Risk-Based Thinking in Quality Management, an ISO 9001:2015 Requirement : A case study to identify underlying elements enabling risk-based thinking in organizations

Abstract

Issues and Purpose One of the most significant changes in ISO 9001:2015 versus ISO 9001:2008 is the increased focus on risk-based thinking (RBT) in requirements for planning, review and improvement of the quality management system (QMS) and its processes. To enable RBT in organizations related to the QMS, management must understand what RBT is, and have knowledge about the theoretical foundation of the term. A theoretical foundation for RBT is found to be lacking in literature. This is considered a significant challenge for management seeking to implement RBT with regards to their QMS. Consequently, the objective of this study is to identify elements from quality and risk management theories as a potential basis for RBT. Due to the positive implications that RBT might have on improving an organization’s QMS this is considered an important area to address. Scope and Limitations The scope of this study is limited to identify underlying elements for RBT in organizations, and conceptualize them in a model. The model is investigated in the context of a case company to discuss the effects of implementing RBT for improving an organization’s QMS. Underlying elements in the model and their interrelationships are discussed to some extent, but are not the main purpose of this study. Methods A constructive research approach was used for this study, this is a method suitable for developing models and other constructions that can contribute to theory in the field of research. This included gathering qualitative data from multiple sources, such as literature and case study. Most of the source material consisted of literature regarding topics such as; quality management, risk management, systems theories, and the ISO 9000 family of standards. The data collected from the case study was compared and discussed based on literature and the theoretical framework. The findings were used to validate the potential basis for a foundation for RBT, as presented in this thesis. Discussion In order to propose a basis for a foundation regarding RBT I had to gain some insights into quality and risk management. Characteristics emphasized in Total Quality Management (TQM) and Enterprise Risk Management (ERM) were considered essential for RBT. Based on this, the underlying elements for conducting RBT were identified as; Process, Organization, Culture, Competence, and Management, referred to as the POCCM-model in this thesis. Arguably, other elements could also be added to the model. However, in this thesis I found POCCM to be a sufficient proposal as a foundation for RBT. The POCCM-model provides a relevant contribution to better understand RBT and its foundation. Findings demonstrate that the elements in POCCM-model are a good representation of underlying elements in RBT. There is a correlation between the theories and characteristics proposed as a potential foundation for RBT and the results from the case study. The POCCMmodel was used to assess the current situation of case company’s QMS with regards to RBT. This revealed that improvement of the elements in the organization related to the POCCM-model would result in an overall improvement regarding RBT, leading to opportunities for improving the QMS. Evaluation The POCCM-model is grounded in known theories and quality standards; TQM, ERM and ISO 9001:2015. Findings have demonstrated a positive alignment of the POCCM-model, RBT and the theoretical framework. The findings are considered to be similar within other organizations in Norway, based on culture and values. Consequently, the proposed model, or a similar model is considered the most appropriate representation of the foundation concerning RBT. However, there is a potential to describe the POCCM-model from a more practical perspective. Thus, making it easier for organizations to implement RBT in their QMS