8.3.2.3 Development of products with embedded software - request for clarification

[morteza]

Hi all,

In clause 8.3.2.3 IATF 16949 states:

Using prioritization based on risk and potential impact to the customer, the organization shall retain documented information of a software development capability self-assessment.

My questions are:

1- Is “potential impact to the customer” anything else rather than “risk”? I think that potential impact to the customer = risk to the customer.

2- Suppose that risk and potential impact are two different things. Does this requirement ask the organization to determine the retention time of self-assessment records based on risk and potential impact to the customer? I.e. such as following table:


thanks all

​

 

[John Broomfield]

Hi all,

In clause 8.3.2.3 IATF 16949 states:

Using prioritization based on risk and potential impact to the customer, the organization shall retain documented information of a software development capability self-assessment.

My questions are:

1- Is “potential impact to the customer” anything else rather than “risk”? I think that potential impact to the customer = risk to the customer.

2- Suppose that risk and potential impact are two different things. Does this requirement ask the organization to determine the retention time of self-assessment records based on risk and potential impact to the customer? I.e. such as following table:
View attachment 25266
thanks all

morteza,

Potential impact on the customer may be a working definition of negative risk (being as we also take positive risks).

Also see ISO 31000 on both types of risk.

The potential impact is considered when assessing risk along with probability of occurrence (and, possibily, probably of detection).

Your table shows that records associated with higher negative risks are kept longer than other records. At one time record keeping was so expensive that this table may have been useful. But is keeping electronically accessible archives that expensive these days?

Finally, risk and potential impact are not really two different things - the latter is part of the former.

John