Quality management can be
thought of as the process of designing and executing products and services
effectively, efficiently, and economically. In this context, effectiveness
primarily involves the ability of the products and services to meet or exceed customers’
expectations, while efficiency involves the ability to provide products and
services without wasting any resources. Economics involves the ability to
generate requisite revenues from the process so that the organization can be
sustained.
Risk management is the
process of identifying, addressing, prioritizing, and eliminating potential
sources of failure to achieve objectives. Applying risk management means being
proactive, preventive, predictive, and preemptive. Risk asks the question, “What
if?†and looks at likelihood and consequences to determine which of the
what-ifs are significant and need to be addressed.
If we look at process
quality, we see that objective gaps imply higher deltas in the process, which
means higher risk: more variances, or higher variation, leads to less
uniformity in product or service. By reducing the risk of deltas, we reduce
objective gaps and variation, and increase process quality.
There are three main types of operational risks:
Enterprise risk—Risk related to the operation of a business, execution strategy, systemic issues, and material issues
Project risk—Risk related to the planning and delivery of a product or service, and of not being able to meet project “triple constraints,†i.e., scope/quality, schedule, and cost, including technology and other factors.
Process risk—Risk relating directly to planning and delivery of a product or service and of not being able to meet process stability, process capability, and continuous improvement—meaning the inability to achieve consistent outcomes.
To ensure consistency of approach to risk management, standards and models have been and are continuing to be developed. Standards provide the following benefits:
1. Reference for risk management processes
2. Define consensus and best practices
3. Define frameworks to guide and support risk decision process
4. Provide common vocabulary to discuss and compare risk processes
Some risk-based standards
include: ISO 28000, which addresses supply chain security; ISO 27000, for
IT security; ISO 22000 for food safety; the FAA Safety Management System, and
AS 9100 for aerospace.
The critical elements of risk management identified in ISO 31000 are:
Risk identification—Identifies the sources of risk, risk events, and their potential consequences.
Risk analysis—Analyzes the causes and source of the risks and the likelihood that they will occur.
Risk evaluation—Determines whether risks need to be addressed and treated.
Risk treatment—Determines strategies and tactics to mitigate or control risks.
Further, ISO states that
risk management should “ensure that organizations have an appropriate response
to the risks affecting them.†Risk management should thus “help avoid
ineffective and inefficient responses to risk that can unnecessarily prevent
legitimate activities and/or distort resource allocation.†And, to be effective
within an organization, risk management should be “an integrated part of the
organization’s overall governance, management, reporting processes, policies,
philosophy and culture.â€
The ISO risk management process involves “applying logical and systematic methods†for:
·
Communication and consultation throughout the process
·
Establishing the context
· Identifying, analyzing, evaluating and treating risk associated
with any activity
· , process, function, project, product, service, or asset
·
Monitoring and reviewing risk
· Recording and reporting the results appropriately
The closer look at the
integration between those two management systems might bring few surprises. A
mature body of knowledge that carries different arguments about not only the
advantages of such integration, but also many conceptual frameworks that might
help in that journey. This confirms with Popescu and Dascalu (2011) who
argued that the quality management system and the risk management system are
not mutually exclusive; they complement each other.
Many scholars addressed the
relationship between quality management and risk management, and argued that
the integration will add value to both areas. The need for this
integration is best understood when reviewing the limitations in the traditional
quality management and risk management thinking.
Summary
We have looked at the link
between quality and risk and the basic elements of risk management and
operational risk. By changing your perspective to view quality as a risk
function, you can shift from a largely reactive approach of measuring and
controlling variances, to proactively identifying, addressing, prioritizing,
and eliminating potential sources of failure.
User questions & answers