Actions to address risks and opportunities (Part 1)

To give assurance that the Quality Management System can achieve its intended results, enhance desirable effects, prevent or reduce undesirable effect and achieve improvements, an organization shall take action to address risks and opportunities at every process level. This may best be approached using the Plan-Do-Check-Act principle.

Diagrammatic Representation

In planning actions to address risks and opportunities, the organization shall consider the following sources.

External and internal issues determined.
Relevant interested parties and their requirements determined.

To achieve this, the organization shall:

Determine and address risks that affect the Quality Management System.
Promote risk-based thinking throughout the organization.
Ensure risks are determined and appropriate actions are taken to address them.
Plan actions to address risks, implement planned actions and evaluate the effectiveness of the actions taken.
Control and contain the identified risks to prevent unintended escalation.
Integrate the results of actions to address risks into the Quality Management System.
Improve the Quality Management System by responding to risks as appropriate.

There is a close relationship between external and internal issues, interested parties and their requirements and actions to address risks and opportunities. For every interested party and requirements identified, there are related issues, and every issue has a potential risk or opportunity.

The Relationship

Risks and opportunities may be obtained from:

Minutes of meetings.
Brain-storming activities.
SWOT analysis of the organization’s Quality management System.
Risk determination and evaluation records.
Reports of customer feedback.
Strategic planning documents.
Planning, analysis and evaluation activities.
Production inspections and service reviews.
Competitor and market analysis.
Marketing and sales data.
Quality manual.
Design and development reviews.
Corrective actions.
Non-conformance reports.
Minutes of management review meetings.

It is required that an organization shall take action to address the risk or opportunity associated with every issue identified regarding interested parties. A better sequence is to identify relevant interested parties and their requirements, determine the issues associated with each of the identified interested parties, assess these issues for their potential risks or opportunities impact and take action to address the risks or opportunities. This will enhance the focus of actions to address risks and opportunities on the interested parties. A positive risk results in an opportunity. Actions to address a risk shall be appropriate to the impact of the risk.