What is
Risk Based Thinking?
One of the key changes in the 2015 revision
of ISO 9001 is to establish a systematic approach to consider risk, rather than
treating “prevention” as a separate component of a quality management system,
because risk is inherent in all aspects of a quality management system. Nonetheless,
there are risks in all systems, processes and functions, where risk-based
thinking ensures these risks are identified, considered and controlled
throughout the design and use of the quality management system. In previous
editions of ISO 9001, a clause on preventive action was separated from the whole.
According to the risk-based thinking; the consideration of risk is integral,
where it becomes proactive rather than reactive in preventing or reducing
undesired effects through early identification and action. Preventive action is
built-in when a management system is risk-based. On the other hand, risk-based
thinking is something that, we all do automatically in everyday life, i.e. if
you wish to cross a road you automatically look for traffic lights or two sides
of the road before you begin, because you will not step in front of a moving vehicle.
On the other hand, not all the processes of a quality management system represent
the same level of risk in terms of the organization’s ability to meet its
objectives, because certain risks need more careful and formal planning and
controls than others, i.e. to cross the road you may go directly through or you
might use a nearby footbridge or a pedestrian crossing. Which process you
choose will be determined by considering the risks.
Even though the
effects of risks can be either negative or positive, it is commonly understood
and considers only the negative consequences. Thus ISO 9001:2015 version
considers risks and opportunities together as a way of preventive risk
management and continuous improvement strategy; in which opportunity is not the
positive side of the risk. Whereas an opportunity is a set of circumstances
which makes it possible to improve the product quality or safety or preventing
an unintended or risk to the consumer or the manufacturer, but captivating or
not taking an opportunity then presents different levels of risk. i.e. crossing the road
directly gives me an opportunity to reach the other side quickly, but if I take
that opportunity there is an increased risk of injury from moving cars. Risk-based
thinking considers both the current situation and the possibilities for change.
Analysis of this situation shows opportunities for improvement:
A
subway leading directly under the road
Pedestrian
traffic lights, or
Diverting
the road so that the area has no traffic
Why use risk-based thinking?
By considering risk
throughout the system and all processes the likelihood of achieving stated
objectives is improved, output is more consistent and customers can be
confident that they will receive the expected product or service.
Risk-based
thinking:
Improves
governance
Builds
a strong knowledge base
Establishes
a proactive culture of improvement
Assists
with statutory and regulatory compliance
Assures
consistency of quality of products and services
Improves
customer confidence and satisfaction
Successful
companies intuitively incorporate risk-based thinking.
Risk based thinking is a sore point among
many Quality professionals. Even so, identifying risk, analyzing the
consequences, probability and level of risk (i.e. risk analysis) and risk
evaluation using formal techniques are becoming increasingly important tasks in
the global business world. ISO 9001:2015 incorporates what the draft version of
the International Standard has termed “Risk Based Thinking” in its requirements
for the establishment, implementation, maintenance and continual improvement of
the quality management system. If you are already familiar with the DIS or have
read the many discussions on the subject, you will already be aware that formal
risk management is not mandated. However, organizations can, in the words of
the TC 176 Committee’s draft standard (May 2014) “…choose to develop a more
extensive risk based approach than is required by this International Standard,
and ISO 31000 provides guidelines on formal risk management which can be
appropriate in certain organizational contexts”.
Managing risks is something we all do every
day, mostly without even thinking about it, but when the complexity increases
beyond our everyday experiences, such as risks faced by a business or a big
project, a more formal approach is required. However, it really isn’t
difficult, since generic risk management process has been set out in ISO
standard 31000 and can be applied to any kind of risk by any kind of organization.
ISO 31000 describes an “overall approach to risk management, not just risk
analysis or risk assessment. It deals with the links between risk management
process and both strategic direction and day to day actions and treatments.” The
form of assessment and its output should be consistent with the risk criteria
developed as part of establishing the context [Clause 6.2]. However, there is
no point in making life more complicated than it needs to be. Thus, suitable techniques should exhibit the
following characteristics, which should be justifiable and appropriate to the
situation or organization under consideration. it should provide results in a
form which enhances understanding of the nature of the risk and how it can be
treated and it should be capable of use in a manner that is traceable,
repeatable and verifiable.
Although risks and opportunities have to be
determined and addressed, there is no requirement in ISO 9001:2015 for a formal
risk management or a documented risk management process. Even so, the concept
of preventive action is expressed in the 2015 wording through the risk based
approach to formulating quality management system requirements, which
indirectly explains that you will most probably want to show your reasoning in
this respect. In other words, how your thinking about risk led to these
actions?
Strategic Approach to Risk Management
A technique that
provides a listing of typical uncertainties which need to be considered, where
users refer to a previously developed list, codes or standards. Checklists and
reviews of historical data are, naturally enough, a sensible step if you are
serious about identifying the risks and opportunities in accordance with the requirements
of ISO 9001:2015 Clause 6.1, and intend to plan and implement the appropriate
actions to address them. Although you could enhance the quality of the output
by following a systematic process to identify risks by means of a structured
set of prompts or questions for the experts by making a checklist of the known
issues in the environment that can (a) affect conformity of products and
services [risk] and (b) have the ability to enhance customer satisfaction
[opportunity].
Regardless of the industry or the product, different
kinds of risks need different assessments in terms of the questions to ask or
the exact technique you use, but the overall risk management process is the
same. Essentially, the generic steps are as follows:
Establish
the context
what activities are we talking about?
What are you trying to do?
e.g., using a piece
of machinery, making/building something, collecting measurements, importing or
exporting goods, staff, data
analysis and
reporting.
Identify
risks
what might affect the outcome?
e.g., a weather
event, change to regulations, injury, staffing shortages, lack of required
skills, loss of a key supplier, chemical exposure, theft, fraud, computer
failure, human error.
Analyze
the risks
– to prioritize them.
What are the consequences if the risk
actually occurs?
How likely is it to occur?
e.g. minor injury,
loss of life, schedule delays, change to reputation, financial losses/gains,
business growth/closure…
Evaluate – can we live with
this risk?
Is it a minor inconvenience?
Major problem?
Fantastic opportunity?
what’s our risk appetite?
Risk averse?
Risk seeking?
Neutral?
How could we change the consequences or
change the likelihood?
Weigh up the
cost/benefit balance for different options and for hazards, check the hierarchy
of controls.
Control/treat – actually implement
what you decided should be done to control the risk.
changes to work
practices
extra monitoring to
watch out for triggers
Review – is it working?
Can we do better?
Has anything changed?
Does this risk still apply?
Looking at past incidents
will help you become aware of the different kinds of risks and hazards to look
for.
However, some organizations have developed
specific forms for particular hazards they deal with, to make it easier to
remember to ask all the relevant questions.
