Management system guidance
6.0 Planning
ISO Navigator Pro™ is a free tool that provides practical, expert guidance for businesses wishing to interpret and better implement the requirements of ISO 9001:2015, ISO 14001:2015 and ISO 45001:2018.
Our range of templates cover the requirements of ISO 9001:2015, ISO 14001:2015 and ISO 45001:2018, and offer an easy way to implement your next management system.
6.1 Actions to address risks and opportunities
6.1.2 Plan the actions needed to address the risks and opportunities
When deciding how to plan and control the management system, including its component processes and activities, your organization needs to consider both the type and level of risk associated with them. Ensure that your organization is taking a planned approach to addressing risks and realizing opportunities, and that any actions taken have been recorded. Options to address risks and opportunities can include:
- Avoiding risk;
- Taking risk in order to pursue an opportunity;
- Eliminating the risk source;
- Changing the likelihood or consequences;
- Sharing the risk;
- Retaining risk by informed decision;
- SWOT analysis by the organization as part of its business strategy to identify the external risk and opportunities and action plans to address them;
- Formal business risk assessment performed by the organization talking into consideration its context, associated risk and opportunities and mitigation plan;
- Use of process approach by organization to identify sources of input, activities, output, receiver of output, performance indicators to control and monitor processes, the risks and opportunities associated with them and action plan to address them.
Formal business risk assessment performed by the organization talking into consideration its context, associated risk and opportunities and mitigation plan. The use of the process approach by your organization to identify sources of input, activities, output, end-user/customer, performance indicators to control and monitor processes and the risks and opportunities associated with them, and action plans to address them:
- Meeting minutes;
- SWOT and/or PESTLE analysis;
- Planning, analysis and evaluation activities;
- Risk determination or evaluation records.
Risk management methodology
Understanding the risks and managing them appropriately will enhance your organization’s ability to make better decisions, safeguard assets, and enhance your ability to provide products and services and to achieve your mission and goals.
By considering risk throughout your organization the likelihood of achieving stated objectives is improved, output is more consistent and customers can be confident that they will receive the expected product or service. Risk-based thinking therefore helps to:
- Improve customer confidence and satisfaction;
- Assure consistency of quality of goods and services;
- Establishes a proactive culture of prevention and improvement;
- Intuitively take a risk-based approach.
We suggest that you use the familiar Plan-Do-Check-Act (PDCA) methodology to manage your organization’s transition to risk-based thinking; using an approach that ring-fences processes into ‘risk themes’ or groups such as:
- Business planning and strategic direction;
- Process risk;
- Product and service risk;
- Risk associated with the control of externally provided product and service.
Risk and opportunity assessment
Assessment of the severity of a risk drives management attention and supports planning for risk mitigation. A qualitative risk assessment scheme consisting of qualitative probability and impact scales is undertaken to ensure consistency. Ensure that all accountable managers should engage with risk owners to:
- Identify the control measures already applied to each risk i.e. existing control measures. These may be pro-active (reducing the probability) or reactive (reducing the impact);
- Rank the probability and impact of each risk after taking into account the actual effectiveness of the existing control measures;
- Enter the existing control measures and the associated current risk probability and impact scores into the risk and opportunity register.
Forecast probability, cost and time data is assessed for each risk based on the causes and effects described, taking into account the existing controls and active responses. Probability or likelihood estimations are established giving due consideration to the effectiveness of existing control measures. The consequence evaluation criteria define the consequence criteria, assessed against potential financial loss, reputation impact, health and safety, legal and regulatory compliance and management time and effort.
Risk assessments are undertaken to provide an improved understanding of the risk profile and derive a more detailed understanding of certain cost and time risks. Forecast probability, cost and time data is assessed for each risk based on the causes and effects described, considering the existing controls and active responses.
Probability or likelihood estimations are established giving due consideration to the effectiveness of existing control measures. The consequence evaluation criteria define the consequence criteria, assessed against potential financial loss, reputation impact, health and safety, legal and regulatory compliance and management time and effort.
Risk treatment and mitigation
The objective of this step is to identify how the identified risks will be treated. Risk treatment involves identifying the options for treating each risk, evaluating those options, assigning accountability (for Very High, High and Moderate residual risks) and taking relevant action.
For each risk, the risk owner must establish an appropriate level of treatment. Control measures in addition to those already existing may be needed to achieve this level of mitigation. Accountable managers should engage with risk owners to develop a satisfactory response each risk in order to:
- Identify a response strategy to treat, terminate, tolerate or transfer the risk;
- Identify response actions to improve control measures as required. These will be SMART;
- Identify a response action owner for each action and confirm with them that they accept accountability for implementing the action within the time allowed.
The risk owner is responsible for the development of the response. When a response action is completed, the risk should be reassessed to reflect any newly introduced control measure
Monitoring
Continuous systematic and formal monitoring of implementation of the risk and opportunity process and outputs take place against appropriate performance indicators to ensure process compliance and effectiveness. Monitoring takes a variety of forms and range from self-assessment, inspections and internal audits, to detailed reviews by independent external experts.
Escalation
On occasion, it may be appropriate to escalate a health and safety risk to ensure it is assessed and/or managed by the person or party best placed to do so (able and with appropriate authority). For example, where a more substantial or coordinated response is required than the current risk owner can authorise or implement will justify higher level assessment and/or management, as appropriate:
- Escalate through established lines of management accountability all hazards and risk that may require mitigation;
- This may take place during formal reviews, or through other simple mechanisms at management meetings;
- Issue reports in accordance with requirements;
- Provide key information such as statistical data on numbers of active hazards, unassessed risks, overdue actions, and others as appropriate
Managing opportunities
Your organization recognizes an ‘opportunity’ as a set of circumstances which makes it possible to leverage positive factors and attributes, for example:
- Develop new products, services and processes;
- Develop new markets, or increase market share;
- Improve the work environment;
- Improve productivity;
- Improve operational efficiency (reduction of resource use, reduction of waste, etc.).
Opportunities may be identified as positive effects of risks; as in a risk forcing implementation of a risk reduction measure that is beneficial in a broader context than just reducing a particular risk. For example, health risks may require measures to improve working environment.
However, these measures also create opportunities to attract and retain better qualified employees, improve morale and job satisfaction, and reduce turnover; and so, the initial health risk creates positive opportunities to improve the overall job satisfaction.
Check that any actions taken to address the risks and opportunities are recorded, and ensure that the effectiveness of each action was effective at addressing the issue, and that the action taken was proportionate to the risk or opportunity. Objective evidence could be in the following various forms:
- Meeting minutes;
- SWOT analysis;
- Reports on customer feedback;
- Competitor analysis;
- Quality manual;
- Brain-storming activities;
- Planning, analysis and evaluation activities;
- Strategic planning documents;
- Design and development reviews;
- Marketing and sales data;
- Production inspections and service reviews;
- Corrective actions;
- Non-conformance reports;
- Management review minutes;
- Risk determination or evaluation records.
More information on PDCA
Planning
Context
Planning
Support
Doing
Support
Operations
Checking
Monitoring, measurement, analysis and evaluation
Acting
Improvement
Want to know more?
- Read our customer's feedback
- Client list - who's using our templates?
- How the templates are formatted and download examples
- Why we use turtle diagrams and process maps
- What's the difference between a process and a procedure?
- About documented information
SSL certification
A certificate guarantees the information your internet browser is receiving now originates from the expected domain - https://www.iso9001help.co.uk. It guarantees that when you make a purchase, sensitive data is encrypted and sent to the right place, and not to a malicious third-party.
Free PDCA guidance
ISO Navigator™ is our FREE online training tool that shows you how to apply the principles of PDCA to your operations. We also offer many helpful templates that get you on the road to documenting your management system, please visit the download page.