SBS - The best value in QMS software

Risk Approach doesn't address External Issues (Auditor's Comment)

tony s

tony s

Information Seeker
Trusted Information Resource
#21
#21
Silex7 said:
Yes, I agree to this point. I think your point is best described in the standard ISO31000/ IEC31010 5.3.2
Click to expand...
Most organizations who would try to "integrate" the statements in the ISO 31000 or even in the ISO 9001 into their tools or forms to analyze risks and opportunities will result to complicating the approach. Even ISO/TS 9002 mentioned this:

Clause 6.1.1 of ISO/TS 9002:2016:​
There is no requirement in ISO 9001 to use formal risk management (in accordance with ISO 31000​
in determining and addressing risks and opportunities. An organization can choose the methods​
that suit its needs.​

There's no need to have subsequent columns to indicate who will be affected (IP) or what is the context for each risk/opportunity that you have identified. It should be the other way around. To better identify risks/opportunities, the needs/expectations of IPs and the issues should be understood first. Example: waking up late will only be considered risk if I clearly understand that my boss expects me to come early in the office (i.e. 4.2) and I know that there is heavy traffic along the way to the office (i.e. 4.1).
 
Popular whitepapers from DISCUS
Elsmar Forum Sponsor
qualprod

qualprod

Trusted Information Resource
#22
#22
tony s said:
Most organizations who would try to "integrate" the statements in the ISO 31000 or even in the ISO 9001 into their tools or forms to analyze risks and opportunities will result to complicating the approach. Even ISO/TS 9002 mentioned this:

Clause 6.1.1 of ISO/TS 9002:2016:​
There is no requirement in ISO 9001 to use formal risk management (in accordance with ISO 31000​
in determining and addressing risks and opportunities. An organization can choose the methods​
that suit its needs.​

There's no need to have subsequent columns to indicate who will be affected (IP) or what is the context for each risk/opportunity that you have identified. It should be the other way around. To better identify risks/opportunities, the needs/expectations of IPs and the issues should be understood first. Example: waking up late will only be considered risk if I clearly understand that my boss expects me to come early in the office (i.e. 4.2) and I know that there is heavy traffic along the way to the office (i.e. 4.1).
Click to expand...
Tonys and Sílex 7
I have seen companies that need to write down documents, (columns) in order for the people these issues be understood, one think is what is kept in the mind, and other is that Information be easy to be read and people can find on one paper, this is when companies take an approach of the risk more deeply.
 
D

dhakadmilind

Starting to get Involved
#23
#23
I think, we can consider 4.1 and 4.2 seperatey but finally when we go for 6.1 then we have to consider Risk planning for 4.1,4.2both.That's why auditor showed the combined sheet so that both clauses will get address in one sheet in 6.1
 
John Broomfield

John Broomfield

Staff member
Super Moderator
#24
#24
I’m shocked to read of an auditor sharing intellectual property that possibly belongs to another client.

If auditors cannot be trusted with your property why would you allow them access to your business?

Better to have such auditors disbarred by their certifying body.
 
John Broomfield

John Broomfield

Staff member
Super Moderator
#28
#28
As a consultant I never worked for any registrar as an auditor. Neither did my colleagues. As consultants (and as second party auditors) we wanted to preserve our independence.
 
Last edited:
A

AndyN

Moved On
#29
#29
Indeed, John. I could/may write a book based on my experiences doing triage at many clients, after audits left more damage than good. Many audits are modeled after the CB process - even in the name of "internal audits" - and, of course, the auditor doesn't see the aftermath of their 76 page reports of nit-picky stuff which doesn't amount to a hill of beans. Being told that one caliper in 400 not being in the cal system is a "major" because last year a "similar" finding happened, doesn't meet with managements' reality. Or that a certificate of training for auditors didn't mention "ISO 9001:2015" as well as IATF 16949... In text-speak: FFS!
 
You must log in or register to reply here.
Thread starter Similar threads Forum Replies Date
G Any good examples of CAPA forms that include a risk based approach? ISO 13485:2016 - Medical Device Quality Management Systems 8
D Validation of existing equipment - Risk based approach example ISO 13485:2016 - Medical Device Quality Management Systems 3
C Usability IEC 62366-1:2015 and MDR 2017/745 - Risk based approach IEC 62366 - Medical Device Usability Engineering 1
M Informational USFDA draft guidance – A Risk-Based Approach to Monitoring of Clinical Investigations Questions and Answers Guidance for Industry Medical Device and FDA Regulations and Standards News 0
Pmarszal ISO 19011:2018 - Risk Based Approach for planning, conducting and reporting of internal audits Internal Auditing 8
Q Questions about the Risk-based approach to QMS processes ISO 13485:2016 - Medical Device Quality Management Systems 17
S ISO 13485:2016 - Risk-based Approach ISO 13485:2016 - Medical Device Quality Management Systems 3
S Risk based approach - Procedures already take a risk-based approach to QMS processes ISO 13485:2016 - Medical Device Quality Management Systems 3
S ISO 13485:2016 - How I can integrate a risk management approach in our SOPs ISO 13485:2016 - Medical Device Quality Management Systems 1
S Risk Based Approach for ISO 13485:2016 Form/Procedure ISO 13485:2016 - Medical Device Quality Management Systems 23
alonFAI How to define a Risk Based Approach for Supplier Management per ISO 13485:2016 ISO 13485:2016 - Medical Device Quality Management Systems 1
B Risk Requirements to meet the explicit Risk Based Approach of ISO 13485:2016 Examples ISO 13485:2016 - Medical Device Quality Management Systems 21
A FTA-Top/Down approach to Risk Analysis ISO 14971 - Medical Device Risk Management 2
AnaMariaVR2 Structured Approach to Benefit-Risk Assessment in Drug Regulatory Decision-Making Pharmaceuticals (21 CFR Part 210, 21 CFR Part 211 and related Regulations) 0
M Name for FMEA (Risk Analysis Approach) Program FMEA and Control Plans 1
V Evolving QA from 'Compliance-based' to 'Science/Risk-based' approach US Food and Drug Administration (FDA) 2
AnaMariaVR2 Risk Based Approach to Validation [article] Qualification and Validation (including 21 CFR Part 11) 3
T Best Risk Analysis Approach (ISO 14971) - Class IIa Medical Devices ISO 14971 - Medical Device Risk Management 16
C ISO/ PAS 28000 Implementation Guide - I'm interested in its risk based approach Other ISO and International Standards and European Regulations 4
Sidney Vianna Risk Based Audits - Will the industry change it's approach? Registrars and Notified Bodies 0
Scott Catron Any difference in FDA inspections since the risk-based approach was announced? US Food and Drug Administration (FDA) 6
T Biological Evaluation (10993) & Risk Management ISO 14971 - Medical Device Risk Management 7
D Cybersecurity and Risk Management: Loss of confidentiality IEC 62304 - Medical Device Software Life Cycle Processes 4
Q FMEA and Risk assessment in Microsoft Access FMEA and Control Plans 6
I Realization processes input into overall risk ISO 14971 - Medical Device Risk Management 2
M Need Help With Information Security Asset Risk Register IEC 27001 - Information Security Management Systems (ISMS) 2
thisby_ Post Market/Production Risk Assessment ISO 14971 - Medical Device Risk Management 0
S Risk Management Review ISO 14971 - Medical Device Risk Management 4
D Low risk IVD study in the UK, do I need MHRA approval? UK Medical Device Regulations 1
S Risk Management and other Files ISO 14971 - Medical Device Risk Management 8
silentmonkey Overall Benefit/Risk Analysis - Risk Management VS Clinical Evaluation ISO 14971 - Medical Device Risk Management 3
N ISO 27001 for Jumb Burger - Risk Assessment sheet IEC 27001 - Information Security Management Systems (ISMS) 11
C Risk Assessment Tools ISO 9000, ISO 9001, and ISO 9004 Quality Management Systems Standards 3
qualprod Examples to mitigate risk from Covid ISO 9000, ISO 9001, and ISO 9004 Quality Management Systems Standards 5
G Risk of stopping your customer's line IATF 16949 - Automotive Quality Systems Standard 4
C Risk Matrix vs FMEAs ISO 14971 - Medical Device Risk Management 11
S IVD risk class II devices for Brazil and MDSAP Other Medical Device Regulations World-Wide 0
M ISO 14971:2019: Criteria for overall residual risk ISO 14971 - Medical Device Risk Management 6
M ISO14971:2019 - Verification of implementation and effectiveness of risk control ISO 14971 - Medical Device Risk Management 3
Aymaneh Medical Device Cybersecurity Risk Management IEC 27001 - Information Security Management Systems (ISMS) 2
S Traceability of requirements to design and risk Design and Development of Products and Processes 3
R Risk control measures as per ISO 14971 ISO 14971 - Medical Device Risk Management 6
D Deciding whether or not pre-market clinical investigation is required for low risk device EU Medical Device Regulations 5
R The term "Benefit Risk Ratio" in EU MDR, do I need to present benefit risk analysis as a RATIO Risk Management Principles and Generic Guidelines 4
_robinsingh Security Risk Assessment Tool IEC 27001 - Information Security Management Systems (ISMS) 0
A 21 CFR 820 - Risk Management - Looking for some guidance US Food and Drug Administration (FDA) 3
bryan willemot Contract Review and risk managment AS9100, IAQG, NADCAP and Aerospace related Standards and Requirements 2
D Risk Analysis using Monte Carlo Simulation instead of Scoring and Heat Map Risk Management Principles and Generic Guidelines 2
Sravan Manchikanti Software Risk Management & probability of occurrence as per IEC 62304 IEC 62304 - Medical Device Software Life Cycle Processes 8
E Normal Condition Hazards in Risk Analysis ISO 14971 - Medical Device Risk Management 3

Similar threads

Top Bottom