Assessment of Risk and Opportunity in Accordance With ISO 9001: An Empirical Study

Introduction

In the Year 2019 there are 883 521 ISO 9001 certificates issued across the world as per annual survey conducted by the International Organization for Standardization which indicate the universal acceptance of the ISO 9001 standard. Post COVID’19 era the certified organizations would have been in a much better position should the “Risk and Opportunity” were seriously addressed. Various processes of the quality management system represent divergent level of risk and effect of uncertainty with regard to organizations capacity to achieve their target. ISO 9001:2015 certified organizations are encouraged to exercise risk based thinking and determine the actions necessary to address the potential risk.

The Risk and Opportunities are integral part of the ISO 9001:2015 version. The chances of achieving intended objectives are enhanced by considering the risk in all the processes within the quality management system. Failure to address the risk proactively would results in poor governance and inconsistent output effecting the customer satisfaction. Appropriate risk identification and effective determination of controls would mitigate the effects of uncertainty to a great extent. The competency of the process owner conducting the risk assessment of every process within the quality management system is significant.

The chances of achieving intended objectives are enhanced by considering the risk in all the processes within the quality management system. Failure to address the risk proactively would results in poor governance and inconsistent output effecting the customer satisfaction. Appropriate risk identification and effective determination of controls would mitigate the effects of uncertainty to a great extent. The competency of the process owner conducting the risk assessment of every process within the quality management system is significant.

There is an excusive risk management standards like ISO 31001 which could be adopted by the organizations as per the complexity of their processes, size, risk category and nature of business. ISO Guide 73 provides vocabulary on risk management. Reference to the above mentioned ISO Standards on Risk would to a great extent enable organizations to identify all the potential risks and address them appropriately in order to minimize the effect of uncertainty and adverse impact on the business and achieve intended output. Novel virus COVID’19 has forced the whole world to lockdown and very few organizations could sustain in the business who have assessed the risk from such a pandemic. The most significant aspect would be the response time to identify the new risk and determination of controls to mitigate the effect of uncertainty; which require a joint effort of the domain expert along with the various process owners. Risk methodologies and tools available as on today have not proven robust against the novel virus COVID’19. Out of many factors contributing the low response time to defend COVID’19 was primarily because organizations couldn’t explore this type of risk affecting business.

Lessons learned from the global pandemic:

• 1)

  Competent person should conduct the Risk assessment to suit their business requirement.

• 2)

  Risk assessment is not a one time activity but a recurring and dynamic exercise.

• 3)

  All stakeholders issues, needs and expectations to be considered.

• 4)

  Necessary resources to be mobilized.

• 5)

  Employees to be trained to handle the uncertain situations.

• 6)

  Mock drills to be conducted to determine the arrangements made by the organization to deal with the effect of uncertaininty is adequate.

• 7)

  A through internal audit would explore the areas for improvement.

• 8)

  Frequent evaluation of compliance would ensure reduce possibility of unintentional breach.

• 9)

  Minimize the documents and focus on Visual communication; hardly anybody would spend time reading tons of materials when its struck with a Uncertainty.

• 10)

  Employee skill matrix could be updated with Risk related competencies.