Confidentiality Procedure

Document Control

• Document ID: EX-QM.MP-02-20.1
• Version: 20.1
• Status: Active
• Language: English
• Owner: Quality Manager
• Approved by: Director

Purpose

Protect confidential information obtained during inspection and governance activities.

Scope

This procedure applies to all personnel, contractors, and management roles operating under the inspection body governance system and related quality activities.

Normative References

• ISO/IEC 17020 (current adopted edition)
• ISO 9001 (current adopted edition)
• Applicable national legislation and sector regulations
• Internal governance and quality documents under docs/governance/

Terms and Definitions

• Inspection Body: The organization responsible for inspection services and compliance obligations.
• Quality Manager: Role accountable for quality system maintenance and document integrity.
• Record: Evidence demonstrating that an activity was performed and controlled.
• Nonconformity: Failure to meet a specified requirement.

Roles and Responsibilities

• Director:
  • approves the procedure and major revisions
  • provides resources for implementation
• Quality Manager:
  • maintains procedure currency
  • monitors implementation and evidence quality
  • initiates review updates when needed
• Process Owners and Responsible Staff:
  • execute activities per this procedure
  • maintain complete and accurate records
  • report deviations and risks promptly

Procedure Requirements

1. Planning and Control:

• Activities MUST be planned, assigned, and tracked.
• Criteria for acceptance/rejection MUST be defined before execution.

2. Competence and Authorization:

• Personnel MUST be competent for assigned tasks.
• Role authorization MUST be documented.

3. Execution and Evidence:

• All required actions MUST be performed using approved methods.
• Evidence records MUST be clear, traceable, and tamper-evident.

4. Monitoring and Review:

• Performance and compliance MUST be periodically reviewed.
• Deviations MUST trigger corrective or preventive actions.

5. Change Management:

• Material process changes MUST be reviewed and approved before use.
• Superseded content MUST be withdrawn from operational use.

Records

Minimum records retained under this procedure SHOULD include:

• planning and assignment evidence
• execution evidence and outputs
• review and approval records
• nonconformity and corrective action records
• revision and communication records

Retention and protection MUST comply with the Records Management and Document Control procedures.

Confidentiality and Data Protection

Information obtained through procedure execution MUST be protected against unauthorized access, alteration, and disclosure, except where disclosure is legally required.

Monitoring, Metrics, and KPIs

Suggested indicators:

• on-time completion rate
• nonconformity recurrence rate
• corrective action closure cycle time
• periodic review completion rate

Nonconformity Handling

When nonconformity is detected:

1. register the issue
2. assess risk and impact
3. define corrective/preventive action
4. assign owner and deadline
5. verify effectiveness and close

Review and Revision

• The procedure MUST be reviewed at least annually.
• Early review MUST occur when regulations, risk profile, or operating model materially changes.
• Revision history MUST be recorded in the controlled register.

Distribution and Access

This document is controlled for internal use. Authorized personnel MAY access current approved version through the document control channel.

Annex (Recommended)

• Annex A: Forms and templates reference list
• Annex B: RACI matrix
• Annex C: Revision history log