A “Risk Based Based Thinking” Thinking” Model for ISO 9001:2015 Bob Deysher Senior Consultant
©201 !S"# In
%$ Agenda •
&h' i()le(en* Risk Based Thinking+ , &ha* does ISO 9001:2015 re-.ire+
•
&ha* is Risk Based Thinking+
•
&ha* is Risk+
•
&ha* is a si()le Risk Tool+
•
•
/o does i* in*egra*e in*o *he ro$ess A))roa$h+ /o do 'o. (ake Risk Based Thinking a on*in.al ro$ess I()ro3e(en* a$*i3i*'+
4an.ar' 15# 2015
©201 !S"# In
%$2
Agenda •
&h' i()le(en* Risk Based Thinking+ , &ha* does ISO 9001:2015 re-.ire+
•
&ha* is Risk Based Thinking+
•
&ha* is Risk+
•
&ha* is a si()le Risk Tool+
•
•
/o does i* in*egra*e in*o *he ro$ess A))roa$h+ /o do 'o. (ake Risk Based Thinking a on*in.al ro$ess I()ro3e(en* a$*i3i*'+
4an.ar' 15# 2015
©201 !S"# In
%$2
ISO 9001:2015 Risk O))or*.ni*ies % !.ali*' (anage(en* s's*e( and i*s )ro$esses The organi6a*ion shall es*a7lish# i()le(en*# (ain*ain and $on*in.all' i()ro3e a -.ali*' (anage(en* s's*e(# in$l.ding *he )ro$esses needed and *heir in*era$*ions# in a$$ordan$e i*h *he re-.ire(en*s of *his In*erna*ional S*andard% The organi6a*ion shall de*er(ine *he )ro$esses needed for *he -.ali*' (anage(en* s's*e( and *heir a))li$a*ion *hro.gho.* *he organi6a*ion and shall de*er(ine: f8 *he risks and o))or*.ni*ies in a$$ordan$e i*h *he re-.ire(en*s of %1# and )lan and i()le(en* *he
a))ro)ria*e a$*ions *o address *he( 4an.ar' 15# 2015
©201 !S"# In
%$;
ISO 9001:2015 Risk O))or*.ni*ies lanning for *he -.ali*' (anage(en* s's*e( %1 A$*ions A$*ions *o address risks and o))or*.ni*ies %1%1 &hen )lanning for *he -.ali*' (anage(en* s's*e(# *he organi6a*ion shall $onsider *he iss.es referred *o in %1 and *he re-.ire(en*s referred *o in %2 and de*er(ine *he risks and o))or*.ni*ies *ha* need *o 7e addressed *o: a8 gi3e ass.ran$ ass.ran$e e *ha* *he -.ali*' -.ali*' (anage(en* (anage(en* s's*e( $an a$hie3e i*s in*ended res.l*
©201 !S"# In
%$
ISO 9001:2015 Risk O))or*.ni*ies %1%2 The organi6a*ion shall )lan: a8 a$*ions *o address *hese risks and o))or*.ni*ies 78 ho *o: 18 in*egra*e and i()le(en* *he a$*ions in*o i*s -.ali*' (anage(en* s's*e( )ro$esses
4an.ar' 15# 2015
©201 !S"# In
%$5
The Main O7=e$*i3es of In*erna*ional S*andards •
•
To )ro3ide $onfiden$e in *he organi6a*ion>s a7ili*' *o $onsis*en*l' )ro3ide $.s*o(ers i*h $onfor(ing goods and ser3i$es To enhan$e $.s*o(er sa*isfa$*ion
The $on$e)* of “risk” in *he $on*e?* of *he in*erna*ional s*andards rela*es *o *he .n$er*ain*' in a$hie3ing *hese o7=e$*i3es 4an.ar' 15# 2015
©201 !S"# In
%$
&ha* is Risk Based Thinking+
4an.ar' 15# 2015
©201 !S"# In
%$@
&ha* is “RiskBased Thinking”+ •
•
Risk7ased *hinking is so(e*hing e all do a.*o(a*i$all' and of*en s.7$ons$io.sl' The $on$e)* of risk has ala's 7een i()li$i* in ISO 9001 , *he 2015 re3ision (akes i* (ore e?)li$i* and 7.ilds i* in*o *he hole (anage(en* s's*e(
•
Risk7ased *hinking is alread' )ar* of *he process approach
•
Risk7ased *hinking (akes preventive action )ar* of *he ro.*ine
•
Risk is often thought of only in the negative sense. Risk- based thinking can also help to identify opportunities. This can be considered to be the positive side of risk
4an.ar' 15# 2015
©201 !S"# In
%$
&h' Sho.ld I ado)* “Risk Based Thinking”+ •
•
•
•
To i()ro3e $.s*o(er $onfiden$e and sa*isfa$*ion To ass.re $onsis*en$' of -.ali*' of goods and ser3i$es To es*a7lish a )roa$*i3e $.l*.re of )re3en*ion and i()ro3e(en* S.$$essf.l $o()anies in*.i*i3el' *ake a risk 7ased a))roa$h
4an.ar' 15# 2015
©201 !S"# In
%$9
&ha* Sho.ld I Co+ Iden*if' ha* *he risks and o))or*.ni*ies are in 'o.r organi6a*ion , i* de)ends on $on*e?* ,ISO 9001:2015 ill no* a.*o(a*i$all' re-.ire 'o. *o $arr' o.* a f.ll# for(al risk assess(en*# or *o (ain*ain a “risk regis*er” ,ISO ;1000 <“Risk (anage(en* D rin$i)les and g.idelines”8 ill 7e a .sef.l referen$e <7.* no* (anda*ed8
4an.ar' 15# 2015
©201 !S"# In
%$10
&ha* Sho.ld I Co+ <$on*in.ed8 •
Anal'se and )riori*i6e *he risks and o))or*.ni*ies in 'o.r organi6a*ion , what is acceptable? , what is unacceptable?
•
lan a$*ions *o address *he risks , how can I avoid or eliminate the risk? , how can I mitigate the risk?
•
I()le(en* *he )lan – take action
•
he$k *he effe$*i3eness of *he a$*ions – does it work?
•
Eearn fro( e?)erien$e – continual improvement
4an.ar' 15# 2015
©201 !S"# In
%$11
Fe' oin*s *o Re(e(7er Risk Based Thinking G re3en*a*i3e A$*ion Risk Based Thinking is e3er'7od' s 7.sinessH ’
, Risk Based Thinking is no* =.s* *he res)onsi7ili*' of (anage(en* , Risk Based Thinking (.s* 7e$o(e an in*egral )ar* of *he organi6a*ional $.l*.re 4an.ar' 15# 2015
©201 !S"# In
%$12
&ha* is Risk+
Risk is *he )ossi7ili*' of e3en*s or a$*i3i*ies i()eding *he a$hie3e(en* of an organi6a*ion s s*ra*egi$ and o)era*ional o7=e$*i3es% ’
4an.ar' 15# 2015
©201 !S"# In
%$1;
Risk , A Si()le Cefini*ion The 3ola*ili*' of )o*en*ial o.*$o(es% or /o s.r)rised do 'o. reall' an* *o 7e++ 4an.ar' 15# 2015
©201 !S"# In
%$1
ood for Tho.gh* J &h' is Risk like Siss heese+
A.*hor needs *o a$knoledge *ha* *his idea as shon a* *he K!A Mee*ing# Bos*on Session# A.g.s* 201 4an.ar' 15# 2015
©201 !S"# In
%$15
Risk Cefini*ions Risk $an 7e defined 7' *o <28 )ara(e*ers , Se3eri*' •
This is *he Seriousness of *he har(
, ro7a7ili*' •
4an.ar' 15# 2015
This is *he robability *ha* *he har( ill o$$.r
©201 !S"# In
%$1
Risk Assess(en* !.an*i*a*i3e
4an.ar' 15# 2015
©201 !S"# In
%$1@
Risk A$$e)*a7le Regions "enerall' LnA$$e)*a7le
As Eo As “Reasona7l'” ra$*i$al "enerall' A$$e)*a7le 4an.ar' 15# 2015
©201 !S"# In
%$1
Risk Assess(en* !.ali*a*i3e
4an.ar' 15# 2015
©201 !S"# In
%$19
Risk Regis*ers
4an.ar' 15# 2015
©201 !S"# In
%$20
The I()or*an$e of a Risk Regis*er •
•
•
The risk regis*er or risk log 7e$o(es essen*ial as i* re$ords iden*ified risks# *heir se3eri*'# and *he a$*ions s*e)s *o 7e *aken% I* $an 7e a si()le do$.(en*# s)readshee*# or a da*a7ase s's*e(# 7.* *he (os* effe$*i3e for(a* is a *a7le% A *a7le )resen*s a grea* deal of infor(a*ion in =.s* a fe )ages%
4an.ar' 15# 2015
©201 !S"# In
%$21
o()onen*s of a Risk Regis*er
•
•
•
•
•
There is no s*andard lis* of $o()onen*s *ha* sho.ld 7e in$l.ded in *he risk regis*er% So(e of *he (os* idel' .sed $o()onen*s are: Dates: As *he regis*er is a li3ing do$.(en*# i* is i()or*an* *o re$ord *he da*e *ha* risks are iden*ified or (odified% O)*ional da*es *o in$l.de are *he *arge* and $o()le*ion da*es% Description of the Risk: A )hrase *ha* des$ri7es *he risk% Risk Type (business, project, stage): lassifi$a*ion of *he risk: B.siness risks rela*e *o deli3er' of a$hie3ed 7enefi*# )ro=e$* risks rela*e *o *he (anage(en* of *he )ro=e$* s.$h as *i(efra(es and reso.r$es# and s*age risks are risks asso$ia*ed i*h a s)e$ifi$ s*age of *he )lan% Likelihoo of !ccurrence: ro3ides an assess(en* on ho likel' i* is *ha* *his risk ill o$$.r% ?a()les are: EEo N;08!" #-#edium !$%-&'()" *-*igh !+&'(). Se"erity of #ffect: ro3ides an assess(en* of *he i()a$* *ha* *he o$$.rren$e of *his risk o.ld ha3e on *he )ro=e$*%
4an.ar' 15# 2015
©201 !S"# In
%$22
o()onen*s of a Risk Regis*er There is no s*andard lis* of $o()onen*s *ha* sho.ld 7e in$l.ded in *he risk regis*er% So(e of *he (os* idel' .sed $o()onen*s are: •
•
•
•
Counter$easures: A$*ions *o 7e *aken *o )re3en*# red.$e# or *ransfer *he risk% This (a' in$l.de )rod.$*ion of $on*ingen$' )lans% !%ner : The indi3id.al res)onsi7le for ens.ring *ha* risks are a))ro)ria*el' engaged i*h $o.n*er(eas.res .nder*aken% Status: Indi$a*es he*her *his is a $.rren* risk or if risk $an no longer arise and i()a$* *he )ro=e$*% ?a()le $lassifi$a*ions are: $.rren* or ended% O*her $ol.(ns s.$h as -.an*i*a*i3e 3al.e $an also 7e added if a))ro)ria*e%
4an.ar' 15# 2015
©201 !S"# In
%$2;
Risk Regis*ers ?a()le
4an.ar' 15# 2015
©201 !S"# In
%$2
Risk Regis*ers ?a()le
4an.ar' 15# 2015
©201 !S"# In
%$25
In*egra*ing Risk Based Thinking i*h *he ro$ess A))roa$h
4an.ar' 15# 2015
©201 !S"# In
%$2
.r)ose of *he ro$ess A))roa$h The ).r)ose of *he )ro$ess a))roa$h is *o enhan$e an organi6a*ion>s effe$*i3eness and effi$ien$' in a$hie3ing i*s defined o7=e$*i3es% This (eans enhan$ing $.s*o(er sa*isfa$*ion 7' (ee*ing $.s*o(er re-.ire(en*s%
4an.ar' 15# 2015
©201 !S"# In
%$2@
Is This a ro$ess Model in Po.r Organi6a*ion+
4an.ar' 15# 2015
©201 !S"# In
%$2
or does 'o.r ro$ess A))roa$h look like *his+
4an.ar' 15# 2015
©201 !S"# In
%$29
or does 'o.r ro$ess A))roa$h look like *his+
4an.ar' 15# 2015
©201 !S"# In
%$;0
&aterials
&easures
&anpo%er
<&i*h &ha*+8
rocess Suppliers
'nputs
!utputs
Custo$ers
Risks <&ha* an "o &rong+8
ðos
&achine
#n"iron$ent
<&i*h &ha*+8
4an.ar' 15# 2015
©201 !S"# In
%$;1
ro)osed Risk Model
4an.ar' 15# 2015
©201 !S"# In
%$;2
ro)osed Risk Model o).la*ed
Ke Risk Qal.e os* A$*ion lans 4an.ar' 15# 2015
©201 !S"# In
%$;;
ood for Tho.gh* J &h' is Risk like Siss heese+
A.*hor needs *o a$knoledge *ha* *his idea as shon a* *he K!A Mee*ing# Bos*on Session# A.g.s* 201 4an.ar' 15# 2015
©201 !S"# In
%$;
Addressing Risk
4an.ar' 15# 2015
©201 !S"# In
%$;5
In*egra*ing Risk Based Thinking i*h *he ro$ess A))roa$h and CA
4an.ar' 15# 2015
©201 !S"# In
%$;
lanCohe$kA$* The lanCo he$kA$* <CA8 (e*hodolog' $an 7e a .sef.l *ool *o define# i()le(en* and $on*rol $orre$*i3e a$*ions and i()ro3e(en*s% ?*ensi3e li*era*.re e?is*s a7o.* *he CA $'$le in n.(ero.s lang.ages%
4an.ar' 15# 2015
ct
lan
J*o% to i$pro"e ne-t ti$e
J+hat to o J*o% to o it
Check
Do
J Di things happen accoring to plan
JDo %hat %as planne
©201 !S"# In
%$;@
ro$ess Risk CA Model s s e $ o r ) r e h * o h * i 0 n o i * $ a r e * n I
ct In$or)ora*e i()ro3e(en*s as ne$essar'
4an.ar' 15# 2015
IKLTS
lan *he )ro$ess
Do , arr' o.* *he )ro$ess
Check , (oni*or(eas.re )ro$ess )erfor(an$e
©201 !S"# In
%$OLTLTS
I n * e r a $ * i o n 0 i * h o * h e r ) r o $ e s s
;
Manage(en* Re3ie In).* To) (anage(en* shall re3ie *he organi6a*ions -.ali*' (anage(en* s's*e(# a* )lanned in*er3als# *o ens.re i*s $on*in.ing s.i*a7ili*'# ade-.a$'# and effe$*i3eness% The (anage(en* re3ie shall 7e )lanned and $arried o.* *aking in*o $onsidera*ion: a8 *he s*a*.s of a$*ions fro( )re3io.s (anage(en* re3ies 78 $hanges in e?*ernal and in*ernal iss.es *ha* are rele3an* *o *he -.ali*' (anage(en* s's*e( in$l.ding i*s s*ra*egi$ dire$*ion $8 infor(a*ion on *he -.ali*' )erfor(an$e# in$l.ding *rends and indi$a*ors for: 18 non$onfor(i*ies and $orre$*i3e a$*ions 28 (oni*oring and (eas.re(en* res.l*s ;8 a.di* res.l*s 8 $.s*o(er sa*isfa$*ion 58 iss.es $on$erning e?*ernal )ro3iders and o*her rele3an* in*eres*ed )ar*ies 8 ade-.a$' of reso.r$es re-.ired for (ain*aining an effe$*i3e -.ali*' (anage(en* s's*e( @8 )ro$ess )erfor(an$e and $onfor(i*' of )rod.$*s and ser3i$es d8 *he effe$*i3eness of a$*ions *aken *o address risks and o))or*.ni*ies
©201 !S"# In
%$;9
on$l.sions •
•
•
•
Risk Based Thinking is an ele(en* in *he ro$ess A))roa$h Risk Based Thinking is an in).* *o Manage(en* Re3ie Risk Based Thinking is an ele(en* in *he $on*in.al i()ro3e(en* )ro$ess *ha* is fo$.sed on )re3en*ion% Risk Based Thinking has 7e 7e de(ons*ra*ed d.ring a.di*s a risk regis*er is do$.(en*ed infor(a*ion *ha* 3alida*es an organi6a*ion has done Risk Based Thinking%
4an.ar' 15# 2015
©201 !S"# In
%$0
!.es*ions+++
4an.ar' 15# 2015
©201 !S"# In
%$1