Paperwork VS Risk-Based Thinking

The 9001:2015 and 14001:2015 standards reduced the required up-front QMS documentation, based on understanding that results (not a system of documents) are what truly matter, and that some companies had been sidetracked with documentation. Now the company defines the processes they need to document to ensure consistent results, although 13485 still requires several specific documents.

Risk Based Thinking’s goal is to manage risk before issues occur. We all use RBT, without calling it that. For instance, crossing the street you decide whether to cross at the intersection or sprint to beat the semi, or whether to go to the gym versus staying at home in bed.

The Concept of Risk is defined as “the effect of uncertainty,” either positive or negative, and is the state of deficiency of information related to an event (ISO 9000:2015, 3.7.9). Determining the combination of likelihood and consequence identifies the risk level. From this point of view, if you know the possible consequences of an activity, you can determine how to reduce, eliminate, mitigate, or otherwise manage the risk to product, company, or customer. Ideally all staff begin to think about work tasks using an RBT lens.

This is a philosophy of keeping in mind the upside and downside of any process or change to a process. In manufacturing, RBT means to define the risks for your company’s activities, and determine how you control those risks in each process. Then you monitor the effectiveness of your controls, analyze cause if adverse effects happen, and improve the controls as needed based on your analysis. Rejects and complaints identify gaps in current risk controls. For more detail, see ISO 9001:2015, sections 0.1, 0.3, Annex A4 and in numerous places throughout, especially in clauses 5 and 6.

Positive Risk - Remember, the definition of risk includes positive and negative outcomes. So part of your RBT needs to be the identification of opportunities, and evaluation of whether it is “worth the risk” to pursue them, i.e.: What is our likely ROI for this machine? Should we purchase vs. lease? What is the legislative impact of clients in this new industry? If we land this major client, what will we need to change to meet demand?

The Method is up to you. Whether you assign values of 1-5 for likelihood and severity and calculate risk in a formal quantitative matrix, use low medium and high values to create a qualitative matrix, or whether you simply list and discuss risk and controls in management review – the goal is to bring risk-based thinking to the surface and make it a part of your strategic planning.

One last thought – remember to review your identified risks at least annually and evaluate the effectiveness of controls, and any changes needed.