Are FMEA and Risks Registries adequate against Clause 6.1.1?

If 6.1.1 of ISO 9001:2015 requires an organization to determine risks and opportunities, can FMEAs or Risks Registries satisfy the requirement? Bear in mind that both tools only identify the "negative" effects of uncertainty. There is no section or column in both tools that identifies opportunities. There's a column for "action", but is intended to address the identified "negative" effect of uncertainty (i.e. risk).

 

Hi, Tony. It looks like you have answered your own question. If the requirement is to address 'risks and opportunities' and FMEA and risk register are both tools that only help to manage risk then you have some additional work to do for the opportunity piece.

Don't feel you have to force fit this activity into the same process. Most organisations are good at managing opportunities (sales enquiries, OFIs etc.). So long as the organization is managing these activities then you should be able to demonstrate addressing the full requirement.

 

Maybe I'm just overthinking about this, but bear with me. Clause 4.4.1f says "address the risks AND opportunities as determined in accordance with the requirements of 6.1". To address them, clause 6.1 requires the following: determine them (6.1.1), plan the actions to address them (6.1.2a), integrate the actions into the processes (6.1.2b.1).

By using FMEAs and Risks Registries, IMHO, the half-part of the requirements described above (i.e. risks part) are adequately covered. We can easily connect FMEAs to the controls established for the manufacturing processes. The Risks Registries, in the same manner, cover the non-manufacturing processes. But what about the other part (i.e. opportunities part)?

 

Don't you not review the risk register during Management Review to identify Opportunities for improvement? OFI are both in the input and output of MR.

 

There are at least two major clauses in the standard where we are required to determine "opportunities". One is on Clause 6 - Planning and the other is on Clause 9 - Performance Evaluation. One is when "we look forward" and one is when "we look back". Identifying OFIs during management reviews does not, IMHO, satisfy the intent of the standard on determining "opportunities" during the "planning" period.

FMEAs and Risks Registries, on the other hand, are good tools for planning the controls to be established. Hence, FMEA is a requirement during product quality planning for some standards (e.g. IATF/ISO 16949) and its outputs are included in the Control Plans and/or documented procedures/instructions. I'm toying with an idea that there must be an equivalent tool for planning for the controls that is based on the anticipated "opportunities".

 

I think everyone "gets' the risk side of it. It's the opportunities that causes some head scratching. Opportunities are not the same as actions taken in response to risks; they're different. An example: When flushing out the context of the organization, the company notes that it operates in an environment where technology changes rapidly. They employ highly qualified engineers and invest considerably in their training to keep them "cutting edge." An opportunity for the company might be to position their engineers to become active within key industry groups as experts - thereby capitalizing on this knowledge through perceived industry expertise and enhancing the company's reputation. Or, alternatively, to offer their services in a professional services function - voila - there's an opportunity for additional revenue!

Just some thoughts.

 

I agree. Even "opportunities" are required to be addressed by actions (see 6.1.2a).

 

SWOT is a reliable tool for determining strategies or actions to address opportunities on high-level management planning. My question (in another form) is: What could be a reliable tool to determine actions to address opportunities on operational-level planning?

 

PDCA

 

Continuous Risk Management (CRM)
Cause and Effect matrix
What do you think about these?

 

Looking at the columns on FMEA, we cannot clearly see where we can capture the "opportunities" that we need to address in order to produce desirable effects or outputs.

 

I believe actions on addressing failures, their effects and causes are not the same with opportunities. Both risks and opportunities are required to be determined and both are required to be addressed by actions. If we equate opportunities to actions, then why would ISO 9001 need to use the phrase "risks and opportunities". They should instead use "risks and actions".

 

The RBT guidance of ISO/TC 176 may have given supplemental definition of an opportunity but this definition will have to be interpreted with the other definitions given by ISO like in ISO 14001:2015 clause 3.2.11 where "risks and opportunities" is defined as "potential adverse effects (threats) and potential beneficial effects (opportunities)". Here opportunity is considered as an effect - not as a set of circumstance...ISO 9000:2015 defined risk as effect of uncertainty where further guidance was given to note that an effect is a deviation from the expected - positive or negative. Since one of the main intentions of ISO 9001 is to enhance integration with the other standards, a more consistent definition of an opportunity should be provided by ISO.

 

One was defined by a guidance document, the other by a requirement standard. From my perspective it's like "cause/mode" and "effect". Since, in my point of view, risks and opportunities are presented in the standards as ying ang yang, both can have its mode/s, cause/s and effect/s, including action/s.