit

No Pass

Upload copies of evidence / related documents here

3