Risks in 4.4?

Hi everybody
First of all, happy new year 2018, best wishes for all of you.

At addressing risks, the standard refers 6.1, "when planning for the quality management system, the organization..." .
But I wonder why doesnt consider 4.4, where are defined processes, procedures, resources,etc.?
In this clause (4.$) it seems it considers a wider aspects in a system, than just planning (6.1).

Somewhere I read that planning in a QMS, it is an activity for the planning a job, e.g. the planner plans a production, using which is named a "traveler plan", where is defined the activity, the responsible, the check points, etc.

But there are other processes, in which there are not planning, they just do the daily activities (Purchasing process) to follow-up of the purchase orders and other minor activities.

So could someone explain, strictly what means "planning", if it seems the most important activities of the processes are carried out in 4.4?

Thanks

 

According to ISO/TS 9002:2016 clause 6.1.1:
"The intent of this subclause is to ensure that WHEN PLANNING THE quality management system PROCESSES, the organization determines its risks and opportunities and plans actions to address them. Its purpose is to prevent nonconformities, including nonconforming outputs, and to determine opportunities that might enhance customer satisfaction or achieve an organization’s quality objectives."

That would mean - we should Plan for the Processes.

There are at least two types of planning i.e. Strategic and Operational according to ISO/TC 176/SC 2/N 1283. See their earlier presentation below:


Clause 6.1.1 covers both types of planning. The actions to address risks/opportunities determined through the use of planning tools such as SWOT (for strategic level) or Risk Registers/FMEA (for operational level) should be incorporated into the processes as per 6.1.2b.1 and be implemented as per 8.1.

 

Thanks Tony and Andy,it is clear now.

 

Tony s, In the short time past I have been implementing the risk, by using
method PxI, but have seen is not the right approach, because sometimes is qualitative in other times it seems quantitative, since I consider a number to rank the risk, Low = 3, medium= 10,etc., Im not fully satisfied, other point I dont like it, is at closing the risk, the residual risk sometimes
it falls in the line of medium and low and exist some doubt regarding if will be closed or not.
Sometimes you proposed an easier method to address the risk (very simple) could you tell us when risk is addressed and taken into account, how o what method you follow to close out the risk, do you use the "residual risk " term , before is closed out?
and what criteria you follow to consider or not a risk (low or high?)
and if it is low, do you consider it? or is only monitored ? and what method is used for the monitoring?

Could you be so kind to explain in detail your approach or maybe to share the procedure you follow?

As always, thanks for all

 

What I do is just determine the risks/opportunities in every process. I don't need to assess the level (i.e. high, medium, low). Then I just determine the actions to address them.

 

T

Thanks
But what is your criteria for the closeout, when do you close it? do you expect to lower the risk before is closed?
Do you apply some monitoring in risk with low value? and when is low value, what is your decision(accept, monitoring, avoid,etc?

Thanks

 

The standard requires organizations to evaluate the effectiveness of the actions to address risks/opportunities. Evaluation can be done during the internal audit and management review. All you need is to verify whether the actions are already implemented and effective (i.e. planned activities are realized and planned results are achieved).

 

Thanks Tonys
Don't you think is better to do the evaluation in the daily activities and determine effect iveness, and in the MR just to comment final results?

 

If you have the time for it, then you can evaluate effectiveness on your daily activities. Clause 6.1.2b.2 doesn't prescribe any time line on when evaluations are to be taken.

 

Thanks Tonys
I like the way You address rísks, very simple and practical.