ISO 9001:2015 – Implementing

Risk Based Thinking

Denis J. Devos [Link]
Advisor
Devos Associates Inc.
(519) 476-8951
Denis@[Link]
[Link]

25th Annual ASQ Audit Division Conference: The Peabody Memphis

 Goal of this Session

• Discuss the new requirements for Risk

Based Thinking
• Introduce Quantitative and Qualitative
approaches to process risk
• Introduce a simple qualitative approach
to Risk Assessment

Devos Associates
Advisors to Industry
25th Annual ASQ Audit Division Conference: The Peabody Memphis
Risk – It’s Obvious!

Devos Associates
Advisors to Industry
3
Risk is the Boogeyman

Devos Associates
Advisors to Industry
25th Annual ASQ Audit Division Conference: The Peabody Memphis
 ISO 9001 Risk Definition

Effect of uncertainty
ISO 9000:2015 3.7.9

Effect of uncertainty on objectives

ISO 31000:2009 2.1

Devos Associates
Advisors to Industry
25th Annual ASQ Audit Division Conference: The Peabody Memphis
 Requirements Related to Risk
5.1.2 Top Management shall demonstrate leadership
and commitment with respect to customer focus by
ensuring that:
b.) Risks & opportunities that can affect conformity
of products/services and the ability to enhance
customer satisfaction are determined & addressed

4.4.1 The Organization shall determine the processes

needed for the QMS and their application
throughout the organization and shall determine ...
e.) The risks and opportunities in accordance with
6.1 and plan and implement the appropriate
actions to address them Devos Associates
Advisors to Industry
25th Annual ASQ Audit Division Conference: The Peabody Memphis
 Requirements Related to Risk
6.1.1 When Planning for the QMS, the organization shall
consider the issues referred to in 4.1 (Understanding
the Organization and its Context), and 4.2
(Understanding the Needs of Interested Parties)
and determine the risks and opportunities that
need to be addressed to:

a.) Give assurance that the QMS can achieve its

intended results

b.) Prevent, or reduce, undesired effects

c.) Achieve Continual Improvement

Devos Associates
Advisors to Industry
25th Annual ASQ Audit Division Conference: The Peabody Memphis
 Requirements Related to Risk
6.1.2 The organization shall plan:

a.) Actions to address these risks & opportunities

b.) How to:

• Integrate & implement actions into
its QMS processes
• Evaluate the effectiveness of these actions

Actions taken to address risks and opportunities

shall be proportionate to the potential impact on
the conformity of products and services
Devos Associates
Advisors to Industry
25th Annual ASQ Audit Division Conference: The Peabody Memphis
 Requirements Related to Risk
9.3.1 Top Management shall review the organization’s
QMS at planned intervals, to ensure its continuing
suitability, adequacy and effectiveness
The Management Review shall be planned and
carried out taking into consideration:

d.) The effectiveness of actions taken to address

Risks and Opportunities (see 6.1)

Devos Associates
Advisors to Industry
25th Annual ASQ Audit Division Conference: The Peabody Memphis
 Requirements Related to Risk
6.1.2 NOTE:

Options to address risks/opportunities can include

• Avoiding Risk
• Taking Risk in order to pursue an opportunity
• Eliminating the Risk source
• Changing the likelihood or consequences
• Sharing the Risk
• Retaining Risk by informed decision

Devos Associates
Advisors to Industry
25th Annual ASQ Audit Division Conference: The Peabody Memphis
 Risk Requirements - Guidance
Its clear that Risk-Based-Thinking has to begin with
Top Management

• Clause 5.1.2 – Risks to Products/Services and

Customer Satisfaction have to be determined
and addressed.

• Clause 9.3.1 – Circle back via the Management

Review to assess the effectiveness of actions
taken to address Risks and Opportunities.

Devos Associates
Advisors to Industry
25th Annual ASQ Audit Division Conference: The Peabody Memphis
 Risk Requirements - Guidance
Its clear that Risk-Based-Thinking has to be
embedded in the Processes

• Clause 4.4 – Determine Risks and Opportunities

at the process level as processes are defined
and then take appropriate actions to address
• Clause 6.1 – Consider Organizational context
(vision and strategy) and the needs of
stakeholders to identify risks to the business and
mitigate them.

Devos Associates
Advisors to Industry
25th Annual ASQ Audit Division Conference: The Peabody Memphis
 Levels of Organizational Risk
• Enterprise Risk
• Regulatory environment
• Market/Competitors Risk
• Financial, Access to Capital Risk
• Product Risk
• Product Safety
• Early Failures, Reliability
• Operational Process Risk
It’s important to consider the above based on the
type of business you are in. (The Organization
and its Context, and needs of Interested Parties)
Devos Associates
Advisors to Industry
25th Annual ASQ Audit Division Conference: The Peabody Memphis
 Enterprise Risk - SWOT
Strengths Strengths

People love our products People love our products

We have strong supplier partners We have strong supplier partners
Strong Marketing Division Strong Marketing Division
We have great managers, We have great managers,
engineers engineers

Strengths Threats

People love our products Gov’t sales of new spectrum

We have strong supplier partners New lower EMI requirements
Strong Marketing Division Downward pressure on prices
We have great managers, Market shift to touchscreen tech.
engineers Lack of credit to upgrade capacity

Advisors to Industry
 Product Opportunity and Risk
Opportunity Risk

Lift Higher than Safety - unit

any competitor can tip over

New Colours Colours can

And Decals fade, not look
good, decals
wear off

Devos Associates
Advisors to Industry
25th Annual ASQ Audit Division Conference: The Peabody Memphis
 Operational Controls
What are operational controls?
• What should they be?
• Where should they be?
• How big should they be?

We know that Operational Controls are

appropriate when they are derived by
and proportional to, RISK

Devos Associates
Advisors to Industry
25th Annual ASQ Audit Division Conference: The Peabody Memphis
Risk Assessment - Quantitative
There are a number of approaches to assessing risk
quantitatively.

• Failure Modes and Effects Analysis (FMEA)

considers the “three dimensions” of risk,
Severity, Probability of Occurrence, and
Effectiveness of Detection, in order to
quantitatively prioritize risks for attention
• Risk Matrix is simpler, which requires less detail
and considers only Probability and Severity.

Devos Associates
Advisors to Industry
25th Annual ASQ Audit Division Conference: The Peabody Memphis
 Risk Model - FMEA
Failure Modes and Effects Analysis
• Severity of the Failure (scale of 1-10)
• Probability of Occurrence (scale of 1-10)
• Effectiveness of Detection/Mitigation (1-10)

Zone 1 – Zone 2 – Zone 3 – Zone 4 –

What can go Cause? How Will we Detect Do we need
Wrong – How likely is it to it if it Devos
improvement Associates
Advisors to Industry
Severe is it? happen? happens? actions?
 Risk Model - FMEA
Consider creating an FMEA for every process
identified in your QMS.
• Processes will be defined in accordance with
Clause 4.4 of ISO 9001:2015. Flow charts are the
preferred approach
• Complete the header of the FMEA with the name
of the process, the process owner, date, etc.
• PFMEA is most effectively accomplished with a
small team. Convene a small team along with a
customer and supplier of that process.

Devos Associates
Advisors to Industry
25th Annual ASQ Audit Division Conference: The Peabody Memphis
 Risk Model - FMEA
Advantages
• Three Dimensions of Risk
• Failure Modes and Scoring on the same lines
• Quantitative, Scored
• Detailed and Rigorous

Disadvantages
• Quantitative, Scored
• Detailed and Rigorous

Devos Associates
Advisors to Industry
25th Annual ASQ Audit Division Conference: The Peabody Memphis
 Risk Assessment - Quantitative
Another Approach is to use a Risk Matrix
• A two-dimensional chart plotting failure severity
against likelihood of occurrence. Current
Detection controls are not considered.
• 3 by 3 matrices can be used, but a 5 by 5 matrix is
more common. Increasingly significant events are
weighed more heavily than the last.
• As with FMEA, likelihood is the net result of the
cause event and corresponding prevention
controls

Devos Associates
Advisors to Industry
25th Annual ASQ Audit Division Conference: The Peabody Memphis
 Risk Matrix

4
2
1

Devos Associates
Advisors to Industry
25th Annual ASQ Audit Division Conference: The Peabody Memphis
 Risk Matrix - Worksheet

6 7 8 9 10 11

Devos Associates
Advisors to Industry
25th Annual ASQ Audit Division Conference: The Peabody Memphis
 Risk Assessment - Qualitative
Unlike the Quantitative approach, a qualitative
approach is based more on “gut feel” and does not
follow a scoring guideline for determining where risk
mitigation is required.

• This presentation uses a “Risk Assessment Table”

as a way of capturing the thoughts and decisions
of the group performing the assessment
• This is the simplest approach, but the lack of
numerical rankings can result in high inconsistency
between groups performing assessments.

Devos Associates
Advisors to Industry
25th Annual ASQ Audit Division Conference: The Peabody Memphis
25th Annual ASQ Audit Division Conference: The Peabody Memphis
 Risk Assessment Table

4 5 6
3
2

Advisors to Industry
 Risk Assessment Table
The following briefly describes what belongs in each
area of the Risk Assessment Table
1. The header includes the process name, the needs
of interested parties, and other information. Each
process of the QMS should be examined for Risk
2. Steps of the process (from the flowchart) should be
listed here. Each step in the process can be
examined for Risk
3. In order to aid in the analysis, categories such as
“5M” can be considered.

Devos Associates
Advisors to Industry
25th Annual ASQ Audit Division Conference: The Peabody Memphis
 Risk Assessment Table

4. The group considers Risks for such categories as

Man (people), Materials, Methods, Machines,
Measurement etc. and lists them in this column.
5. Current Controls are those aspects of the process
that are already in place to mitigate the risks in the
prior column
6. The last column lists the results of the review for that
line and any actions that are decided upon for
reducing Risks.

Devos Associates
Advisors to Industry
25th Annual ASQ Audit Division Conference: The Peabody Memphis
 Risk Examples – Man (People)
• Lack of Skill/Experience
• Not enough people in place to do the job(s)
• No back-up person if the main person is on
vacation
• No Succession planning for key positions
• Security concerns such as key cards for office
doors, computer passwords, etc.
• Police Checks, Background checks for people in
key positions
• Recruiting methods that may not identify the best
candidates for new jobs
Devos Associates
Advisors to Industry
25th Annual ASQ Audit Division Conference: The Peabody Memphis
 Risk Examples – Materials
• Running out of Raw Materials
• Losses due to shrinkage or disorganized warehouse
• Supply chain risks such as supplier capacity
• Supply chain risks such as long lead times for
overseas suppliers etc.
• No back-up sources of supply for critical materials
• Poor quality of raw materials
• Lack of critical office supplies
• Distribution risks for finished goods

Devos Associates
Advisors to Industry
25th Annual ASQ Audit Division Conference: The Peabody Memphis
 Risk Examples – Methods
• Lack of defined work Standards
• Lack of enforcement of Standards
• Methods that lead to poor outcomes
• Lack of contingency planning – defined reaction
plans that are invoked when things go wrong
• Methods that are cumbersome or not user-friendly
• Lack of validation of Methods to prove that they
are the most effective method
• Inefficient methods

Devos Associates
Advisors to Industry
25th Annual ASQ Audit Division Conference: The Peabody Memphis
 Risk Examples – Machines
• Lack of state-of-the-art machinery leads to
competitive disadvantage
• Lack of capability of machines
• Lack of maintenance of machines
• Lack of machine capacity
• Lack of machine/workplace safety
• Lack of IT, software, computer infrastructure
• Lack of workplace infrastructure such as desks,
telephones, proper lighting, ergonomics etc.

Devos Associates
Advisors to Industry
25th Annual ASQ Audit Division Conference: The Peabody Memphis
 Risk Examples – Measurement
• Insufficient inspection of outputs such as products
or service outcomes
• Insufficient measurement devices for the above
• Lab/Inspection calibration risks
• Lack of follow-through on tasks and projects
• Lack of performance measurement for key
business processes
• General lack of oversight and periodic review of
processes and outputs, so that effective
management is compromised.

Devos Associates
Advisors to Industry
25th Annual ASQ Audit Division Conference: The Peabody Memphis
 ISO 9001:2015 – Implementing
Risk Based Thinking
Denis J. Devos [Link]
Advisor
Devos Associates Inc.
(519) 476-8951
Denis@[Link]
[Link]

25th Annual ASQ Audit Division Conference: The Peabody Memphis