Risk Management - Is it only a paper work?

In ISO 9001:2015 Quality Management system Risk Based Thinking (RBT) is emphasized at a greater length. As a QMS consultant, I personally feel there is a big gap between what is asked for in the standard and that of the reality. I have been interacting with many of my clients and trying to explain the requirements of QMS ISO 9001:2015 standard but many of them are little bit confused and are even allergic to the phrase "Risk based Thinking".. The simple reason is many fail to see it as a tool to improve their QMS. These small and medium firms simple do risk assessment and risk treatment (RART) for the sake of satisfying the Certifying body auditors. But in reality these are not put into practice. As usual there is a line of thinking among MSME's and even in some corporates that RART has to be done for the sake of certification and there is no link to the real life situations what they face day in and day out. This is the simple realm of life.

The standard also doesn't emphasize documentation for addressing the requirements of clause 4.1 - Understanding the context of the organization and clause 4.2 - Needs and expectations of interested parties. As usual the interpretation by consultants and certifying body auditors on Risk based thinking documentation is still creating confusion among the minds of the client organizations. The standard clearly states there is no formal requirement of Risk Assessment but in reality for addressing the requirements of Clause 6.1 - Actions to address risk and opportunities a documented evidence is asked for. I feel somewhere there is still an ambiguity in this area.

The risk assessment and risk treatment (RART) is carried out as a ritual and many organizations simply copy and paste templates available in the web and literally doesn't understand the concept of risk based thinking in Quality Management System. Its the duty of Certifying body auditors, Consultants and Regulators to come out with a uniform version of understanding on risk based thinking and avoid interpreting the standard in their own convenient way.

Awareness Training in IATF 16949:2016 on June 10th 2018

ISO 9001:2015 Quality Management System

What's new in ISO 9001: 2015 Quality Management System?

The organisations already certified with earlier version of ISO 9001:2008 QMS standard will find this very useful.

The major changes are listed below:

Previously there were 8 management principles Now it is 7 management principles

The total clauses in the earlier version was 8. Now this has been standardized for all ISO standards and its called as "High Level Structure" aka HLS which comprises 10 clauses.

Preventive action clause has been removed. Instead Risk management has been added.

No requirement for a separate Quality Manual

No requirement for a Management Representative

No Mandatory documented procedures

The word document and records has been integrated as "Documented Information"

The internal audit is Risk Based Audit (RBA)

The High level structure is user friendly and this structure is now common to all other management systems also. So if an organization is adopting two or three management systems these can be integrated in HLS and now its called as IMS - Integrated Management System.

For further details

Mail me to ramkumar@pragyaconsultancy.com or log on to

www.pragyaconsultancy.com

contact number - +919940120781

ISO CERTIFICATION AUDIT - Is it becoming a ritual in companies?

ISO certification audit - Is it becoming a ritual in companies? 

ISO 9001:2008 - Quality Management system (QMS) is the most adopted international system by firms and organizations. In the wake of recent revisions being proposed for this international system and the new revised version of ISO 9001 is going to get released officially by Mid 2015, I want to register my thought process regarding this international certification with my own experience as a freelance ISO consultant.

ISO certification process - the audits both internal and external are being conducted in various organizations and the non-conformances raised during these audits are closed by taking "appropriate" corrective actions. But my experience goes like this........In internal audits is is predominantly the role of MR and the qualified internal auditors to take care of closing the non-conformances. It is in fact imperative to note that these non-conformances were issued by the same set of people. Rest of the crowd brand these people as "ISO people" and they think that it's none of their business to take the corrective actions for the non-conformances raised. In fact there should be a separate article to be written titled as " Is playing the role of an ISO internal auditor - A bane or Boon?"...........All the auditors some point in time lose their interests because of the extra work due to ISO audits and start feeling this as a "BURDEN"

The top management also doesn't provide any extra incentives for the MR or the ISO internal auditors who are in fact playing a yeomen role in sustaining the management system in the organization.

Whenever a consultant enters inside a company, then on seeing him any employee whatever position he or she occupies in the organization immediately directs the consultant to MR and say, "ISO consultant has come and all ISO "PEOPLE" can meet the consultant" as if he or she doesn't have any role to play in ISO certification. This is the ground reality. 

The organizations are in a compulsion to go in for ISO certification due to the mandatory demand from the customers. They will not be able to participate in the tenders without ISO certification. By hook or crook they want to get their organizations "ISO CERTIFIED"

In this scenario, Organizations doesn't ADOPT the ISO system in their daily routines and instead feel that conducting an ISO internal audit followed by an MRM (management review meeting) is a ritual to be carried out once in six months. This is in fact true with many MSME's wherein the top person managing the company is neither able to calibrate to the level of a corporate company nor want to leave the "COMFORTABLE" position as an Entrepreneur. So there is always a lack of commitment in the Top management people to adopt this international standard in its true spirit.

After getting the certification, the top management person always says in a frustrated and blaming mood that , "I am unable to see any difference in my organization. I don't see any system in my company. I don't see any change in my employees. I think I have wasted my money in getting the ISO certificate." 

Always the consultants like me face this music and we very well know the answer for this. "The Top management person is not strictly adhering to the ISO system and adopt in his daily routines". The  top management works according to its convenience. They themselves violate the system and blame the certification body and the ISO team (MR & internal auditors) and term it as a wasteful exercise.

As a result the whole exercise of getting an ISO certifications is becoming a mockery and of course there are ways to get these international certificates at a cheaper price. Where are we heading for? Are we not cheating ourselves? Whose responsibility is to check these type of touts prevailing in the certification domain? 

These type of scenario - Will it see a change with the release of revised standard in mid 2015? because the new standard doesn't requires a Quality Manual and also a MR - Management Representative and more focussed on 'RISK MANAGEMENT".............




(The views expressed here are only my views. There may be differences of opinions which are most welcome as "COMMENTS")

ISO 9001 is getting revised in 2015. Are you aware?

ISO 9001:2008 - Quality Management System international standard is getting revised during this year 2015.

The draft international standard (DIN) is ready and I hereby highlight the changes between 2008 and 2015.

ISO 9001:2008	ISO 9001:2015 DIS	Remarks
0. Introduction	0. Introduction
1.1 General	1. Scope
1.2 Application	4.3 Determining the scope of the quality management system
2. Normative references	2. Normative references	There is no normative reference in the DIS
3. Terms and definitions	3. Terms and definitions	Definitions from ISO 9001:2014 DIS included
4. Quality Management System	4. Context of the organization
4.1 General Requirements	4.4 Quality management system and its processes
4.2 Documentation Requirements	7.5 Documented information	Reduced requirements for documentation
4.2.1 General	7.5.1 General
4.2.2 Quality Manual	-	Quality Manual not required
4.2.3 Control of Documents	7.5 Documented Information	Records and Documents are now "Documented Information"
4.2.4 Control of Records	7.5 Documented Information	Records and Documents are now "Documented Information"
5. Management Responsibility	5. Leadership
5.1 Management Commitment	5.1.1 Leadership and commitment for the quality management system
5.2 Customer Focus	5.1.2 Customer focus
5.3 Quality Policy	5.2 Quality policy
5.4 Planning	6. Planning for the quality management system
5.4.1 Quality Objectives	6.2 Quality objectives ans planning to achieve them
5.4.2 Quality Management System Planning	6.3 Planning of change
5.5 Responsibility, Authority, and Communication	5.3 Organizational roles, responsibilities and authorities
5.5.1 Responsibility and Authority	5.3 Organizational roles, responsibilities and authorities
5.5.2 Management Representative	-	MR not required
5.5.3 Internal Communications	7.4 Communication
5.6 Management Review	9.3 Management Review
5.6.1 General	9.3.1 Management Review
5.6.2 Review Input	9.3.1 Management Review
5.6.3 Review Output	9.3.2 Management Review
6. Resource Management	7.1 Resources
6.1 Provision of Resources	7.1 Resources
6.2 Human Resources	7.1.2 People	?
6.2.1 General	7.2 Competence
6.2.2 Competence, Training, and Awareness	7.2 Competence and 7.3 Awareness
6.3 Infrastructure	7.1.4 Infrastructure
6.4 Work Environment	7.1.5 Environment for the operation of processes
7. Product Realization	8. Operation
7.1 Planning of Product Realization	8.1 Operational planning and control
7.2 Customer-Related Processes	8.2 Determination of requirements for products and services
7.2.1 Determination of Requirements Related to the Product	8.2.2 Determination of requirements related to products and services
7.2.2 Review of Requirements Related to the Product	8.2.3 Review of requirements related to products and services
7.2.3 Customer Communication	8.2.1 Customer communication
7.3 Design and Development	8.3 Design and development of products and services
7.3.1 Design and Development Planning	8.3.2 Design and development planning
7.3.2 Design and Development Inputs	8.3.3 Design and development inputs
7.3.3 Design and Development Outputs	8.3.5 Design and development outputs
7.3.4 Design and Development Review	8.3.4 Design and development controls
7.3.5 Design and Development Verification	8.3.4 Design and development controls
7.3.6 Design and Development Validation	8.3.4 Design and development controls
7.3.7 Control of Design and Development Changes	8.3.6 Design and development changes
7.4 Purchasing	8.4 Control of externally provided products and services
7.4.1 Purchasing Process	8.4.1 General
7.4.2 Purchasing Information	8.4.3 Information for external providers
7.4.3 Verification of Purchased Product	8.4.2 Type and extent of control of external provision and 8.6 Release of products and services
7.5 Production and Service Provision	8.5 Production and service provision
7.5.1 Control of Production and Service Provision	8.5.1 Control of production and service provision
7.5.2 Validation of Processes for Production and Service Provision	8.5.1 Control of production and service provision
7.5.3 Identification and Traceability	8.5.2 Identification and traceability
7.5.4 Customer Property	8.5.3 Property belonging to customers or external providers
7.5.5 Preservation of Product	8.5.4 Preservation
7.6 Control of Monitoring and Measuring Equipment	7.1.6 Monitoring and measuring resources
8. Measurement, Analysis, and Improvement	9.1 Monitoring, measurement, analysis and evaluation
8.1 General	9.1.1 General
8.2 Monitoring and Measurement	9.1.1 General
8.2.1 Customer Satisfaction	9.1.2 Customer satisfaction
8.2.2 Internal Audit	9.2 Internal Audit
8.2.3 Monitoring and Measurement of Processes	9.1.3 Analysis and evaluation
8.2.4 Monitoring and Measurement of Product	8.6 Release of products and services
8.3 Control of Nonconforming Product	8.7 Control of nonconforming process outputs, products and services
8.4 Analysis of Data	9.1.3 Analysis and evaluation
8.5 Improvement	10. Improvement
8.5.1 Continual Improvement	10.3 Continual Improvement	Continual deleted in CD, but is back in DIS
8.5.2 Corrective Action	10.2 Nonconformity and corrective action
8.5.3 Preventive Action	6.1 Actions to address risks and opportunities	PA is being replaced with risk based thinking