Awareness of Risk-Based Thinking

The risk-based thinking is the new concept introduced by the ISO 9001:2015 Standard. It promotes a new
organizational culture that leads people to look for opportunities and to address risks. This concept
advises that alterations produce opportunities as well as unanticipated consequences. Thus, the
organization shall analyze and act in advance to address changes that may impact its objectives,
expectations of interested parties, or product requirements.
• The top management shall refer to risk-based thinking in its quality policy, define it
as a quality goal, and if applicable, define relevant quality objectives.
• While implementing the process approach, risk-based thinking will be integrated in
the planning of the processes.
• The top management can initiate actions like small-scale risks analysis projects in
order to identify risks that pose threats to the QMS or to detect opportunities that
will improve the QMS and enhance desirable effects.
• The top management shall allocate resources for the promotion of risk-based thinking.
Leadership 45
Ensuring Resources
No QMS can succeed without sufficient resources. The top management tends to take this matter not
seriously because it involves costs. But still the top management must ensure allocation of all required
resources in order to ensure the effective operation of the QMS. Which resources are needed and how to
ensure their availability will be discussed in chapter 7.1—Resources. But the matter should be structured
in the strategy of the organization and be expressed by its quality policy, for example, the policy shall
indicate that
• The importance of allocating the right resources to the various activities of the
organization is understood and considered
• The need for resources in order for processes and activities to be effective and
efficient is acknowledged
• The top management is committed for providing the resources required to carry out
the activities of the QMS
• Current process capabilities and the their resources are assessed
• Future resources and technology needs are identified
• Activities for the identification and provision of needed resources shall be determined
Very important is the link between the strategy and vision of the organization and the commitment to
provide the necessary resources for achieving this strategy. In practice, I would include in each section,
part, chapter, or capital of the quality policy reference to the allocation of the necessary resources. For
example
• Responsibilities and roles
• The appropriate times resources
• Procedures and methods
• Tools and instruments
• External resources
• Training
Improvements
With a direct relation to the process approach and the needed resources, the top management must
promote improvement in the organization. The requirements for improvement and its application will be
discussed in chapter 10—Improvement. Here we discuss the strategic aspect. The ISO 9001 Standard
views the improvement as vital to the effectiveness of the QMS. The expectance of the standard is a
structured approach—by systematically improving the QMS, it would achieve its objective over the long
term. Practicing improvement must address inputs such as data for analysis, changes in the context of the
organization, and assessment of current risks and opportunities.
This topic must be forwarded to employees at all levels. It is important for them to understand the direct
relation between their work and the effectiveness of the QMS. When individuals perform their activities
as expected or according to specifications and as a result they produce the intended results, the goals of
QMS are achieved. When they are acting for enhancing their outputs, then the QMS is improved.
46 ISO 9001:2015—A Complete Guide to Quality Management Systems
Understanding this concept will motivate workers in striving for improvement. In practice, the top
management must show evidences of actions for promoting improvements. Publishing it on the bulletin
board is not enough. It is a cyclic process that includes
• Promoting improvement
• Initiating actions to collect inputs
• Analyzing the inputs
• Launching actions for improvement
• Measuring the effectiveness of those improvements
So if you maintain a suggestion box for improvements in an audit it will not be enough to show that
suggestions were filled out on a controlled form but that
• The suggestions were reviewed
• A few of them were chosen for implementation
• They were submitted to a methodic process
• Their implementation was done under control
• The top management took the time to evaluate the effectiveness of the suggestions