ISO 9001:2015 – risk and opportunities

Below is an article I added to CQI’s blog in November 2015.

In the third instalment of our guest blog series in collaboration with PMI, Paul Simpson asserts that, just as there are risks and opportunities that we respond to in daily organisational life, quality professionals should focus on the opportunities for improvement presented in ISO 9001:2015.

One of the big new ideas in the 2015 edition of ISO 9001 is ‘Risk Based Thinking’ and if you are to believe the ‘Twitterati’ the concept is akin to the subject of Edvard Munch’s painting ‘The Scream’ as the quality management landscape turns vibrant orange behind them.

But before the hysteria needle hits ‘11’ let’s think back to the real world outside the quality manual.

Everyone involved in running an organisation looks at risk and opportunity – they are two sides of a coin. When an entrepreneur starts their business, risk and opportunity are always front and centre in their mind.

Wherever they have come from, they have identified an opening to start a business, make a living and grow it to the point where it gives them an income with the opportunity of a pot of gold for their retirement. This future is, however, not certain. There will be difficulties along the way and these risks, left unmanaged, could lead to a loss of income and, ultimately, to their business failing.

The entrepreneur recognises these risks come in many forms and many are related to quality:
• Do I have the right products and services for my target customers?
• Can I control production and service delivery to consistently meet those customer needs?
• Can my suppliers keep up with my demands and maintain the quality levels I need?

If I can manage those risks at that level then the business will succeed and I can grasp all the opportunities, including that elusive pot of gold.

Moving forward in time as the business continues to thrive and grow, our entrepreneur has moved upstairs to the boardroom as CEO and has managers and teams dealing with day-to-day business while they buy in high-priced consultants to lead some ‘blue sky’ strategy sessions. Strategic risks haven’t really changed – an incorrect strategy still has the capability to bring down our grown-up start-up.

Tactically the business can cope more easily with risk as it has multiple customers buying a range of products. On the downside, tactical errors can lead to an erosion of hard-earned brand reputation as all our customers inhabit the same system and talk to one another – see the earlier blog on organisational context, Context is King.

Moving out of the boardroom along to the shop floor and offices where ‘business as usual’ happens, ‘risk’ looks a little different but it is just as important it is recognised and managed.

With every order comes a risk the organisation will misunderstand its customers’ needs so, at this process level, there have to be checks and balances. Individuals working with their CEO’s delegated authority, accept orders and enter into contracts including the inherent risks that a legal contract carries.

At the same time on the shop floor, all employees are involved in managing risk. Some develop specifications and standards (perhaps in a separate design office), some manufacture products or deliver services that they believe meet those standards.

Throughout the process managing risks leads to delivered products and services meeting specification, satisfying customer needs and customers paying their bills, thereby allowing the organisation to realise the sales opportunity and contributing to our entrepreneur’s vision of a pot of gold.

If the above risks and opportunities are present in daily organisational life, why do we have concerns for the quality professional’s ability to inhabit this space? Why do we have concerns over what our certification body auditors are going to ‘do to us’?

The revised clauses of ISO 9001 create an opportunity for us to revisit and realign our processes to ensure our systems deliver what our customers and stakeholders want. There are, of course, risks with changes to the standard, but perhaps we can focus on the opportunities presented and maximise them instead.

ISO 9001:2015 Context is King

Below is an article I added to CQI’s blog in October 2015.

In the second instalment of our guest blog series in collaboration  with PMI, Paul Simpson uses the example of a corner shop to set the challenge to larger organisations aiming to understand the importance of ‘context’ in ISO 9001:2015.

The 5th edition of ISO 9001 contains significant requirements for organisations to assess and take actions on information in their working environment.

In a small number of words the standard creates huge responsibilities for the organisation’s leaders and the only effective way to demonstrate those requirements are met is to look at the organisation as a system and understand the processes that interact with others in the operating environment.

So, what does that mean in practice?

Thinking of my local corner shop to test out a concept

I live in a village where my local shop owner has a very good idea as to who her customers are and their buying patterns. She knows her regulars and those who pop in once a month for a pint of milk late on Sunday. Each time a customer purchases something it is scanned and goes through the till and she gets sales reports as often as she wants. Her staff make a note when someone asks for something not in stock and, periodically, she sits down and decides whether the current stock holding needs to change.

She has supplier reps and multiple mail shots from suppliers to give options and alternative products to stock. Her stock deliveries take place twice a week and an emergency delivery can be called up if needed. She knows her regular sales team, their strengths and weaknesses and sickness patterns and meets each of them daily and talks about what is happening currently and what she plans to do.

In the village the Parish Council is fairly active and occasionally she meets one of the councillors and they talk about village traffic, problems with parking and litter. All in all the relationship is amicable. In surrounding villages there are similar shops and recently one of the majors opened an Express outlet.

In all of the above there are risks and opportunities that can affect the sustainability of her business so she has a plan that attempts to deal with the risks and maximise the opportunities. The plan is in her head and is occasionally discussed with her husband and some ideas are tested with selected customers. The plan adapts in the light of changes to the operating environment of the store.

In the spirit of ISO 9001:2015

So, in my example, we have a system (corner shop) operating in a range of wider systems (village, local area, grocery supply network). The shop is part of a range of processes that take food from farm to fork and news from event to the reader. Each process is operating in real time and competes for time from members of staff and space in the owner’s head in terms of developing plans and strategies.

I’ll put my neck on the line here and state that not only is my local shop owner doing a good job of running her business but her practices are in line with the Deming Cycle and meet the spirit and letter of the requirements in ISO 9001:2015.

For larger organisations context assessment is a much more complicated process, part of strategic management but, if done well, requires no further effort to comply with ISO 9001:2015.

If, however, you haven’t done this piece of work effectively, not only are you in serious danger of failing to meet your system objectives of being a sustainable, profitable business but you cannot hang your 2015 certificate on the wall in reception with a clear conscience.