ISO 9001:2015 QMS standard incorporates risk-based thinking in its requirements. ISO 9001:2015 QMS standard does not mandate formal risk management. An organization can decide whether or not to develop a more extensive risk management methodology, however risk-based thinking is an integral part of ISO 9001:2015 QMS standard. One of the key changes in ISO 9001:2015 QMS standard is to establish a systematic approach to consider risks as integral part of the QMS, rather than to treat 'prevention' as a separate need.
The concept of risk-based thinking was also present in the earlier versions of ISO 9001 standards through requirements for planning, review and improvement. Earlier version, ISO 9001:2008 standard had a clause on preventive action that indirectly included risk-based thinking.
ISO 9001:2015 QMS standard specifies requirements to understand organization's context (clause 4.1) and determine risks as a basis for planning (actions to address risks and opportunities - clause 6.1). Requirements of clause 4.1 together with clause 6.1 depict the application of risk-based thinking to planning and implementing QMS processes. Consideration of risks is integral in ISO 9001:2015 QMS standard. It is now a proactive action, rather than to be reactive.
One of the objectives of a QMS is to function in a preventive environment and now the preventive action, though not present as a requirement, is reflected through risk-based thinking and is inherent to planning, operation, analysis and evaluation activities. Risk-based thinking is the part of the process approach. Risk-based thinking is evident in the following Para and clauses of ISO 9001:2015 QMS standard.
- Introduction - The Para explains the concept.
- Clause 4 - Organization needs to address risks and opportunities in accordance with requirements.
- Clause 5 - Top management needs to (i) promote risk-based thinking, and (ii) ensure determining and addressing the risks and opportunities that can affect conformity of product/service.
- Clause 6 - Organization needs to (i) determine risks and opportunities, (ii) plan actions to address risks and opportunities, and (iii) ensure actions taken (to address risks and opportunities) are in proportionate to the potential impact on product/service conformity.
- Clause 7 - Organization needs to determine and provide necessary resources for the quality management system. Risk is inherent in all aspects of the quality management system, so determining and providing resources is also necessary for determining risks and opportunities and taking actions to address risks and opportunities.
- Clause 8 - Organization needs to manage operational processes. Risk is inherent in all aspects of the quality management system. All operational processes have some risks.
- Clause 9 - Organization needs to analyze and evaluate data and information with regard to the risks and opportunities. Management review includes consideration of the effectiveness of the actions taken to address risks and opportunities.
- Clause 10 - Organization needs to correct / prevent / reduce undesired effects and update risks and opportunities determined during planning.
The risk-based thinking applied in ISO 9001:2015 QMS standard has enabled organization to plan and manage risk on the basis of performance. Clause 6.1 of the standard specifies requirements to plan and address risks and opportunities, however no formal methods or processes are mentioned in the standard. Formal risk management is not mandated in ISO 9001:2015 QMS standard, however an organization can decide its risk management methodology with the help of other guidance or standards. In the bibliography list at the end of ISO 9001:2015 QMS standard, ISO 31000 standard is mentioned that provides principles and guidelines for risk management. ISO 31000:2009 risk management (RM) standard can be helpful in taking a risk-based approach depending on the context of an organization, but necessarily implementing this standard's guidelines is not a requirement of ISO 9001:2015 QMS standard.
- Keshav Ram Singhal
Organizations may contact for conducting in-house training programmes on (i) 'ISO 9001:2015 QMS Awareness', and (ii) 'Applying risk-based thinking.'
Moderate trainer's fee.
Customer satisfaction is prime objective.
No comments:
Post a Comment