ISO 9001:2015 and Risk Based Thinking

Transcription

1 ISO 9001:2015 and Risk Based Thinking Inc. Advisors to Industry Denis J. Devos P.Eng 1 (519)

2 Goal of this Session Discuss the major changes to the Standard No discussion of TC 176 or subcommittees Knowledge of ISO 9001:2008 is assumed Several small changes are not addressed Commentary and examples throughout 2

3 What s New? New Stuff Same Old Thing 3

4 Effective QMS QMS Should be designed to be auditable, but not designed for the auditor 4

5 Effective QMS Practical & Effective Overall Compliance Checkable, Auditable 5

6 New Clause Layout Annex SL ISO 9001: Quality Management System 5 Management Responsibility 6 Resource Management 7 Product Realization 8 Measurement, Analysis, Improvement ISO 9001: Context of the Organization 5 Leadership 6 Planning 7 Support 8 Operation 9 Performance Evaluation 10 Improvement 6

7 4.1, 4.2, 4.3 Establish context, define relevant interested parties & scope of QMS 10. Continual Improvement 5. Leadership Customers & other relevant interested parties 4.4 QMS General & Process Approach 6. Planning 9. Performance Evaluation Customers satisfaction Requirements Inputs 8. Operations Outputs Products & Services Inc All Rights Reserved 7. Support Processes ISO/DIS 9001:2015 Clause 0.3 ISO/DIS 9001:2015 Clause 0.3 7

8 Significant Changes 1. Redrafting to make the Standard more generic and more easily applicable by service industries Replace Product with Products and Services 2. Context of the Organization 3. Process Approach 4. Risk and Preventive Action Risk Based Thinking concepts are introduced Preventive Action is no longer a clause (8.5.3) No requirement for formal risk management 8

9 Significant Changes 5. Documented Information Terms Document and Record have been replaced throughout by Documented Information 6. Control of External Provision of Goods and Services 7. Organizational Knowledge 8. More emphasis on results 9

10 4. Context of the Organization 4.1 Understanding the Organization and its Context 4.2 Understanding the Needs and Expectations of Interested Parties 4.3 Determining the Scope of the QMS 4.4 QMS and its Processes 10

11 4.1 Understanding the Organization and its Context Determine external and internal issues that are relevant to its purpose and strategic direction Monitor and Review the info. about these issues Consider issues arising from: Legal, technological, competitive, market, cultural, social, economics at all levels Company values, culture, knowledge, performance [Consider an Organizational Profile as MBNQA] 11

12 4.2 Understanding the Needs and Expectations of Interested Parties Determine the interested parties that are relevant to the QMS and the requirements of those parties Monitor and review the information about these parties and their relevant requirements Consider the following examples: Direct Customers End Users Suppliers, distributors retailers or others involved in the supply chain Regulators and others 12

13 Organizational Context - Guidance Product/Service Offerings Vision and Mission Workplace Profile and Physical Assets Regulatory Requirements Organizational Structure Customers and Stakeholders, Supplier Partners Competitive Position, Changes in the Market Strategic Context, Competitive Advantages Performance Improvement System 13

14 4.3 Scope of the QMS The organization shall determine boundaries and applicability of QMS to establish scope. Consider: a) External, Internal issues from context b) Requirements of interested parties c) Products and services of the organization State the types of products/services offered, justify the not applicables - Scope: Documented Info. 14

15 4.3 Example Scope - Automotive ABC company provides steel stampings and welded assemblies to the automotive and household appliance industry in North America. The scope of our QMS includes stamping, and welding processes and outsourced heat treating and painting operations. ABC does not design the products we manufacture. Our site includes two buildings on 5 acres of land at 123 Sesame Street, and a shipping warehouse at 1313 Mockingbird Lane. 15

16 4.4 Processes The organization shall determine process & application a) Determine the inputs & outputs from each process b) Determine their sequence and interaction c) Determine criteria, methods, measurements and related performance indicators needed to ensure that both the operation and control of these processes are effective d) Determine resources and ensure availability e) Assign responsibilities and authorities 16

17 4.4 Processes f) Address Risks & Opportunities in accordance with Clause 6.1 g) Evaluate processes and implement changes to ensure they achieve intended results h) Improve processes and the QMS. Maintain documented information to support the operation of processes and to provide confidence that (plans) are carried out 17

18 18

19 19

20 5. Leadership 5.1 Leadership and Commitment 5.2 Quality Policy 5.3 Organizational Roles, Responsibilities, Authorities 20

21 5.1 Leadership and Commitment a.) Take accountability of the effectiveness of QMS b.) Ensuring that Q Policy and Objectives are compatible with its strategic direction c.) Ensuring the integration of QMS requirements into their business processes. d) Promoting awareness of the Process Approach and Risk Based Thinking e) Ensuring that resources are available f) Communicating the importance of QMS and conformance to QMS requirements 21

22 5.1 Leadership and Commitment g) Ensuring the QMS achieves intended results h) Engaging, directing, supporting people to contribute to the effectiveness of the QMS i) Promoting improvement j) Supporting other management roles to demonstrate leadership in their areas of responsibility. 22

23 5.1 Guidance Accountability Make Goals and Expectations Clear Provide resources set us up for success Hold people accountable for results Strategic Direction Have a Strategic Plan or Interview Top Mgt. Compare the QP and Objectives to what was learned from Top Mgt. Look for a holistic approach to objectives, not just quality objectives 23

24 5.1.2 Customer Focus Top Management shall demonstrate leadership and commitment with respect to customer focus by ensuring that: a) Customer and statutory/regulator requirements are determined, understood and met b) the risks and opportunities which can affect conformity of products/services and the ability to enhance customer satisfaction are determined and addressed c) The focus on enhancing CS is maintained. 24

25 5.2.1 Establishing Quality Policy Top Management shall establish a Policy that: a) Is appropriate to the purpose and context of the organization and supports its strategic direction b) Provides a framework for quality objectives c) Includes a commitment to satisfy applicable requirements. d) Includes a commitment to CI of the QMS 25

26 5.2.2 Communicating Quality Policy The Quality Policy Shall: a) Be documented b) Communicated, understood, applied c) Be available to relevant interested parties, as appropriate 26

27 5.3 Organizational Roles, Responsibilities and Authorities Top Management shall assign the responsibility and authority for a.) ensuring QMS conformance b.) ensuring process deliver intended outputs c.) reporting on the performance of QMS To Top Mgt. d) Promoting a customer focus e) Ensuring integrity of the QMS when changes occur Note that a defined Management Representative has been removed. (although the tasks remain) 27

28 6. Planning 6.1 Actions to Address Risks and Opportunities 6.2 Quality Objectives and Planning to Achieve Them 28

29 6.1 Address Risks & Opportunities Consider Context of the Organization and stakeholder needs and determine Risks and opportunities that need to be addressed to: a) Assure the QMS can achieve its intended results b) Enhance desirable effects c) Prevent or reduce undesired effects d) Achieve continual improvement The organization shall plan actions to address these R&O and integrate actions into the QMS processes and evaluate the effectiveness of actions. 29

30 6.1 Address Risks & Opportunities NOTE: Options to address risks/opportunities can include Avoiding Risk Taking Risk in order to pursue an opportunity Eliminating the Risk source Changing the likelihood or consequences Sharing the Risk Retaining Risk by informed decision 30

31 ISO 31000:2009 Risk Definitions Risk Risk Management RM Framework RM Policy Risk Attitude RM Plan Risk Owner RM Process Establishing Context External, Internal Context Communication, Consultation Stakeholder Risk Assessment Risk Identification Risk Source Event, Consequence Likelihood Risk Profile, Risk Analysis Risk Criteria Risk Evaluation Risk Treatment Control Residual Risk 31

32 ISO 31000:2009 RM Principles & Guidelines Clause 3 - Principles b) RM is an integral part of all organizational processes c) Risk Management is part of decision making f) RM is based on best available information g) RM is tailored (customized) i) PM is transparent and inclusive j) RM is dynamic, iterative, responsive to change k) RM facilities Continuous Improvement 32

33 ISO 31000:2009 RM Principles & Guidelines Clause 4 - Framework 4.1 General 4.2 Mandate and commitment 4.3 Design of framework for managing risk 4.4 Implementing risk management 4,5 Monitoring & review of the framework 4.6 Continual Improvement of the framework 33

34 ISO 31000:2009 RM Principles & Guidelines Clause 5 - Process 5.1 General 5.2 Communication and consultation 5.3 Establishing the context 5.4 Risk assessment 5,5 Risk treatment 5.6 Monitoring and review 5.7 Recording the risk management process 34

35 ISO 31010:2009 Risk Assessment Techniques 120 Pages Long Overlap with ISO 31000:2009 Annex A Comparison of Risk Assessment Techniques Table A1 Applicability of tools used for risk assessment Table A2 Attributes of a selection of risk assessment tools Annex B Risk Assessment Techniques Overview of 31 Risk Assessment Tools 35

36 Levels of Organizational Risk Enterprise Risk Regulatory environment Market/Competitors Risk Financial, Access to Capital Risk Product Risk Product Safety Early Failures, Reliability Operational Process Risk It s important to consider the above based on the type of business you are in. (The Organization and its Context, and the needs of Interested Parties) 36

37 Enterprise Risk - SWOT Strengths People love our products We have strong supplier partners Strong Marketing Division We have great managers, engineers Weaknesses Manufacturing is inefficient High turnover in key positions Too long to introduce new products Weak distribution in Europe Opportunities Purchase a competitor Increase sales in Europe and Asia Purchase new High Speed equipment Introduce the next generation product Threats Gov t sales of new spectrum New lower EMI requirements Downward pressure on prices Market shift to touchscreen tech. Lack of credit to upgrade capacity 37

38 Product Risk and Opportunities Opportunity Lift Higher than any competitor New Colours And Decals Risk Safety - unit can tip over Colours can fade, not look good, decals wear off 38

39 Risk Requirements - Guidance Its clear that Risk-Based-Thinking has to begin with Top Management Clause 5.1 (d) - Promote RBT & Process Approach Clause Risks to Products/Services and Customer Satisfaction have to be determined and addressed. Clause Circle back via the Management Review to assess the effectiveness of actions taken to address Risks and Opportunities. 39

40 Risk Requirements - Guidance Its clear that Risk-Based-Thinking has to be embedded in the Processes Clause 4.4 Determine Risks and Opportunities at the process level as processes are defined and then take appropriate actions to address Clause 6.1 Consider Organizational context (vision and strategy) and the needs of stakeholders to identify risks to the business and mitigate them. 40

41 Operational Controls What are operational controls? What should they be? Where should they be? How big should they be? We know that Operational Controls are appropriate when they are derived by and proportional to, RISK 41

42 Risk Assessment - Quantitative There are a number of approaches to assessing risk quantitatively. In this presentation, we address two Failure Modes and Effects Analysis (FMEA) considers the three dimensions of risk, Severity, Probability of Occurance, and Effectiveness of Detection, in order to quantitatively prioritize risks for attention Risk Matrix is a simpler approach, which requires less detail and considers only Probability and Severity. 42

43 Failure Modes & Effects Analysis List process steps, requirements for each step, What can go wrong, and the Effects of the failure What could cause the failure. List preventive controls and detective controls that are already In place Based on Risk Priority, decide upon actions to be taken to improve the process On a scale Of 1-10, how Severe would This be? On a scale Of 1-10, how Likely is this To happen? On a scale Of 1-10, how Strong are Our controls? 43

44 Risk Assessment - Quantitative Another Approach is to use a Risk Matrix This is a two-dimensional chart which plots failure severity against likelihood of occurrence. Current Detection controls are not considered. Although 3 by 3 matrices can be used, the most common approach is a 5 by 5 matrix. Increasingly significant events are weighed more heavily than the last. As with FMEA, consider likelihood as the net result of the cause event and corresponding prevention controls 44

45 Risk Matrix

46 Risk Matrix - Worksheet

47 Risk Assessment - Qualitative Unlike the Quantitative approach, which uses a numerical ranking to determine risk levels, a qualitative approach is based more on gut feel and does not follow a scoring guideline for determining where risk mitigation is required. This presentation uses a Risk Assessment Table as a way of capturing the thoughts and decisions of the group performing the assessment This is the simplest approach, but the lack of numerical rankings to guide decision making can result in high inconsistency between groups performing the risk assessments. 47

48

49 Risk Assessment Table The following briefly describes what belongs in each area of the Risk Assessment Table 1. The header includes the process name and other information, including Opportunities. Each process of the QMS should be examined for Risk 2. Steps of the process (from the flowchart) should be listed here. Each step in the process can be examined for Risk 3. In order to aid in the analysis, categories such as 5M can be considered. 49

50 Risk Assessment Table 4. The group considers Risks for such categories as Man (people), Materials, Methods, Machines, Measurement etc. and lists them in this column. 5. Current Controls are those aspects of the process that are already in place to mitigate the risks in the prior column 6. The last column lists the results of the review for that line and any actions that are decided upon for reducing Risks. 50

51 6.2.1 Quality Objectives and Planning Establish Quality Objectives at relevant functions, levels: a) Be consistent with the Quality Policy b) Be measureable c) Account for applicable requirements d) Be relevant to conformity & enhancement of CS e) Be monitored, communicated, updated f) Maintain documented information on Objectives 51

52 6.2.2 Quality Objectives & Planning When planning how to achieve quality objectives, the organization shall determine a.) What will be done b.) What resources are required c.) Who will be responsible d.) When it will be completed e.) How results will be evaluated [SMART goals] 52

53 6.3 Planning of Changes Carry out QMS changes in a planned manner. Consider: a) The purpose of the changes & potential consequences b) The integrity of the QMS c) The availability of resources d) Allocation or reallocation of responsibilities, authorities 53

54 One More Thing This has been risk assessment of existing processes. It is backward looking. RBT also has to be embedded into current processes so that it carries on into the future Review procedures and checklists to include RBT for risky processes such as Quotations process Design engineering process Supplier selection process Corrective Action process, etc. 54

55 Workshop Processes for RBT Corrective Action Calibration Manage NC Product Internal Audit Purchasing Hiring / Training Strategic Planning and Management Review Driving to Work Cooking Dinner Doing Laundry Buying Groceries Assemble a new Toy Washing the Car Putting a child to bed Create a Flowchart first 4 to 6 steps. Complete the Worksheet