In the 2015 version of the ISO9001 quality management standard risk and opportunity management are something completely new. In our update process, this turned out to be one big entity, which we found easy to work with and which in the end, also produced great results and new ideas.
There are many definitions for risk management depending on viewpoint. We found a good Finnish site, which provided easy-to-understand guidelines and useful background material. We used their classification to divide the task into smaller entities and assigned working groups for each of these entities.
At first, we were a bit skeptical as to how much enthusiasm the task would generate. Usually these kinds of tasks are often overridden by the ever so pressing day-to-day responsibilities. So imagine our surprise, when the working groups reported back with heaps of content and even in the given timeframe. When going through the Excel sheets, we were spoiled with choice; it seemed that every part of the organization had been gone through with a risk management comb. It makes you wonder though, about what kind of company gets so excited about risks…
But in all seriousness… The risk management task probably gave our personnel a chance to look at things from a completely new perspective. Also, I guess they also saw a good opportunity to point out important matters in their own field of expertise. And this is definitely how it should be, since company management cannot possibly see or know everything. That’s why sometimes you need to go and ask from those who know.
Nearly all groups raised risks related to key personnel and to the valuable experience and knowledge they possess. What would happen if and when these persons no longer work for Ekocoil? The large amount of this un-documented, so-called tacit knowledge is one of the biggest challenges small and medium sized enterprises face. Their employees often have a long working history and in many cases have had different kinds of roles and responsibilities. When the company started out small, there never was a need to document much since it was possible to rely on someone always knowing the answer. As years have gone by, companies are now faced with questions like: “what if our head designer falls ill” or “what happens when our maintenance guy retires”. On the flip side, there are answers to these questions and the risk management exercise produced some new, innovative insights. The topic is so important, that it deserves its own post later on as part of knowledge management series.
But back to risk management. What sorts of practical advise would I give based on our experiences? First, involve the whole personnel. Take sometime to get familiar with risk management and don’t forget the other aspect: have a look at opportunities as well. Divide the task into smaller parts and form groups from people with different kind of expertise. These are the persons with the best viewpoint. Remember to evaluate the severity of risks as well as the likelihood that they will someday realize. And most importantly – try to outline preventive actions with plans and responsibilities. It might be worthwhile to also consider, if some risks are such that they can be tolerated, meaning the risk is knowingly taken.
Wishing you a risk-free year 2016 filled with opportunities!