Risk management (ISO 31000) and risk-based thinking (ISO 9001)

Risk management (ISO 31000) and risk-based thinking (ISO 9001)

ISO 9001:2015 QMS standard introduced risk-based thinking as an essential part of quality management system. While ISO 9001 QMS standard always advocated mitigating and avoiding risks, in its earlier versions, requirements of preventive action were included that's aim was to prevent or reduce undesired effects. Now with the introduction of risk-based thinking in the quality management system, the organization needs to focus on risk-based thinking and thus implementing risk-based thinking in an organization is a challenge.

It is not necessary to adopt risk management or formal risk-based approach as per ISO 31000:2018 standard for an organization that wishes to implement ISO 9001:2015 QMS standard. Depending on the context of an organization, ISO 31000 family standards may help the organization in taking a 'risk-based approach' to the quality management system, its processes and activities. ISO 31000:2018 standard provides principles and general guidelines on risk management. ISO 31000:2018 standard provides guidelines to adopt formal risk management. Although ISO 9001:2015 QMS standard incorporates risk-based thinking in its requirements. ISO 9001:2015 QMS standard does not mandate adoption of formal risk management as per ISO 31000 standard.

ISO 9001:2015 QMS standard does not prescribe implementing ISO 31000 standard's requirements, however bibliography at the end of ISO 9001:2015 QMS standard includes the reference of ISO 31000 standard.

- Keshav Ram Singhal

Organizations may contact for conducting in-house training program on (i) 'ISO 9001:2015 QMS Awareness', and (ii) 'Applying risk-based thinking.'
Moderate trainer's fee. Customer satisfaction is prime objective.

Risk awareness culture

Risk awareness culture

Risk awareness culture (risk-aware culture) in an organization is helpful in applying risk-based thinking in a proactive way. Build a risk culture in your organization. Risk-aware culture in an organization is a foundation of values. knowledge, beliefs, understanding and communication of the risks associated to the organization's objectives and assets necessary to achieving the objectives. It is a capability of the organization to recognize risks before any threaten, mitigate them when they arise, and recover from the damages they may cause. It is capability present throughout the organization and it is woven into the normal routines, rituals, and behaviors of all persons involved.

To build risk-aware culture in the organization is the leadership (top management) that should demonstrate their leadership and commitment to the management system by collectively establishing core values, policies and procedures for the organization that include risk-based thinking and its awareness. Once the top management has established the foundation for building the risk aware culture, the next step is to share necessary knowledge with the organization's people. This includes written documentation regarding risk and continuous training for risk awareness. The organization should organize a 'Risk Awareness' program (lecture series) from time to time in the organization and motivate all employees to answer the question 'What can go wrong at my desk/job function?' Compile information and address all relevant risk issues. This will facilitate in building a risk culture.

Risk-based thinking must be adopted in every organization.

Decision making should be on the basis risk-based thinking. Define unacceptable to desired in every process. Identify and critically prioritize the mechanisms that can influence the behaviour of employees to adopt risk-based thinking. Enforce risk-based thinking in the organization's activities as usual activities. Leaders (top management) need to continually live and breathe the risk-based culture values.

- Keshav Ram Singhal

Organizations may contact for conducting in-house training programmes on (i) 'ISO 9001:2015 QMS Awareness', and (ii) 'Applying risk-based thinking.'
Moderate trainer's fee. Customer satisfaction is prime objective.