![Advisera Mark Hammar](https://advisera.com/wp-content/uploads/blog_authors/markhammar.jpg)
September 1, 2015
Risk analysis is one of the biggest expected additions to the ISO 9001 standard, and has been included in all of the drafts of ISO 9001:2015 that have been circulated. Risk analysis is the important step of identifying the potential problems that could arise in your organization, otherwise known as risks, and deciding how to deal with these risks. Although risk assessment and analysis are not currently required by the ISO 9001 standard, as I explained in a previous blog post on The Role of Risk Assessment in the QMS, it is currently used by many companies especially in the product design process.
One commonly used method of risk identification and analysis is the Failure Modes and Effect Analysis (FMEA), sometimes modified to a Failure Modes Effects and Criticality Analysis (FMECA), which is done during the design of a product or process. The idea of this assessment is to identify all potential problems that could arise in the product or process, identify the overall criticality of the risk, and decide what to do about it. This sounds simple enough, but it can present challenges.
While I will not be able to give an in-depth explanation of the FMEA (there are entire courses explaining how to use it), there are four basic steps in the FMEA process:
The benefits of FMEA are simple; it is easy to use once understood, gives results that are easy to determine acceptability, and thus provides a framework to assign resources to risk reduction that is easily supported. When all parties can agree that one particular ranking of risks is the best, it is easy to determine which is most critical to address first, then second, and so on. The FMEA process is also widely used, so if you are in an industry that uses the FMEA process, there will be no need to explain what you have done.
On the other hand, there are some criticisms of the FMEA process. The biggest criticism is that it is assumed that each of the three factors is equally important, and if not, then having the same numerical ranking multiplied together is a flawed assumption. For instance, if a risk has a low probability, high severity, and low detection, it can have a very low overall number (1 X 10 X 1 = 10) even though the severity of this risk could warrant action on its own, while a risk with very low severity that has a medium probability and high detection would rank higher (10 X 1 X 10 = 100) even if the risk would not cause a real problem with the product.
As I said, FMEA is only one way of dealing with risk analysis, and it is in no way mandated by the ISO 9001 standard that you must use it. Any method that you find useful and efficient will be acceptable. It is also important to note that the requirements in the draft versions of ISO 9001:2015 only require you to analyze the risks in your QMS, but not to actively manage them afterwards. There are many methods, and many software tools, that can help you with the task of managing risks, but you need to ask yourself if this is important for your business. The choice is up to you; ISO 9001 is there to provide the basic framework for a good Quality Management System, not to add extra expense to your processes beyond what you need.
For more information on changes brought about by ISO 9001:2015, check this free ISO 9001:2015 vs. ISO 9001:2008 matrix.