Risky Business Standalone ISO9001:2015 Risk-Based Thinking and Integration of Risk Management with ISO9001:2015

Presenters Clark Leiphart Senior Quality Engineer, Modular Mining Christina Cook, J.D. Manager, Global Commercial Operations, Modular Mining.

Outline Definitions Simple Method for using risk with ISO9001 More Comprehensive Method for using ISO31000 risk principles Tools and further research

Risk –Definitions PMI: An uncertain event that, if it occurs, has a positive or negative effect on a project’s objectives. ISO9000: risk: effect of uncertainty Note 1 to entry: An effect is a deviation from the expected — positive or negative. Note 2 to entry: Uncertainty is the state, even partial, of deficiency of information (3.8.2) related to, understanding, or knowledge of, an event, its consequence, or likelihood. Note 3 to entry: Risk is often characterized by reference to potential events (as defined in ISO Guide 73:2009, 3.5.1.3) and consequences (as defined in ISO Guide 73:2009, 3.6.1.3), or a combination of these. Note 4 to entry: Risk is often expressed in terms of a combination of the consequences of an event (including changes in circumstances) and the associated likelihood (as defined in ISO Guide 73:2009, 3.6.1.1) of occurrence. Note 5 to entry: The word “risk” is sometimes used when there is the possibility of only negative consequences.

Risk –Definitions and Assumptions ISO9001 Assumptions: The concept of risk has always been a component of ISO 9001 and ISO 14001, by requiring the organization to plan its processes and manage its business to avoid undesirable results. Organizations have typically done this by putting greater emphasis on planning and controlling processes that have the biggest impact on the quality of the products and services they provide. The way in which organizations manage risk varies depending on their business context (e.g. the criticality of the products and services being provided, complexity of the processes, and the potential consequences of failure)

Risk –Definitions and Assumptions ISO31000 Assumptions: Risk management is a central part of the strategic management of any organization. It is the process whereby organizations methodically address the risks attached to their activities. This is a process-based approach: 9001 Nomenclature 31000 Nomenclature Plan Design Do Implement Check Monitor Act Improve

9001:2015 Risky Excerpts Context of the Organizations Clause 4.4 f) - QMS and its processes - determine the risks and opportunities in accordance with the requirements of 6.1.1 (see below) and plan and implement the appropriate actions to address them Leadership Clause 5.1.1d) promoting the use of the process approach and risk based thinking Clause 5.1.2 b) Customer Focus - the risks and opportunities that can affect conformity of products and services…..

9001:2015 Risky Excerpts Planning Clause 6.1.1 & 6.1.2 - Actions to address risk and opportunities.. proportionate to the potential impact….. Operation 8.1 Operational planning and control - review the consequences of unintended changes taking action to mitigate any adverse effects, as necessary

9001:2015 Example Combining Management Review, Auditing and Corrective/Preventive Action Systematically As a part of Management Review, we deal with opportunities and problems on the basis of a simple model: Risk / Consequence High Med Low Vote

9001:2015 Example Management Review – Within each area of the agenda, order items on the basis of risk, and assure adequate assignment of resources. ISO 9001 Customer Feedback (ticket surveys, escalations, customer visits, and field campaigns) ISO 9001 Process and Product Conformity(risk based) ISO 9001 Audit Planning and Results-(risk based) ISO 9001 Update on status of Corrective and Preventive Actions(risk based) ISO 9001 Risk Assessment and Management based on results of 1-4(prioritized) Changes to the ISO9001 quality management system and recommendations for QMS improvement Review/Follow Up on Prioritized Action Items

9001:2015 Example Auditing

9001:2015 Example CAPAs

31000 Risky Excerpts Establishing the context Risk Identification Risk Analysis Risk Evaluation Risk Treatment Periodic Monitoring and Review

31000 Risk Template

31000 Risk Template

9001:2015 and 31000 Examples Concluding Thoughts Even though 9001:2015 does not REQUIRE a formal risk management methodology, there is an opportunity to consistently use risk management throughout a company, on products and services offered to customers, as well as on internal operational processes. The integration and management of risk across the organization should yield an increase in operational efficiency and a common internal vocabulary to pursue opportunities and reduce unintended consequences.

Links and References To be added before uploading to ASQ0707