Playing Chess in the Dark

Traditional companies are managed by crises (Firefighting). When a machine breaks down, it is repaired; when a customer returns a product, a new one is sent; when a workplace accident occurs, a safety measure is taken. This "reactive" approach keeps the company constantly on the defensive and drives costs to massive scales.

The biggest revolutionary concept introduced with the historic 2015 revision of ISO standards was Risk-Based Thinking. Standards no longer expect you to write a separate procedure called "Preventive Action"; because they dictate that the system itself must be a preventive action in its entirety.

Picture 1

Science Against Fatalism

Risk is defined as "the effect of uncertainty on objectives." Risk-Based Thinking is the art of mathematically managing future uncertainties by putting them on the table today, rather than waiting for them with fatalism.

A good management system asks these three ruthless questions at the beginning of every process:

  1. What could go wrong? (Risk identification)
  2. If it goes wrong, what will it cost us, and what is the probability of it happening? (Risk assessment - Probability x Severity)
  3. What must we do NOW to prevent it from happening or to mitigate its impact? (Risk mitigation)

If there is political instability in the region where your supplier is located (Context of the Organization), a delay in material is not fate; it is a foreseeable risk. A company that employs risk-based thinking will have approved and integrated an alternative supplier months before that crisis occurs.

Turning Risks into Opportunities

The word risk is often perceived only negatively (Threats). However, risk-based thinking also covers the other side of the coin: "Opportunities."

If you foresee a vulnerability in your competitors' supply chain, you can make an early logistical move to increase your market share. Risk management is not just done to "survive"; it is also done to "make a difference" and grow through Calculated Risks.

In short, when an ISO auditor visits your factory, they don't want to see your forms; they want to see "how you accounted for potential disasters and opportunities when making decisions." The quality of the system is determined not by how fast you put out fires, but by how few fires you start.