ISO 9001:2015
Risk-based thinking
ISO/TC 176/SC 2/N1283
1
Purpose of this presentation
To explain the concept of risk-based thinking in
ISO 9001:2015
ISO/TC 176/SC 2/N1283
2
This presentation
Developed by the ISO subcommittee responsible
for ISO 9001
Available for unrestricted public use
ISO/TC 176/SC 2/N1283
3
What is risk-based thinking?
Risk-based thinking is something we all do
automatically and often sub-consciously to get
the best result
The concept of risk has always been implicit in
ISO 9001 – this edition makes it more explicit
and builds it into the whole management system
ISO/TC 176/SC 2/N1283
Risk-based thinking ensures risk is considered
from the beginning and throughout
Risk-based thinking makes preventive action
part of strategic and operational planning
4
Where is risk addressed in
ISO 9001:2015?
ISO/TC 176/SC 2/N1283
5
Risk-based thinking is in:
Introduction - the concept of risk-based thinking is
explained
Clause 4 - organization is required to determine its QMS
processes and address its risks and opportunities
Clause 5 – top management is required to
̶Promote awareness of risk-based thinking
̶Determine and address risks and opportunities that
can affect product /service conformity
ISO/TC 176/SC 2/N1283
Clause 6 - organization is required to identify risks and
opportunities related to QMS performance and take
appropriate actions to address them
6
Risk-based thinking is in:
Clause 7 – organization is required to determine and
provide necessary resources
Clause 8 - organization is required to manage its
operational processes
Clause 9 - organization is required to monitor, measure,
analyse and evaluate the effectiveness of actions taken
to address risks and opportunities
ISO/TC 176/SC 2/N1283
Clause 10 - organization is required to correct, prevent
or reduce undesired effects and improve the QMS and
update risks and opportunities
Note, risk is implicit whenever suitable or appropriate is
mentioned (clause 7 and 8)
7
Why use risk-based thinking?
Successful organizations intuitively apply risk-
based thinking because it brings benefits that:
improve governance
establish a proactive culture of improvement
assist with compliance
ISO/TC 176/SC 2/N1283
assure consistency of quality of products and
services
improve customer confidence and satisfaction
8
How do I do it?
Identify what your risks are – it depends on
context
Use risk-based thinking to prioritize the way you
manage your processes
ISO 9001:2015 does not require formal risk
management
ISO/TC 176/SC 2/N1283
ISO 31000 Risk management — Principles and
guidelines may be a useful reference for
organizations that want or need a more formal
approach to risk (but its use is not obligatory)
9
How do I do it?
Balance risks and opportunities
Analyse and prioritize your risks
what is acceptable?
what is unacceptable?
Plan actions to address the risks
how can I avoid, eliminate or mitigate risks?
ISO/TC 176/SC 2/N1283
Implement the plan; take action
Check the effectiveness of the action; does it
work?
Learn from experience; improve
10
Conclusions
Risk-based thinking:
is not new
is something you probably do already
is ongoing
ensures greater knowledge of risks and improves
preparedness
increases the probability of reaching objectives
ISO/TC 176/SC 2/N1283
reduces the probability of negative results
makes prevention a habit
11