May 2014 - Risk Assessment - Make It Easier Than It Appears
May 2014 - Risk Assessment - Make It Easier Than It Appears
May 2014 - Risk Assessment - Make It Easier Than It Appears
May2014RiskAssessmentMakeitEasierthanitAppears
May2014RiskAssessmentMakeitEasierthanit
Appears
RiskAssessment
MakeitEasierthanitAppears
APISpec.Q19thEditionaddressesthesubjectofriskinClause5.3,RiskAssessmentand
Management.Itisimportanttounderstandthatriskassessmentasaddressedinthissectiononly
appliestoimpactupon:
Deliveryofproduct
Productquality
TheorganizationisresponsibleforimplementingtheserequirementsinordertoconformtoaQ1
qualitymanagementsystem.WhileQ1outlinesthehighlevelrequirementsforthissubject,itdoes
notprovidedetailsabouthowtoimplementit.
Inordertobetterunderstandyourjourneytoimplementation,itisimportanttounderstandthe
circularnatureofQ1.Forexample,thefollowingQ1clausesaredirectlyorindirectlyrelatedtothe
subjectofriskassessment,whetherornottheyhavebeenspecifiedinClause5.3:
3.1.19
DefinitionofRisk
4.5
ControlofRecords
http://www.qualifiedspecialists.com/areyoutrainedintherecentrevisionstoapispecq18thedition/
1/4
16/04/2016
May2014RiskAssessmentMakeitEasierthanitAppears
5.2(d)
Planning
5.4.2(g)
DesignandDevelopmentInputs
5.5
ContingencyPlanning
5.7.8(note)
PreventiveMaintenance
5.10.1
DeliveryofNonconformingProduct
5.11
ManagementofChange
6.5.2(f)
[ManagementReview]InputRequirements
Bibliography
ISO31000,RiskmanagementPrinciplesand
guidelines
AsreferencedintheBibliography,itisimportanttohaveacopyofISO31000,Riskmanagement
Principlesandguidelines(1).WhileISO31000identifiesgenericrequirementsforthe
implementationofariskmanagementsystemthatcouldapplytomostriskbasedsituations,its
contentsarerelevantforunderstandinghowtoapplyariskassessmentculturethatisrelatedto
Clause5.3sintent(i.e.,deliveryofproductandproductquality).
Shownbelow,Figure1outlinesthebasicprinciplesforariskmanagementsystem.Thisstructure
providesasimplisticandunderstandableformatforcontentthatshouldbeincludedinaprocedure
inordertomeettherequirementsofClause5.3.
Figure1
ExcerptfromISO31000(1)
Concurrently,itisimportanttounderstandthereferencestoriskfromothersectionsinQ1.Shown
belowareexcerptsfromtwootherQ1clausesrelatedtoriskassessment.
5.5ContingencyPlanning
5.5.1General
Theorganizationshallmaintainadocumentedprocedureforcontingencyplanningneededto
addressriskassociatedwithimpactondeliveryandqualityofproduct.
Contingencyplanningshallbebasedonassessedrisks(see5.3),andoutputshallbe
documentedandcommunicatedtotherelevantpersonnelandupdatedasrequired.
5.5.2PlanningOutput
Thecontingencyplanshallinclude,ataminimum:
a)actionsrequiredinresponsetosignificantriskscenariostomitigateeffectsofdisruptive
http://www.qualifiedspecialists.com/areyoutrainedintherecentrevisionstoapispecq18thedition/
2/4
16/04/2016
May2014RiskAssessmentMakeitEasierthanitAppears
incidents
5.11ManagementofChange
5.11.3MOCNotification
Theorganizationshallnotifyrelevantpersonnel,includingthecustomerwhenrequiredby
contract,ofthechangeandresidualornewriskduetochangesthathaveeitherbeeninitiatedby
theorganizationorrequestedbythecustomer.
WhileClauses5.5and5.11bothcontainrequirementsrelatedtorisk,theirrequirementsarenot
explicitlyandholisticallymentionedinClause5.3.
ThenotecontainedinClause5.3asquotedbelowisimportantinunderstandinghowto
implementariskassessmentandmanagementprocedure:
NOTERiskassessmentcanincludeconsiderationofseverity,detectionmethods,and
probabilityofoccurrence.
Dependingonyourorganizationsvernacular,thewordsseverityandprobabilitycouldbe
synonymouswiththewordsconsequence(2.18)(1)andlikelihood(2.19)(1)respectively.ISO
31000specifiesthedefinitionsforconsequenceandlikelihood,aswellasnumerousother
definitionsassociatedwithriskmanagement.Thesewordshelpidentifytheboundariesofarisk
event,thedegreetowhichriskcouldbedisruptivetoyourorganization.
Inpartoftheriskassessmentprocess,typically,organizationscreateariskmatrixthatillustrates
consequenceononeaxisandlikelihoodontheotheraxis,whichgeneratesarisknumberthatis
associatedwiththedegreeofsignificanceofariskevent.
ThenoteinClause5.3alsoaddressesdetectionmethods.Whiletheyappeartobeself
explanatory,detectionmethodsmaybefoundinothersectionsofQ1andcouldbeusedtoidentify
howorwhereriskwasinitiallyidentified,forexample:
ControlofNonconformingProduct(e.g.,aproductnonconformancedocumentingamaterial
problem)
InspectionandTesting(e.g.,visualcharacteristicsthatconsiderablydeviatefromacceptance
criteria)
CorrectiveAction(e.g.,adocumentedsuppliernonconformityonacrackedfastener)
PreventiveAction(e.g.,aprocesschangethatrequiresnewanddifferentprocessequipment)
DesignInput(e.g.,adesignchangeduetoafieldfailure)
Planning(e.g.,acustomerorderrequiringtheuseofmaterialsnotusedbefore)
PreventiveMaintenance(e.g.,repetitiveequipmentfailuresforequipmentusedinacritical
process)
OnceyougainanunderstandingofhowtheinterrelatednessofothersectionsinQ1provideinput
totheriskassessmentandmanagementprocess,thedocumentationandimplementationofthe
http://www.qualifiedspecialists.com/areyoutrainedintherecentrevisionstoapispecq18thedition/
3/4
16/04/2016
May2014RiskAssessmentMakeitEasierthanitAppears
processshouldnotbesodaunting.Inshort,alwaysconsider:
HowQ1clausesinterrelatewithotherQ1clauses
HowtheintegrationofabibliographicreferencecanfacilitateconformitytoQ1
1.InternationalOrganizationforStandardizationISO31000,RiskmanagementPrinciplesand
guidelines
OurServices
http://www.qualifiedspecialists.com/areyoutrainedintherecentrevisionstoapispecq18thedition/
4/4