What do we do about Risk Management?

Risk management is an activity directed towards the assessing, mitigating and monitoring of risk. In most day-to-day cases the acceptable risk may be determined low or close to zero. Risks can come from accidents, natural causes and disasters as well as deliberate attacks from an outside source. Technically, the notion of risk is independent from the notion of value and, as such, possible occurrences may have both good and bad consequences.

Consider the following when establishing risk areas or activities;
1. Identify risk in a selected or selected area of interest,
2. Document the identified risk by using for example a Process Flow Diagram method,
3. Establish the following:
- the scope of the risk management activities,
- the the identity and objectives of nay stakeholder requirements, and
- on what basis the risks will be evaluated, constraints.
4. Define a framework for the above activities and develop an agenda for identification and review of existing and future risks.
5. Develop what methods to use to analyze existing risks involved in your risk areas and its processes.
6. When mitigate risks we can consider using convinient and available technological, human and organizational resources.

Analyze Risk

After establishing the areas in your processes/activities were risk may occur and we have identified the risks this might entail, the next step to analyze these potential risks. Risks are about events that, when triggered, cause problems and for that reason risk identification always starts with the source of problems, or with the problem itself. For example the following methods could be considered;
• Source analysis Risk sources may be internal or external to the processes/activities that is the target of risk management. Examples of risk sources are: stakeholders of a project, employees of a company or the weather over an airport.
• Problem analysis Risks are related to the identified threats of said risk. For example: the threat of losing money, the threat of abuse of privacy information or the threat of accidents and casualties. The threats may exist with various entities, most important with shareholders, customers and legislative bodies such as the government. The chosen method of identifying risks may depend on culture, industry practice and compliance.

AS9100 C Risk Managment

In the new revision of the AS9100 standard, an emphasis is being placed on clause 7.1.2 - Risk Management. Understanding and embracing these changes will better position your organization for growth and profitability. It's a matter of survival especially during these uncertain times. The new requirement is to implement a risk management process applicable to the product and organization that includes responsibility, criteria, mitigation, and acceptance.

The purpose of adding risk management in clause 7.1.2 is to provide an additional focus on product risk during product realization. However, AS9100 is not prescriptive about how this should be implemented. They have kept this part flexible to allow an organization to choose the best method of analysis appropriate to the product. AS9100 C Implementation benefits include measuring, analyzing, and improving product quality and on-time delivery performance, and formally monitoring customer satisfaction data and trends. Also, plans will be needed to ensure continuous improvement.

For more information on implementing risk management and the new requirements of AS9100 Rev C see AS9100C Changes and How to Update and AS9100C Document Packagesor contact us today!