ISO 9001 is the world’s most recognizable standard for a quality management system (QMS). It enforces confidence in an organization’s ability to consistently supply products and services to a uniform standard. This is achieved by controlling processes within the organization and an important aspect of that is the introduction of risk-based thinking throughout the entirety of the QMS.
Adverse risk events, such as COVID-19, demonstrate the importance of adopting a risk-based way of thinking. Unpredictable, negative events can significantly reduce a company’s ability to deliver consistency. Without risk-based thinking at the heart of a QMS, an organization is always reacting to an event, rather than proactively anticipating it. A system that is reacting will be delayed and disrupted, but an organization that has adopted proactive behaviors will already have processes in place to mitigate the negative impact of the event.
Unlike previous iterations of ISO 9001, which separated preventative actions into their own clause, the latest version – ISO 9001:2015 – ensures it is part of every facet of the organization. This is because risk-based thinking is key to achieving continual improvements within the QMS.
Defining Risk-Based Thinking
It is easier to start by defining what it is not. It is not:
- Risk management
- An implementable model
- A documentable practice
Instead, risk-based thinking is a systematic and organic process for the integration of risk management thinking into an organization. It is all-encompassing and continual.
