Risk treatment approach for context and Interested parties?

Hi everybody

In doing the risk analysis in 4.1 and 4.2, following 6.1, which says we have to
identify Risk and opportunities in internal/external issues additionally in Interested
parties.

I have identified in context (Int/Ext issues) people, competitors and clients,
but also have found the same in interested parties, but also have detected that in some
cases the actions are the same for the treatment.

People
A In context, people, Risk= people left the company, poor competency
B In interested parties, Risk= Do not comply people with requirements, law benefits, payments on
time, etc.
Treatment
A, here I have to evaluate what to do, so that people dont leave the company.
B. here, I have to take actions to cover the people´s needs.
It seems they are different actions, Ok?

Competitors
In context, Risk= Lowering my sales
In interested parties = requirements, Dont know what may apply
Dont know what treatment to apply

Clients

C- In context, clients, Risk and opportunities= Risk for not delivering good products and opportunity to have more profits.
D- In interested parties, clients, Risk = to not comply with good products and services, DOT,etc

Treatment
C = to apply actions to ensure good products to clients and actions to get more profits
D =to apply actions to improve my DOT and to improve quality.

I noticed Actions are the same.

Questions

1- Do you think are ok my assumptions ?
2- Are there cases where the treatment is the same for the same aspect (e.g. clients)
for context and interested parties?

Please feed me back.

 

Problem is that this context and risk stuff is all ivory tower academic MBA type stuff. Not much for the rank and file actually running the business every day. I agree, don't over complicate it.

 

Thanks
Andy And Golfman

Please explain why do you think is over complicated?
I´ll really appreciate your input

I know you are people with a lot of experience in this field, I really have little experience, and according to some training I ve had and browsing on the web, is the knowledge I have.

According to what the Standards stress, to Identify context and interested parties
and that based on some of issues found, we have to develop the strategic direction (high level view)

So, don´t you think that addressing these issues with no too much importance we may miss
aspects which really could affect a business?

In the case I proposed, specifically what would you do at addressing Risk and opportunities?

Thanks

 

The standard does not require us to analyze risks on 4.1 and 4.2. It requires us to understand 4.1 and 4.2. Once we have a good grasp of the context of the organization and needs/expectations of interested parties, this understanding will help us "when planning for the QMS" (i.e. 6.1.1). At high level planning, organizations can use tools like SWOT analysis (see 4.1 and 6.1.1 of ISO/TS 9002:2016). In SWOT analysis, the internal issues are usually identified at the Strengths and Weaknesses, while the external issues are identified in the Opportunities and Threats. Typically, organizations can establish their "strategic directions" by using this risk-based thinking tool.

Then, as one of the planning outputs, measurable quality objectives can then be established to support the high-level strategic directions (see 5.1.1b). These objectives should be developed with the needs/expectations of the interested parties in mind (see 6.2c). This approach can already satisfy the requirements in 4.1, 4.2 and 6.1.1. and completes the first part of planning - i.e. at the strategic level.

On the operational planning part, RBT can be utilized by using tools like FMEA or a simple Risk Register. Each process can then be analyzed for risks and opportunities in order to determine the controls/actions to ensure that NCs or nonconforming outputs are prevented from happening (see 6.1.1 of ISO/TS 9002). Once the controls/actions are determined, you have to integrate them into your processes (see 6.1.2 and 4.4.1f). Some controls will be specified into your documented procedures. Some will be installed physically.

I based this RBT approach for QMS Planning from the previous guideline i.e. ISO/TC 176/SC 2/N1283 where one of its slides mentioned:

 

Thanks Tonys
But according to the standard (below) specifically states, consider issues 4.1
and requirements in 4.2 and determine RYO and you say that "dont Require us to analyze"

At the en of the first paragraph, you say "Typically, organizations can establish their "strategic directions" by using this risk-based thinking tool".

Dont understand well, first you say it is not necessary and afterwards it is needed.

could you explain a little bit more?

To determine risk in 4.1 and 4.2 or only in planning?

Im I interpreting the standard in the wrong way?

Thanks

6.1.1 When planning for the quality management system, the organization shall consider the issues
referred to in 4.1 and the requirements referred to in 4.2 and determine the risks and opportunities that
need to be addressed to:
a) give assurance that the....

 

Thanks Jenni


Maybe Im not doing the question correctly

I´ll explain:
I already have 9001:2008 and go to 2015
I already have the 4.1 ( a list) I used SWOT (internal/external issues) positive and negative, where O and S are my positive and T and W are my negative.
Also have defined my interested parties (internal and external)
Next I´ll start to detect R&O, additionally I implemented a procedure to manage the risks and opportunities by using Ishikawa.
My plans is to start the risks detection in issues (4.1) one by one,e.g. ext/Client, goverment,economical,suppliers,etc., Int/ employees, Top management,etc.

Then detection in interested parties (one by one),e.g. clients, suppliers,insurance,etc.

Then to detect R&O in Processes, e.g. (Sales, Purchasing),etc.

All detected risk will have its proper analysis with mitigation plans, and registered in a master lists.

So the direct question is:

Should I do the risk detection in 4.1 then in 4.2, then processes?
Or only in processes according what Tony s Recommended considered 4.1 and 4.2 as a reference ?

I ´d suppose that at doing the risk detection in 4.1 and 4.2, most of the risks in processes could be covered when they be analysed, and maybe more effectives because are risk in high level.

As an example: if I analyze as negative in SWOT OTD, maybe would need strong mitigation plans in all the processes, compared if OTD is considered in one process, maybe will be addresses as a minor problem.
is my thought.


Hope I have explained well

Thanks

 

There it is! 6.1.1 started the statement - "WHEN PLANNING FOR THE QUALITY MANAGEMENT SYSTEM...". Thus, if you are planning STRATEGICALLY - you can use RBT tools like SWOT. Then, if you are planning OPERATIONALLY - you can use FMEA or Risk Registers.

SWOT analysis will already satisfy 4.1 since internal issues can be included in the Strengths and Weaknesses, while external issues can be included in the Opportunities and Threats. By using SWOT, you can establish your organization's "strategic directions". Quality objectives can then be set to support the strategic directions. However, when you are establishing your quality objectives, you should always consider 4.2. This approach will help you in satisfying 6.1.1.

To help in satisfying 6.1.2, I use tools like FMEA or Risk Registers during operational planning. The actions/controls determined by using these tools are incorporated into the processes.

The standard does not require.

See clauses 4.4.1f, 6.1.1 and 6.1.2b.1 including 10.2.1e - to establish a sound answer. Notice also that these risks/opportunities/actions are determined/updated during "planning" (6.1.2 starts the statement "The organization shall plan..." and 10.2.1e specifies "update risks and opportunities determined during planning...")

 

Thanks Tony s

I really appreciate your patience, but still a doubt, if In SWOT I detected threats and weaknesses, why not to analyze them with FMEA or other tool? you say is not required, if it is clear those are important negative issues?
Or when will be analyzed



Thanks

 

Tonys

Or the risk detected in Interested parties, when will be analyzed?

Thanks

 

Don't need to analyze the Threats and Weaknesses further. You should act on them. "Threats" in the SWOT analysis is equivalent to "risks". I based this assumption from the definition of section 3.2.11 of ISO 14001:2015 of "risks and opportunities" i.e. "potential adverse effects (threats) and potential beneficial effects (opportunities)".

Actually, the standard requires us to understand the needs and expectations of interested parties (see 4.2). Thus, "when planning for the QMS" (see 6.1.1), risks and opportunities that need to be addressed to fulfill these needs and expectations should be determined. To satisfy this, the RBT tools (e.g. FMEA) for OPERATIONAL planning (see 6.1.2) come in handy.

 

Thank you so much, Tony s, have received much of help from all of you.

 

Not to hijack, but schooling and training programs are quickly being ramped back up. We have at least 19 high schools in my area that have some type of machining program. With more developing them. Also community colleges are ramping up. The real issue is the students to fill them. Back to your regular programming.

 

That's really nice for a senior high program. I just hope we have those in my country.