Risk based Thinking in ISO 9001 2015

i)                Risk-based thinking is something we all do automatically and often sub-consciously.

ii)              The concept of risk has always been implicit in ISO 9001 – this revision makes it more explicit and builds it into the whole management system.

iii)            Risk-based thinking is already part of the process approach.

iv)             Risk-based thinking makes preventive action part of the routine.

v)               Risk is often thought of only in the negative sense.

vi)             Risk based thinking can also help to identify opportunities. This can be considered to be the positive side of risk

Risk in Clauses - Process Approach, Leadership, Planning

·       In clause 4 the organization is required to determine the risks which can affect its ability to meet these objectives.

·       In clause 5 top management are required to commit to ensuring clause 4 is followed.

·       In clause 6 the organization is required to take action to address risks and opportunities

Risk in Clauses – Operation, Evaluation, Improvement

i)                Clause 8 - the organization is required to have processes which identify and address risk in its operations.

ii)              Clause 9 the organization is required to monitor, measure, analyse and evaluate the risks and opportunities.

iii)            In Clause 10 the organization is required to improve by responding to changes in risk

Why Should I Adopt “Risk-based Thinking”?

·       To improve customer confidence and satisfaction

·       To assure consistency of quality of goods and services.

·       To establish a proactive culture of prevention and improvement.

·       Successful companies intuitively take a risk-based approach

What Should I Do?

i)                Use a risk-driven approach in your organizational processes.

ii)              Identify what the risks and opportunities are in your organization – it depends on context.

iii)            ISO 9001:2015 will not automatically require you to carry out a full, formal risk assessment, or to maintain a “risk register”.

iv)             ISO 31000 (“Risk management — Principles and guidelines”) will be a useful reference (but not mandated)

v)               Analyse and prioritize the risks and opportunities in your organization.

a.      What is acceptable?

b.     What is unacceptable?

vi)             Plan actions to address the risks

a.      How can I avoid or eliminate the risk?

b.     How can I mitigate the risk?

vii)           Implement the plan – take action.

viii)         Check the effectiveness of the actions – does it work?

ix)             Learn from experience – continual improvement

What Is Next?

Contact your local TNV office today and start the ISO 9001 transition process or write to training@isoindia.org