Do we need a Risk Register for ISO 9001:2015

[Sidney Vianna]

You could do a "PM" Private Message and not make your documentation to the whole world - thus not violating proprietary laws because no one will know or find out.

If you share intellectual property from your organization against your employer's policy, you are willfully violating a company directive, which could be grounds for immediate dismissal.

Not worth the risk in my opinion, especially when identities of people in a forum are not readily known and you could be sending valuable information to a competitor.

 

[Jen Kirley]

So - I have a bit to add that I hope will deem helpful.
You do NOT have to have a "register" per se, but you do need to have a MR, so that all has to be integrated. We have a large dry erase board that I have divided up by sections that have risk: shipping, purchasing, etc. We toss up issues as they arise, discuss and manage in the meetings and then keep a running "risk register" Just excel doc - on a shared folder for reviewing and history. Hope that works!

If your white board is for "brainstorming" and a document is kept that maintains the information (I don't say "retain" because we can consider this a "living document") it sounds good. Auditors will ask what risks have been identified, what management decided to do about them, if any, who they would impact (those would be your relevant interested parties) and how well the operational controls worked (objectives and monitoring & measurement).

You can have a MR if you want, but top management is accountable to see all of this gets done; a formally appointed management representative is no longer required.