🚀 go-pugleaf

G'day!

My question is loosely related to the 18th element of ISO 9001:1994 -
training, because the impetus to enforce training/deployment of special,
external security guidelines is one of our customers (data security -
medical sector).

The requirement is that we verify the deployment of these guidelines in the
course of our processes: we established a system, where the project manager
hands out these guidelines to new employees - after reading it for
themselves there is a joint review of these policies conducted by/with the
manager, if everything has been cleared up in this dialogue, the new
employees sign a document to confirm that they have read these policies,
understand them and that they will comply with them. We also make reviews of
the policies (all project team-members) in a fixed intervall of a few months
to support the process of deployment and adapt it if necessary.

Nevertheless, our customer complains that if one knows the guidelines, this
does not mean that he complies with them automatically - ok - so my question
is:

what system can we establish additionally to enforce/check the deployment of
these guidelines without compromising trust (which is still a main concern
in our organization (internally)) and with reasonable effort ?

Thanx in advance,
John.