Managing Risk IGMA Winter Conference Tucson, Arizona Feb 1, 2018 - PDF document

IGMA 2017/18 Strategic Planning Workshop July 31, 2017 Managing Risk IGMA Winter Conference Tucson, Arizona Feb 1, 2018 this workshop was brought to you by www.human.ca 1 What is Risk and why should we be interested in it? Risk refers to the uncertainty that surrounds future events and outcomes (negative or positive). Risk is the expression of the likelihood and impact of an event with the potential to influence (negatively or positively) organizational objectives. 6.1 Actions to address risks and opportunities 6.1.1 When planning for the quality management system, the organization shall consider the issues referred to in 4.1 and the requirements referred to in 4.2 and determine the risks and opportunities that need to be addressed... this presentation was brought to you by www.human.ca 2 Montreal, Quebec Summer Conference 1

IGMA 2017/18 Strategic Planning Workshop July 31, 2017 Difference Between Risk and Opportunity A risk is a potential for a loss. An opportunity is a potential for a gain. Most strategies and plans entail both risk and opportunity. As such, both play a role in decision making, strategy formation and management. We want to avoid risks and exploit opportunities . “ Opportunity is not the positive side of risk. An opportunity is a set of circumstances which makes it possible to do something. Taking or not taking an opportunity then presents different levels of risk .” (ISO paper RISK‐BASED THINKING IN ISO 9001:2015) this presentation was brought to you by www.human.ca 3 ISO 9001:2015 Requirements 4.1 Understanding the organization 4.2 Understanding the needs and expectations and its context of interested parties Due to their effect or potential effect on the The organization shall determine external and organization’s ability to consistently provide products internal issues that are relevant to its purpose and its strategic direction and that affect its and services that meet customer and applicable ability to achieve the intended result(s) of its statutory and regulatory requirements, the organization quality management system. shall determine: a) the interested parties that are relevant to the quality management system; b) the requirements of these interested parties that are relevant to the quality management system. this presentation was brought to you by www.human.ca 4 Montreal, Quebec Summer Conference 2

IGMA 2017/18 Strategic Planning Workshop July 31, 2017 ISO 9001:2015 Requirements ‐ continued 4.4 Quality management system and its processes 10.2 Nonconformity and corrective action f) address the risks and opportunities as determined in e) update risks and opportunities determined during accordance with the requirements of 6.1; planning, if necessary; 5.1 Leadership and commitment A.4 Risk‐based thinking d) promoting the use of the process approach and risk‐based This International Standard specifies requirements for the thinking; organization to understand its context (see 4.1) and 5.1.2 Customer focus determine risks as a basis for planning (see 6.1). b) the risks and opportunities that can affect conformity of Although 6.1 specifies that the organization shall plan actions products and services and the ability to enhance customer to address risks, there is no requirement for formal methods satisfaction are determined and addressed; for risk management or a documented risk management process. 9.1.3 Analysis and evaluation e) the effectiveness of actions taken to address risks and A.8 Control of externally provided processes, products and opportunities; services 9.3.2 Management review inputs The organization can apply risk‐based thinking to determine e) the effectiveness of actions taken to address risks and the type and extent of controls appropriate to particular opportunities (see 6.1); external providers and externally provided processes, products and services.; this presentation was brought to you by www.human.ca 5 Where can we use risk‐based thinking? Here are some examples where you can use risk (and opportunity) based thinking throughout your organization: a) Strategic planning b) Launching new products c) Opening new markets d) Building partnerships and joint ventures e) Using new technology f) Project management g) Improving products and services h) Improving processes Over the next hour we’ll take a look at 3 risk‐based thinking tools . this presentation was brought to you by www.human.ca 6 Montreal, Quebec Summer Conference 3

IGMA 2017/18 Strategic Planning Workshop July 31, 2017 1 Here’s a risk‐based thinking tool to improve processes Failure Mode & Effects Analysis this workshop was brought to you by www.human.ca 7 What is an Failure Mode and Effects Analysis? Failure modes and effects analysis ( FMEA ) is a step-by-step approach for identifying potential risk of failure in the design, creation and/or delivery of a product or service. It then assists in implementing plans to prevent the most likely causes of failure. this presentation was brought to you by www.human.ca 8 Montreal, Quebec Summer Conference 4

IGMA 2017/18 Strategic Planning Workshop July 31, 2017 A Three Dimensional Risk Assessment FMEAs evaluate three key dimensions of process failure; severity, occurrence and detection on a scale of 1 to 10 (1 lowest, 10 highest). 1. Severity is a measure of how damaging a failure would be. 2. Occurrence tells us how often this type of failure might occur. 3. Detection is an estimate of how likely it is that you will detect the failure prior to its having a harmful effect. this presentation was brought to you by www.human.ca 9 Failure Mode and Effects Analysis Template this presentation was brought to you by www.human.ca 10 Montreal, Quebec Summer Conference 5

IGMA 2017/18 Strategic Planning Workshop July 31, 2017 Step 1 – Define the Process Steps A Failure Mode and Effects Analysis (FMEA) begins by specifying the process to be studied. You should have a process flow diagram (PFD) of the process or at the very least have identified the steps. Record the process or product name and process owner in the top left of the FMEA template. Then record the key process steps in Column 1 of the FMEA template. this presentation was brought to you by www.human.ca 11 Step 2 – Identify Potential Failure Modes Identify significant failure mode(s) for each process step and document them in Column 2 on the FMEA form. You can repeat this process for different failure modes. this presentation was brought to you by www.human.ca 12 Montreal, Quebec Summer Conference 6

IGMA 2017/18 Strategic Planning Workshop July 31, 2017 Step 3 – Potential Effects of the Failure Modes Write down the effects that would happen if the potential failure were a real failure. How would the failure impact your company? Your suppliers? Your customers? What would be the worst possible outcomes? this presentation was brought to you by www.human.ca 13 Step 4– Severity of the Failure Mode The Severity Rate (S) is the "best guess" of how serious it would be to the customers, the product, or the service if the failure really occurred. 9 - 10 : With potential safety risk or legal problems - potential loss of life or major dissatisfaction 7 - 8 : High potential customer dissatisfaction - serious injury or significant mission disruption 5 - 6 : Medium potential customer dissatisfaction - potential small injury, mission inconvenience, or delay 3 - 4 : The customer may notice the potential failure and may be a little dissatisfied - annoyance 1 - 2 : The customer will probably not detect the failure - undetectable this presentation was brought to you by www.human.ca 14 Montreal, Quebec Summer Conference 7

IGMA 2017/18 Strategic Planning Workshop July 31, 2017 Step 5 – Potential Causes of the Failure For the failure mode listed in Step 2, write down all factors the team can think of that could cause the failure to occur. this presentation was brought to you by www.human.ca 15 Step 6 – Occurrence of the Failure Mode The Occurrence Rate (O) is an estimate of how often the failure happens due to each specific cause listed in Step 5. 9 - 10 : Very high probability of occurrence 7 - 8 : High probability of occurrence 5 - 6 : Moderate probability of occurrence 3 - 4 : Low probability of occurrence 1 - 2 : Remote probability of occurrence this presentation was brought to you by www.human.ca 16 Montreal, Quebec Summer Conference 8

IGMA 2017/18 Strategic Planning Workshop July 31, 2017 Step 7 – Current Controls For each of the failure mode causes in Step 5, write down the current controls that are in place to prevent the causes from occurring. this presentation was brought to you by www.human.ca 17 Step 8 – Detection of the Failure Mode The Detection Rate (D) is an estimate of how difficult it is to detect the failure before the customer sees it. 9 - 10 : Zero probability of detecting the potential failure cause 7 - 8 : Close to zero probability of detecting potential failure cause 5 - 6 : Not likely to detect potential failure cause 3 - 4 : Good chance of detecting potential failure cause 1 - 2 : Almost certain to identify potential failure cause this presentation was brought to you by www.human.ca 18 Montreal, Quebec Summer Conference 9