No organization is free of uncertainty: changing regulations, supplier failures, the loss of key skills. Recent management system standards have made "risk-based thinking" a core part of planning, instead of waiting for problems to happen.
What is risk?
In international standards, risk is defined as "the effect of uncertainty" on objectives. That effect can be negative — what we usually call a risk — or positive, which we call an opportunity.
ISO 31000, the standard on risk management, explains that an effect is a deviation from what is expected, and that risk is usually expressed in terms of risk sources, potential events, their consequences and their likelihood. Risk is therefore not the event alone, but the event together with its effect on what the organization is trying to achieve.
Risk in ISO 9001: prevention built into planning
ISO 9001 places risk-based thinking at the heart of the quality management system: preventive action is no longer a separate clause but part of routine planning. The standard requires organizations to determine the risks and opportunities that need to be addressed, to plan actions proportionate to their potential impact on the conformity of products and services, and to evaluate the effectiveness of those actions. It does not require a formal method or a documented risk management process, leaving each organization free to choose an approach suited to its size and the nature of its activities.
A practical approach
- Identify: what could prevent us from achieving our objectives or the quality of our services? Reviewing past complaints and incidents, and holding discussions with the people who do the work, both help here.
- Assess: how likely is it, and how severe would the impact be? A simple likelihood × impact matrix often suffices.
- Treat: avoid the risk, reduce it, transfer it or accept it knowingly.
- Monitor: were the actions effective? Have new risks emerged?
ISO 31000 frames these steps with further elements: the process begins by establishing the scope, context and risk criteria, which ensure that everyone rates risks on the same scale, and it is accompanied throughout by communication and consultation with interested parties and by recording and reporting, since risks unknown to the people doing the work are hard to manage.
In a likelihood × impact matrix, each factor is rated on a simple scale of three or five levels, and their intersection in the grid gives the level of risk: high risks are treated first, medium risks are monitored and low risks may be accepted. ISO 9001 lists broader treatment options, including removing the risk source, changing the likelihood or consequences, sharing the risk with other parties, and even taking a calculated risk in pursuit of an opportunity.
The results are usually recorded in a risk register: the risk, its cause, its effect, its rating, the planned treatment, the person responsible and the review date. In technical and design work, failure mode and effects analysis (FMEA) is often used; it rates each potential failure mode by the severity of its effect, the likelihood of its occurrence and the chance of detecting it before it reaches the user.
Examples
A small manufacturer depends on a single supplier for an essential material. The likelihood is moderate; the impact is high because production would stop. Treatment: qualify a second supplier, keep a safety stock and review the situation every quarter. The risk is reassessed once these measures are in place, to confirm that its level has actually fallen.
In a training centre, a major risk may be the absence of the trainer shortly before a scheduled course. The likelihood is moderate; the impact is high, because trainees would travel for nothing and the centre’s reputation would suffer. Treatment: keep a list of qualified back-up trainers, document training materials so that someone other than their author can deliver them, and set up a procedure to inform trainees quickly of any change. An opportunity comes with this risk: documented materials also make it easier to deliver the same course elsewhere.
Don’t forget opportunities
Risk-based thinking is not pessimism. Change can also bring opportunities: a new technology, a new user demand, a possible partnership.
ISO 9001 gives examples of opportunities, such as adopting new practices, launching new products, opening new markets, reaching new customers, building partnerships and using new technology. It is therefore worth asking two parallel questions at every review: what could go wrong, and what could go better if we prepared for it well?
The goal is not to eliminate every risk but to make conscious decisions about them.
Common mistakes
- Turning the risk register into a document prepared for the audit and then forgotten.
- Rating likelihood and impact without shared criteria, so that ratings vary from one person to another.
- Looking only at negative risks and ignoring opportunities.
- Approving treatment actions without an owner, a deadline and an indicator to follow them up.
- Overcomplicating the approach, when a simple, regular method is enough for a small organization.
