Everybody talks about Risk Analysis according to ISO 9001 - what about the Opportunities?

ISO 9001 defines the requirements that quality management systems must meet. By fulfilling these requirements, companies can satisfy the demands of their stakeholders. However, the content of ISO 9001 is often interpreted in a one-sided manner. Only the risks are in the foreground, while the opportunities recede into the background. This perception does not do justice to the standard.

Part of a family of standards

ISO 9001 is part of the DIN EN ISO 9000 ff family of standards, which comprises the individual standards DIN EN ISO 9000, 9001, 9004 and 19011. This family of standards provides the framework for establishing an effective quality management system. ISO 9000 provides the basis for successful QM systems and explains the essential terms of quality management. ISO 9001, on the other hand, specifies the requirements for an effective QM system. The standard is comprehensive and complex because it is designed as a universal rule for all companies, regardless of size, company purpose or industry. But behind the complexity lies a sophisticated, intelligent and goal-oriented management system.

Targeted management system

For an overview, ISO 9001 can be divided into four fields:

• Requirements for the planning of the company: What should be realized?
• Requirements for implementation: In what way are services to be provided?
• Control requirements: How should it be measured whether the services have actually been provided?
• Requirements for improvement: In what way is it ensured that the company continues to develop?

Achieve goals and consider stakeholders

The provisions of ISO 9001 are intended to help companies to address, monitor and analyse the important issues for achieving the objectives. What is the current general economic situation? Which new technologies are relevant for the success of the company? What legal regulations does the company have to comply with? An ISO 9001 company should be able to answer all these questions in a well-founded manner. In doing so, it should also always consider the interests of the company's stakeholders, as its actions always have an impact on its environment. The concerns and expectations of employees, partners, suppliers, owners, government agencies and customers must be understood and taken into account by the company.

Risk assessment is essential

The core of ISO 9001 is customer orientation. According to the standard, all procedures and processes in the company are to be designed in such a way that the requirements of the customers are recognized and fulfilled on a permanent basis. Companies must permanently measure the extent to which they satisfy their customers' requirements. However, ISO 9001 does not prescribe which measurement procedure is to be used here. One of the core tasks of a quality management system is to fulfil an early warning function in order to guarantee customer satisfaction and to avert dangers from the company. The QMS must act in a forward-looking and preventive manner, which is one of the central requirements of ISO 9001.

Therefore, according to ISO 9001, risks and opportunities must already be identified during the development of the QMS. It is also imperative to define how opportunities and risks are to be dealt with at this stage. However, ISO does not require formal risk management. Nevertheless, companies must define and document their opportunities and risks. In this way, company leaders should identify potential developments, react to them more quickly and thus make the company fit for the future.

Risk AND opportunity

Risks and opportunities are present when decisions are made under uncertainty. This means that it is not yet clear today which event will occur in the future. The investment in a new machine may pay off in the future, but not necessarily. Maybe the purchase of the machine was a bad decision in the end. That is the risk involved in this investment. However, the entrepreneur does not expect this failure when he or she decides to buy this machine. In his estimation, the investment will pay for itself and contribute significantly to the success of the company.

This shows that a decision under uncertainty always involves both risk and opportunity. The risk of failure and the chance of success. Two sides of the same coin, inseparable. The requirements of ISO 9001 can also be seen as a call to bear this ambiguity in mind. Often the regulations are viewed only one-sidedly, focusing only on the fact that decisions under uncertainty involve risk. And it is forgotten how many opportunities they offer.

Systematic decisions under uncertainty

Some companies handle decisions under uncertainty systematically and professionally. Before making any important decision, they sketch out what outcomes could theoretically occur in the future. The purchase of the machine, for example, may prove to be a success in the future. The machine not only recovers its investment costs, but also proves to be a highly profitable investment (possibility 1). However, the purchase may also prove to be a wrong decision, the investment costs are not earned back (possibility 2). And then there is the theoretical option that the machine will exactly recover its investment costs (possibility 3).

These possible outcomes in the uncertain future can now each be assigned a probability of occurrence. The company calculates that there is a 70 percent probability that the investment in the machine will pay off. The managers estimate that there is a 20 percent chance that the investment will fail. And there is a 10 percent probability that the machine will just recoup its investment costs. The probabilities of occurrence can be estimated in different ways. Past experience can be used here, or a detailed analysis of the competition and customer requirements. The managers of the company can now make their decision based on this information. Their attitude towards the handling of risk and opportunity is a major factor here.

Examples of opportunities in ISO 9001

Section 0.3.3 of ISO 9001 lists examples of what is meant by opportunities:

• Development of new products and services
• Customer acquisition
• Improving productivity
• Reduction of scrap or waste

The explanatory notes to section 6.1.2 also list what may constitute an opportunity:

• Market launch of new products
• Entry into new markets
• Use of innovative techniques
• Adoption of new practices