QUALITY · FAILURE MODE & EFFECT ANALYSIS · ISO 9001:2015
FMEA & Risk-Based Thinking
Turning Preventive Action into a Structured, Repeatable Discipline
How Failure Mode and Effect Analysis operationalizes the risk-based thinking required by ISO 9001:2015 and IATF 16949
Severity · Occurrence · Detection · Risk Priority
Agenda
From risk concepts to a working FMEA
What Is an FMEA? What Is Risk-Based Thinking?
01 02
Purpose, history, and the failures it's designed to prevent The ISO 9001:2015 concept behind modern preventive action
Where FMEA and Risk-Based Thinking Meet The Risk Triad: S × O × D
03 04
FMEA as risk-based thinking made concrete How severity, occurrence, and detection build the RPN
The FMEA Procedure Beyond RPN
05 06
Ten steps from team formation to resulting RPN Prioritizing risk and the shift toward Action Priority
FMEA & Risk-Based Thinking 2
What Is an FMEA?
A systematic method for identifying and preventing product and process problems before they occur — focused on defect prevention, safety, and
customer satisfaction.
Origins Adopted Broadly Two Main Types Preventive by Design
The automotive industry adapted
First formal FMEAs were Design/Product FMEA asks how a FMEA aims upstream — at design
FMEA into a standardized quality-
conducted in aerospace in the product can fail; Process FMEA and process development —
improvement tool with a
mid-1960s, targeting safety issues asks how manufacturing or where changes are still cheap and
common, cross-functional
before they became incidents. assembly can fail. easy to make.
language.
FMEA & Risk-Based Thinking 3
What Is Risk-Based Thinking?
The ISO 9001:2015 concept behind modern preventive action
Risk-based thinking is described as automatic and often subconscious — ISO 9001:2015 makes it explicit and
Something We Already Do builds it into the whole management system.
Rather than a standalone 'preventive action' clause, the 2015 revision expresses prevention entirely through a
Preventive Action, Reframed risk-based approach to planning.
Risk isn't only about threats — it also covers opportunities: circumstances that make a favorable outcome
Two Sides of Risk possible if acted on early.
Improved customer confidence, more consistent quality, a proactive culture of prevention, and organizations
The Intended Outcomes that take a risk-based approach intuitively.
FMEA & Risk-Based Thinking 4
Where FMEA and Risk-Based Thinking Meet
FMEA is risk-based thinking made concrete — the same cycle, with a structured worksheet and numeric rigor behind it.
ISO 9001:2015 Risk-Based Thinking Cycle The Matching FMEA Step
Determine risks and opportunities (clause 6.1.1) Review the process/product and brainstorm potential failure modes and effects
Plan actions to address risk, proportionate to impact Rank each effect for severity, occurrence, and detection; calculate the RPN
Prioritize failure modes and take action to eliminate or reduce the highest-risk
Integrate and implement actions into the QMS
ones
Evaluate the effectiveness of actions taken Recalculate the resulting RPN once corrective action is complete
FMEA & Risk-Based Thinking 5
Risk in the Standards
Risk-based thinking is not confined to one clause — it runs through planning, operation, and review.
ISO 9001:2015 IATF 16949
4.4 The QMS and its processes must address risks and opportunities [Link] Risk is embedded directly in the QMS process requirements
6.1.1 / 6.1.2 Determine and plan actions to address risks and opportunities [Link]–.3 Risk-based requirements specific to automotive planning
9.1.3 Analyze and evaluate the effectiveness of risk actions 8.1.2 / [Link] Risk considerations in operational and design planning
Management review covers changes in risk and their
9.3 effectiveness
[Link]–.6 Risk-related controls for nonconforming product
Improvement and corrective action update risks and
10.1 / 10.2 opportunities
8.1.1 / 8.6.6 Clauses dealing directly with managing and mitigating risk
FMEA & Risk-Based Thinking 6
The Risk Triad: S × O × D
Every potential failure is scored on three 1–10 scales; multiplying them turns qualitative judgment into a comparable risk number.
Severity
× Occurrence
× Detection
How serious the consequence would be if How probable or frequent the failure mode How likely current controls are to catch the
the failure's effect occurred. is expected to be. failure before impact.
RPN = Severity × Occurrence × Detection
Range: 1 (lowest risk) to 1,000 (highest risk) per failure mode
FMEA & Risk-Based Thinking 7
The FMEA Procedure
Ten steps translate risk-based thinking into a documented, team-based worksheet — Steps 1–5 of 10.
1 2 3 4 5
Review the Process or Brainstorm Failure
List Potential Effects Assign Severity Assign Occurrence
Product Modes
Study a blueprint or Work element by element
For each failure mode, ask: if Rate how likely each failure
flowchart so the whole team (people, methods, Rate how serious each effect
it occurs, then what mode is to happen, using
shares the same equipment, materials, would be, on a 1–10 scale.
happens? data where possible.
understanding. environment).
FMEA & Risk-Based Thinking 8
The FMEA Procedure (cont.)
Steps 6–10 of 10 — from detection ranking to a demonstrably lower resulting risk.
6 7 8 9 10
Calculate Resulting
Assign Detection Calculate the RPN Prioritize for Action Take Corrective Action
RPN
Rate how likely current Multiply severity × Rank RPNs highest to lowest; Eliminate or reduce the Re-score severity,
controls are to catch the occurrence × detection for set a cutoff, and flag any highest-risk failure modes occurrence, and detection to
failure before its effect is every failure mode and severity of 9–10 regardless using targeted problem confirm the risk has
felt. effect. of RPN. solving. genuinely dropped.
FMEA & Risk-Based Thinking 9
Prioritizing Risk
Not every failure mode gets attention at once — risk-based thinking means spending effort where it matters most.
The 80/20 Pattern Set a Cutoff RPN Severity Overrides the Cutoff
As with most quality data, a small share of Any effect ranked 9 or 10 in severity gets
Teams commonly agree on a threshold —
failure modes typically accounts for most of attention regardless of its RPN — some
e.g., any RPN above 200 gets addressed
the total RPN — a Pareto chart makes this consequences are too serious to wait on
now, with the rest revisited later.
visible at a glance. the math.
FMEA & Risk-Based Thinking 10
Beyond RPN: Action Priority
Risk-based thinking keeps evolving inside the FMEA method itself
Multiplying S × O × D can let a genuinely dangerous, low-frequency failure land at the same numeric score as a
A Known Limitation of RPN minor, frequent annoyance — masking where real risk sits.
The newer AIAG & VDA FMEA methodology replaces a single RPN cutoff with an Action Priority (High / Medium
The AIAG-VDA Shift / Low) look-up table driven by the S, O, and D rankings together.
Under both the classic and newer approaches, high-severity effects are never allowed to hide behind a low
Severity Still Leads overall score — severity governs urgency directly.
Whichever scoring convention is used, the underlying discipline is unchanged — identify, evaluate, prioritize,
The Constant: Risk-Based Thinking act, and re-evaluate risk continuously.
FMEA & Risk-Based Thinking 11
Building a Risk-Based FMEA Team
Risk-based thinking is everybody's business — the team's composition determines whether real risks get found.
The Process Expert's Dual Documented, Not Just
Cross-Functional by Design Clear Boundaries of Freedom
Role Discussed
Four to six members, with every
Scope, budget, deadlines, and how Deep expertise speeds the analysis, A risk register or completed FMEA
affected area represented —
far the team can go before escalating but the team must guard against ego worksheet is the evidence, during
manufacturing, engineering,
should be defined and understood getting in the way of an honest audits, that risk-based thinking
maintenance, materials, and the
before work starts. critique of that person's own work. genuinely took place.
customer's perspective.
FMEA & Risk-Based Thinking 12
Risk-Based Thinking Beyond the Factory Floor
The same severity–occurrence–detection logic adapts to any function, with ranking scales customized to fit.
Function Where Risk-Based FMEA Thinking Applies
Safety Anticipate and eliminate hazards in equipment and product use before an incident occurs
Finance Assess credit or investment risk before extending exposure to a shaky counterparty
Software / IT Catch design and security flaws before release, where bugs can range from nuisances to disasters
Marketing Pressure-test campaigns for offensive or misleading content before launch
HR Bridge the gap between a restructuring plan on paper and its real-world rollout
Purchasing Anticipate problems with equipment options before a major purchase is committed
FMEA & Risk-Based Thinking 13
Key Takeaways
Risk-based thinking is ISO 9001:2015's explicit requirement to determine and address risks and opportunities — FMEA is that
requirement put into practice.
The risk triad — severity, occurrence, detection — turns team judgment into a comparable Risk Priority Number for every
potential failure mode.
Ten structured steps carry a team from brainstorming failure modes to a documented, verified reduction in resulting risk.
The discipline keeps evolving — from RPN cutoffs to Action Priority tables — but the underlying cycle of identify, evaluate,
act, and review stays constant.
ISO 9001:2015 · IATF 16949 · FMEA — Failure Mode and Effect Analysis