No risk rating - NC!?

Early this week, a consultant friend told me that a nonconformity was raised against her client because their method for determining risks/opportunities doesn't have criteria for determining the level of risk (i.e. high, medium, low). The CB auditor was looking for factors such as how the severity of the impact and likelihood of the occurrence of risks are measured.

I've actually observed such prescriptive calls of CB auditors, fortunately we know how to push back. For others, like my friend's client, who doesn't want to tussle with CB auditors, will just go along with the prescriptive call and accept the nonconformity finding.

Just want to vent my exasperation and, at the same time, get some two cents (agreeable or dissenting) from the members of this forum.

 

I’m not agree, standard doesn’t require to evaluate level of risk, neither to use some special methodology for the addressing the risks.

 

Yeah. It's really disappointing. CB auditors should at least read the standards. Below are the statements where both ISO 9001 and ISO/TS 9002 clarified the concept on determining risks:

Annex A.4 of ISO 9001:2015:

Although 6.1 specifies that the organization shall plan actions to address risks, there is no requirement
for formal methods for risk management or a documented risk management process. Organizations can
decide whether or not to develop a more extensive risk management methodology than is required by
this International Standard, e.g. through the application of other guidance or standards.​

Section 6.1.1 of ISO/TS 9002:2016:

There is no requirement in ISO 9001 to use formal risk management (in accordance with ISO 31000
[19]) in determining and addressing risks and opportunities. An organization can choose the methods
that suit its needs. IEC 31010[23] provides a list of risk assessment tools and techniques that can be
considered, depending on the organization’s context.​

 

Auditors fall back on what they consider "best practices" instead of using the standard. Auditees frequently don't know the extent of the standard and take auditors commentary as gospel. It takes several cycles before the Auditee will learn to push back.

 

Regarding to auditors, once I heard someone to say.
we see them as Gods and some of them seem feel like that but really....... they are human.

 

Not disagreeing with any of the above but I wonder if the auditor asked how they addressed this clause (from 6.1.2):

Actions taken to address risks and opportunities shall be proportionate to the potential impact on the conformity of products and services.

(emphasis added).

 

There's nothing here that implies determining the level of risk. The same intention is also employed in clause 10.2.1 where it says "Corrective actions shall be appropriate to the effects of the nonconformities encountered".

 

To me that's what a "judgement call" is. We make them every day.