A “Risk Based Thinking”Model for IS

A “Risk Based Thinking”
Model for ISO 9001:2015
Bob Deysher
Senior Consultant
©2014 QSG, Inc.
Agenda
January 15, 2015 2
• Why implement Risk Based Thinking?
– What does ISO 9001:2015 require?
• What is Risk Based Thinking?
• What is Risk?
• What is a simple Risk Tool?
• How does it integrate into the Process
Approach?
• How do you make Risk Based Thinking a
Continual Process Improvement activity?
©2014 QSG, Inc.
ISO 9001:2015 Risk & Opportunities
January 15, 2015 3
4.4 Quality management system and its processes
The organization shall establish, implement, maintain and
continually improve a quality management system,
including the processes needed and their interactions, in
accordance with the requirements of this International
Standard.
The organization shall determine the processes needed
for the quality management system and their application
throughout the organization and shall determine:
f) the risks and opportunities in accordance with the
requirements of 6.1, and plan and implement the
appropriate actions to address them;
©2014 QSG, Inc.
ISO 9001:2015 Risk & Opportunities
January 15, 2015 4
6 Planning for the quality management system
6.1 Actions to address risks and opportunities
6.1.1 When planning for the quality management system,
the organization shall consider the issues referred to
in 4.1 and the requirements referred to in 4.2 and
determine the risks and opportunities that need to be
addressed to:
a) give assurance that the quality management
system can achieve its intended result(s);
b) prevent, or reduce, undesired effects;
c) achieve continual improvement.
©2014 QSG, Inc.
ISO 9001:2015 Risk & Opportunities
January 15, 2015 5
6.1.2 The organization shall plan:
a) actions to address these risks and opportunities;
b) how to:
1) integrate and implement the actions into its
quality management system processes (see
4.4);
2) evaluate the effectiveness of these actions.
Actions taken to address risks and opportunities shall be
proportionate to the potential impact on the conformity of
products and services.
©2014 QSG, Inc.
The Main Objectives of International
Standards
January 15, 2015 6
• To provide confidence in the organization’s
ability to consistently provide customers with
conforming goods and services
• To enhance customer satisfaction
The concept of “risk” in the context of the
international standards relates to the
uncertainty in achieving these objectives
©2014 QSG, Inc.
What is Risk Based Thinking?
January 15, 2015 7
©2014 QSG, Inc.
What is “Risk-Based Thinking”?
January 15, 2015 8
• Risk-based thinking is something we all do automatically and
often sub-consciously
• The concept of risk has always been implicit in ISO 9001 – the
2015 revision makes it more explicit and builds it into the whole
management system
• Risk-based thinking is already part of the process approach
• Risk-based thinking makes preventive action part of the routine
• Risk is often thought of only in the negative sense. Risk-based
thinking can also help to identify opportunities. This can be
considered to be the positive side of risk
©2014 QSG, Inc.
Why Should I adopt “Risk-Based
Thinking”?
January 15, 2015 9
• To improve customer confidence and
satisfaction
• To assure consistency of quality of goods and
services
• To establish a proactive culture of prevention
and improvement
• Successful companies intuitively take a riskbased
approach
©2014 QSG, Inc.
What Should I Do?
January 15, 2015 10
Identify what the risks and opportunities are in
your organization – it depends on context
–ISO 9001:2015 will not automatically require
you to carry out a full, formal risk
assessment, or to maintain a “risk register”
–ISO 31000 (“Risk management — Principles
and guidelines”) will be a useful reference
(but not mandated)
©2014 QSG, Inc.
What Should I Do? (continued)
January 15, 2015 11
• Analyse and prioritize the risks and opportunities in
your organization
– what is acceptable?
– what is unacceptable?
• Plan actions to address the risks
– how can I avoid or eliminate the risk?
– how can I mitigate the risk?
• Implement the plan – take action
• Check the effectiveness of the actions – does it work?
• Learn from experience – continual improvement
©2014 QSG, Inc.
Key Points to Remember
January 15, 2015 12
Risk Based Thinking = Preventative
Action
Risk Based Thinking is everybody’s
business!
– Risk Based Thinking is not just the
responsibility of management
– Risk Based Thinking must become
an integral part of the organizational
culture
©2014 QSG, Inc.
What is Risk?
January 15, 2015 13
Risk is the possibility of events or
activities impeding the achievement of an
organization’s strategic and operational
objectives.
©2014 QSG, Inc.
Risk – A Simple Definition
January 15, 2015 14
The volatility of potential outcomes.
or
How surprised do you really want to be??
©2014 QSG, Inc.
Food for Tho