1. A New Concept for Laboratory Quality Management Systems
The Requirement for Assessing Risks and Opportunities of ISO/IEC 17025: (2017)
Presented by
Lawrence Lagman
Food Testing Program Manager
Lead Assessor

2. Perry Johnson Laboratory Accreditation, Inc.
ISO/IEC 17025:(2017)
The newest clause added to the standard, is one covering risks and opportunities associated with the laboratory activities.
7/21/2019
Perry Johnson Laboratory Accreditation, Inc.

3. Perry Johnson Laboratory Accreditation, Inc.
What is a risk?
Definition of Risk
1. : possibility of loss or injury
2. : someone or something that creates or suggests a hazard
3. a : the chance of loss or the perils to the subject matter of an insurance contract; also : the degree of probability of such loss
b. : a person or thing that is a specified hazard to an insurer
c. : an insurance hazard from a specified cause or source war risk
4. : the chance that an investment (such as a stock or commodity) will lose value.
Source: Merriam-Webster On-line Dictionary
7/21/2019
Perry Johnson Laboratory Accreditation, Inc.

4. What does the Standard require?
8.5 Actions to address risks and opportunities.
8.5.1 The laboratory shall consider the risks and opportunities associated with the laboratory activities in order to:
give assurance that the management system achieves its intended results;
enhance opportunities to achieve the purpose and objectives of the laboratory;
prevent, or reduce, undesired impacts and potential failures in the laboratory activities;
achieve improvement.
7/21/2019
Perry Johnson Laboratory Accreditation, Inc.

5. What does the Standard require?
8.5.2 The laboratory shall plan:
actions to address these risks and opportunities;
how to:
— integrate and implement these actions into its management system;
— evaluate the effectiveness of these actions.
NOTE: Although this document specifies that the laboratory plans actions to address risks,
there is no requirement for formal methods for risk management or a documented risk management process.
Laboratories
can decide whether or not to develop a more extensive risk management methodology
than is required by this document, e.g. through the application of other guidance or standards. ISO 19600:2014, Compliance management systems -- Guidelines
7/21/2019
Perry Johnson Laboratory Accreditation, Inc.

6. What does the Standard require?
8.5.3 Actions taken to address risks and opportunities shall be proportional to the potential impact on the validity of laboratory results.
NOTE 1: Options to address risks can
include identifying and avoiding threats,
taking risk in order to pursue an opportunity,
eliminating the risk source,
changing the likelihood or consequences,
sharing the risk,
or retaining risk by informed decision.
NOTE 2: Opportunities can
lead to expanding the scope of the laboratory activities,
using new technology and other possibilities to address customer needs.
addressing new customers,
7/21/2019
Perry Johnson Laboratory Accreditation, Inc.

7. How are Assessor’s going to Evaluate this element of the Standard?
They are going to look for objective evidence of compliance!
What kind of evidence or records?
What risks and opportunities the Laboratory associated with its activities.
2. What action taken to address the identified risks and opportunities by the laboratory.
3. How the did the laboratory integrate and implement these actions into its management system.
4. How does the laboratory evaluate the effectiveness of these actions.
5. A copy of the risk assessment.
7/21/2019
Perry Johnson Laboratory Accreditation, Inc.

8. Perry Johnson Laboratory Accreditation, Inc.
Risk Management
7/21/2019
Perry Johnson Laboratory Accreditation, Inc.

9. Risk Management, What is it?
the identification, assessment, and prioritization of risks (defined in ISO as the effect of uncertainty on objectives) followed by coordinated and economical application of resources to
Risk management is
minimize, monitor, and control the probability and/or impact of unfortunate events or to maximize the realization of opportunities.
7/21/2019
Perry Johnson Laboratory Accreditation, Inc.

10. Perry Johnson Laboratory Accreditation, Inc.
Risk Assessment
Risk assessment is the determination of quantitative or qualitative estimate of risk related to a well-defined situation and a recognized threat (also called hazard). Quantitative risk assessment requires calculations of two components of risk (R): the magnitude of the potential loss (L), and the probability (p) that the loss will occur.
7/21/2019
Perry Johnson Laboratory Accreditation, Inc.

11. Risk Assessment Methods
7/21/2019
Perry Johnson Laboratory Accreditation, Inc.

12. RISK ASSESSMENT METHODS
1. Use a what-if analysis to identify threats and hazards.
What-if questions are asked about what could go wrong and about what would happen if things do go wrong. This type of analysis is a brainstorming activity and is carried out by people who have knowledge about the areas, operations, and processes that may be exposed to hazardous events and conditions.
7/21/2019
Perry Johnson Laboratory Accreditation, Inc.

13. RISK ASSESSMENT METHODS
2. Use a checklist of known threats and hazards to identify your threats and hazards
The value of this type of analysis depends upon the quality of the checklist and the experience of the user.
7/21/2019
Perry Johnson Laboratory Accreditation, Inc.

14. RISK ASSESSMENT METHODS
3. Use a hazard and operability study (HAZOP) to identify your threats and hazards.
If you need to do a thorough analysis, this method is for you. However, it requires strong leadership and is costly and time consuming. It also assumes that you have a very knowledgeable interdisciplinary team available to you, one with detailed knowledge about the areas, operations, and processes that may be exposed to hazardous events and conditions.
7/21/2019
Perry Johnson Laboratory Accreditation, Inc.

15. RISK ASSESSMENT METHODS
4. Use a failure mode and effect analysis (FMEA) to identify potential failures and to figure out what effect failures would have.
This method begins by selecting a system for analysis and then looks at each element within the system. It then tries to predict what would happen to the system as a whole when each element fails. This method is often used to predict hardware failures and is best suited for this purpose.
7/21/2019
Perry Johnson Laboratory Accreditation, Inc.

16. RISK ASSESSMENT METHODS
5. Use a fault tree analysis (FTA) to identify all the things that could potentially cause a hazardous event.
It starts with a particular type of hazardous event and then tries to identify every possible cause.
7/21/2019
Perry Johnson Laboratory Accreditation, Inc.

17. The Assessment Process
7/21/2019
Perry Johnson Laboratory Accreditation, Inc.

18. Comprehensive risk assessments:
Identify the range of hazards, threats, or perils:
identify the hazards, threats, or perils that impact or might impact your organization.
Identify the hazards, threats, or perils that impact or might impact your infrastructure.
Identify the hazards, threats, or perils that impact or might impact the surrounding area.
7/21/2019
Perry Johnson Laboratory Accreditation, Inc.

19. Comprehensive risk assessments:
Determine the potential impact of each hazard, threat, or peril by:
Estimating the relative severity of each hazard, threat, or peril.
Estimating the relative frequency of each hazard, threat, or peril.
Estimating the vulnerability to each hazard, threat, or peril.
Estimate how vulnerable your people are to each hazard, threat, or peril.
Estimate how vulnerable your operations are to each hazard, threat, or peril.
Estimate how vulnerable your property is to each hazard, threat, or peril.
Estimate how vulnerable your environment is to each hazard, threat, or peril.
7/21/2019
Perry Johnson Laboratory Accreditation, Inc.

20. Comprehensive risk assessments:
Categorize each hazard, threat, or peril according to how severe it is, how frequently it occurs, and how vulnerable you are.
7/21/2019
Perry Johnson Laboratory Accreditation, Inc.

21. Comprehensive risk assessments:
Develop strategies to deal with the most significant hazards, threats, or perils.
Develop strategies to prevent hazards, threats, or perils that impact or might impact your organization and its people, operations, property, and environment.
Develop strategies to mitigate hazards, threats, or perils that impact or might impact your organizationand its people, operations, property, and environment.
Develop strategies to prepare for hazards, threats, or perils that impact or might impact your organization and its people, operations, property, and environment.
Develop strategies to respond to hazards, threats, or perils that impact or might impact your organization and its people, operations, property, and environment.
Develop strategies to recover from hazards, threats, or perils that impact or might impact your organization and its people, operations, property, and environment.
7/21/2019
Perry Johnson Laboratory Accreditation, Inc.

22. Perry Johnson Laboratory Accreditation, Inc.
Risk Management
7/21/2019
Perry Johnson Laboratory Accreditation, Inc.

23. Perry Johnson Laboratory Accreditation, Inc.
Questions ?
Contact us at:
Perry Johnson Laboratory Accreditation, Inc. 755 W. Big Beaver Rd. Suite 1325 Troy, MI (phone)
Presented by:
Lawrence Lagman
7/21/2019
Perry Johnson Laboratory Accreditation, Inc.