Of course. In many cases no, in many other cases yes. But were these procedures developed to reduce the effect of uncertainty?
Informational Is Identification of Risks and Opportunities required for QMS Processes?
- Thread starter morteza
- Start date
My guidance during a recent ISO-9001:2015 audit was that there is a general push toward risk-based thinking for all processes. When I performed some recent documentation training I stressed that people should think about the risk to which we're exposed if documentation is NOT done correctly.
Please, don't you think for a minute that what you heard from ONE auditor is "general". There is tremendous variation among CB's and even within the same CB, there is tremendous variation among "trained" auditors.
As for risk-based thinking applying universally and permanently, that's a given. It has always been like that, even when we did not use the term risk, explicitly.
Really? I'd be keen to see more on this. All I've seen, so far, is a lot of BS findings about document control and auditor qualifications...
Reading through the standard it's one of the top 3 lines in the introduction, then comments about risk and the PDCA cycle and "
Risk-based thinking enables an organization to determine the factors that could cause its processes and
its quality management system to deviate from the planned results, to put in place preventive controls
to minimize negative effects and to make maximum use of opportunities as they arise..." and that's just in the introductory section.
But.....but.....but.....weren't we told that the new standard brings more accountability to
In the IAF resolution (attached below), the message was:
If the auditors are still focusing on things that are immaterial to customer satisfaction and/or product conformity because they don't have the intelectual horsepower or the intestinal fortitude to address real issues, what is the point of revising standards? We all know that organizations, in the vast majority, will only do things they are written up for.
So, are you telling us that auditors are still delving into inconsequential issues just because this is their comfort zone? all the while ignoring issues of tremendous materiality for the system at hand? Who could see that coming?
Too bad that people involved in the management system conformity assessment sector have not been introduced to the notion of risks and opportunities for the "certification sector". Until buyers properly specify what they want from suppliers (hint: assurance and confidence) instead of certificates, we will reward mediocrity in the auditing world.
Thanks, Andy, for sharing your perspective.
Ah, but that's not "auditable"...
All,
RIsk-based thinking is second nature for most of us but can easily be taken for granted.
When analyzing your system with top management to determine its key processes the thinking is risk-based, perhaps starting with agreeing the criteria for a process being “key” or critical to success. PESTLE or SWOT can be useful analytical techniques here to flush out this thinking.
When analyzing each of the key processes with the process owner you are both thinking risk as you determine the actions (starting with planning and preparation) taken to fulfill process objectives while preventing nonconformity.
When designing the few new key processes, needed for the system to fulfill its mission, with the process owner you are both thinking risk as you determine the PDCA actions necessary to fulfill process objectives while preventing nonconformity.
So, seek evidence of risk-based thinking and you’ll probably find it or your colleagues will be ready to help.
This is preferable to ignoring risk-based thinking for you to impose your new fangled RM tools on your colleagues.
Asking auditors what they’ll be looking for so you can keep them happy is wrong because our system should be about creating more successful customers.
John
RIsk-based thinking is second nature for most of us but can easily be taken for granted.
When analyzing your system with top management to determine its key processes the thinking is risk-based, perhaps starting with agreeing the criteria for a process being “key” or critical to success. PESTLE or SWOT can be useful analytical techniques here to flush out this thinking.
When analyzing each of the key processes with the process owner you are both thinking risk as you determine the actions (starting with planning and preparation) taken to fulfill process objectives while preventing nonconformity.
When designing the few new key processes, needed for the system to fulfill its mission, with the process owner you are both thinking risk as you determine the PDCA actions necessary to fulfill process objectives while preventing nonconformity.
So, seek evidence of risk-based thinking and you’ll probably find it or your colleagues will be ready to help.
This is preferable to ignoring risk-based thinking for you to impose your new fangled RM tools on your colleagues.
Asking auditors what they’ll be looking for so you can keep them happy is wrong because our system should be about creating more successful customers.
John
I'm interested to understand more abut this approach. Seriously. We've seen a significant reduction in ISO 9001 requirements (to almost zero) in prescriptive documentation requirements, while at the same time, increasing references to risk and opportunity. Doesn't this tend to suggest that documentation, in general terms, isn't linked to risk?
Our auditor brought it up several times.
Similar threads
