Friday, June 2, 2017

Risk in ISO 9001:2015 Transition?

By: Dale Wicker
In the ISO 9001:2015 standard there are two basic terms encompassing risk: risk-based thinking and the compound term risk and opportunities. Risk-based thinking is intended to be the system or approach an organization takes when considering risks and opportunities. These risk and opportunities are only those that may affect the organization’s ability to enhance customer satisfaction and consistently meet customer requirements, and, as applicable, statutory and regulatory requirements.

In ISO, risk is defined as “the effect of uncertainty,” and when used is implying a negative sense, which is in agreement with the Merriam-Webster Dictionary definition. So, in every instance in which the term risk is used in the new standard, it is used in the negative sense and never in the sense of a positive effect.

Opportunity, however, is presented in a less clear manner. For instance, in NOTE for Clause 6.1.2 states, “Options to address risks can include . . . taking risk in order to pursue an opportunity…” which agrees with the general understanding of opportunities, where actions are put in place for favorable or positive effects. However, throughout the standard it seems to use risk and opportunities together in a negative fashion. This seems to imply that we are to look for opportunities in the negative effects of risks and take action to prevent them or mitigate them. While this is true, it tends to place opportunities in a negative light and not line up with the general understanding. For instance, it would be a good practice to also consider positive effects that may occur that could lead to better products, improved processes, cost reductions, etc. This would line up with the general understanding of opportunities.

So what’s all this risk rattling mean?

David Hoyle, writer and Quality Management coach explains:

• An uncertainty presents a risk if its occurrence may have a negative effect on an expected result and is therefore relevant.
• An uncertainty presents an opportunity if its occurrence may have a positive effect on an unexpected result and is therefore relevant.

So, what do you need to do? 

Don’t panic! You’ve probably been applying risk-based thinking and didn’t know it! For instance, when you analyzed nonconformities and took action to prevent their recurrence, you were addressing risk; when you introduced training, you were addressing risk; when you did contract review, you were addressing risk; when you put in place controls over design, purchasing, production and service delivery, you were addressing risks. If you are currently ISO 9001 registered, none of this should be new to you. You already do these things!  The only thing that is new is the definition, which is covering a lot of what the old preventive actions required anyway.

In summary, your organization needs to have a system or approach for risk-based thinking that is promoted by leadership (Clause 5.1.1) that addresses your risk and opportunities (Clause 4.4.1, 5.1.2, 6.1.1, 6.1.2, 9.1.3, 9.3.2, and 10.2.1). You  must assess the risk and opportunities in light of meeting customer, statutory and regulatory requirements, as applicable, while enhancing customer satisfaction.



Ask Our Expert

Dale Wicker
Quality Program Manager



Dale Wicker is a member of The Center's Quality Team. He manages and delivers training and assistance to organizations in the areas of quality improvements and environmental management systems. Some of his projects involve support with the implementation of a Quality Management System including: ISO 9001, ISO/TS 16949, AS 9100 and ISO 14001. Dale also conducts training and provides consulting on the supporting tools of Quality Systems. To read Dale’s full bio, click here.






Since 1991, the Michigan Manufacturing Technology Center has assisted Michigan’s small and medium-sized businesses to successfully compete and grow. Through personalized services designed to meet the needs of clients, we develop more effective business leaders, drive product and process innovation, promote company-wide operational excellence and foster creative strategies for business growth and greater profitability. Find us at www.the-center.org.



1 comment:

  1. Nice article. You must also address risks and opportunities relative to the context of the organization, and the needs of (relevant) interested parties (6.1 which references 4.1 and 4.2).

    ReplyDelete