Preventive Action in ISO 9001:2015

New language encourages organizations to integrate risk analysis throughout their QMS

Published: Thursday, May 7, 2015 - 16:35

Among the fallout from the final draft of the ISO 9001:2015 revision is a contextual change in the concept of “continual improvement.” The standard’s intent that organizations preemptively address likely issues before they become problems hasn’t changed; if anything, there’s an explicit toughening of the language to clarify what’s expected. However, some organizations are interpreting it as a justification to reduce the efforts they apply to prevention. I think this will prove to be a tactical mistake.

The updated standard is actually looking for a more quantitative analysis of issues that could be potentially harmful if not preemptively addressed. There’s clearly a move to incorporate risk assessment elements into every practical facet of a quality management system. An organization would be well-advised to broaden its vision and scope to include opportunities beyond the obvious such as supply chain; corrective action analysis; environment, health, and safety (EH&S) incident investigation; and internal assessment findings to include objectives, metric analysis, and training competency.

This is especially important when coupled with other positions taken in the new revision of the standard language. There should now be few, if any, reasons to take or attempt exclusion from any of the clauses of the standard. The reworking of the language has endeavored to make ISO 9001:2015 more transparently applicable to service providers that struggled to make sense and apply the very manufacturing-oriented language of previous editions.

Presentations prepared for management review meetings and activities should include some form of quantitative risk assessment, even if it’s a just a simple summary. The standard doesn’t give explicit directions for the means and methodology to be used. This should be taken as an opportunity to start with the basics and, if nothing else, plant an easily identified and quantified stake in the ground. This will give you a reference point to determine if you’re moving forward, slipping backward and increasing risk opportunities, or holding steady. A steady state can be taken as an indication that the current risk control and mitigation methods are marginally effective but should be improved and strengthened.

The clear message sent in the new revision of the standard is to integrate risk analysis—and therefore identify opportunities for improvement and prevention—in virtually everything you address in your quality management system. The standard’s requirements for continuous improvement and preventive actions haven’t gone away, become less important, or been replaced by some mysterious new mandate. Rather they have evolved into a more effective and practical application of your quality metrics and tools.

First published Apr. 22, 2015, on the Quality Management 2.0 blog.

About The Author

Mary McAtee

Mary McAtee has been a member of the Siemens organization for more than 20 years. She is a 40-year quality professional specializing in reliability engineering for semiconductor and nuclear devices. McAtee is an exam-qualified lead assessor for ISO 9001, ISO 14001, ISO 13485, IATF 16949, and TickIT. She has lead several organizations to successful registrations to various standards and has written and presented on the topic of compliance and quality extensively over the years. She is working with organizations in the United States and Europe to develop a broader uniform interpretation of primary norms and compliance standards.