13.1 Risk Assessment Inputs, Monitoring, and Control Plans

13.1 Risk Assessment Inputs, Monitoring, and Control Plans

Risk-Based Thinking Replaced the Preventive Action Clause

ISO 9001:2015 clause 6.1 (Actions to Address Risks and Opportunities) requires an organization to determine the risks and opportunities that could affect conformity of products and services and the ability to enhance customer satisfaction, to plan actions to address them, and to evaluate the effectiveness of those actions. This clause replaced the standalone preventive-action clause that existed in earlier editions: risk-based thinking is preventive action, built into every process instead of sitting in its own procedure.

For a quality technician this is not a documentation detail. It changes the daily question from "did this part conform?" to "what is this data telling me is about to go wrong?"

Risk in this context is the effect of uncertainty on an expected result — an effect that may be negative (a threat) or positive (an opportunity). Risk assessment combines two dimensions:

$\text{Risk} = f(\text{Severity of the consequence},\ \text{Likelihood of occurrence})$

and, in failure-mode work, a third: how likely the organization is to detect the problem before the customer does (Section 13.2).

---

The Methods of Risk Assessment and Mitigation

ISO 14971 provides the formal risk-management framework for medical devices, and IATF 16949 requires control plans and FMEAs as standing automotive requirements, but the underlying logic is identical everywhere: identify what can go wrong, rank it, control it, and monitor whether the control is working.

---

Inputs to Risk Assessment

Risk assessment is only as good as the data fed into it. A technician is usually the person closest to several of these inputs.

[!IMPORTANT] Escapes matter more than rejects. A defect found at in-process inspection is the system working. The same defect found at final inspection means an in-process control failed. The same defect found by the customer means every control failed. Sorting the same defect count by where it was found converts ordinary reject data into a risk signal about the control system.

---

Trend Analysis: Using SPC as a Risk Tool

Control charts are usually taught as a process-control tool; the Body of Knowledge lists trend analysis (SPC) as a risk assessment method, and the difference is the time horizon.

Three risk-relevant patterns (the run rules of Section 6.3 applied to management metrics):

1. A trend — six or more consecutive points moving in one direction — on a Cpk-by-month chart means the process is deteriorating even if no part has yet been rejected. Tool wear, fixture wear, and supplier drift all look like this.
2. A shift — nine or more consecutive points on one side of the centerline — after a known change confirms the change had an effect, whether or not anybody expected one.
3. Increasing dispersion — a widening range chart with a stable average — is the classic precursor to a capability failure, because Cpk erodes from the spread rather than from the mean.

Charting a metric rather than a characteristic also protects against the most common management error: treating every monthly movement as a special cause. Applying control-chart logic to a scrap-rate metric tells you whether last month's increase is a signal or noise, which decides whether a corrective action is warranted at all.

---

Control Plans

A control plan is the document that states, operation by operation, what is controlled, how, how often, by whom, and what happens when the control detects a problem. It is the bridge between the PFMEA (what could go wrong) and the work instruction (what the operator does).

The Three Types

Pre-launch control plans deliberately over-inspect. Moving to the production control plan too early — before capability and stability are demonstrated — is one of the most common launch failures.

What a Control Plan Contains

[!CAUTION] The reaction plan is the column technicians are tested on. A control plan that specifies a characteristic, a gage, and a frequency but leaves the reaction plan blank has documented detection without documenting response. When an out-of-control point appears, the operator does not know whether to stop the machine, how far back to contain, or whom to call, and the containment boundary expands with every minute of confusion.

Keeping the Three Documents Consistent

The PFMEA, the control plan, and the work instruction must agree. A PFMEA that calls for a torque check every hour, a control plan that says once per shift, and a work instruction that mentions no torque check at all is a systemic finding regardless of which document is right. When any one of them changes, the other two are reviewed — and a control plan is always reviewed after a nonconformance, a customer complaint, an engineering change, or a process change.

---

Ranking and Mitigating Risk

The Risk Matrix

Ranking dissimilar risks requires a common scale. A simple matrix crosses consequence against likelihood:

                        LIKELIHOOD
              Rare    Unlikely  Possible  Likely   Frequent
            +--------+--------+--------+--------+--------+
  Severe    | MEDIUM |  HIGH  |  HIGH  | EXTREME| EXTREME|
            +--------+--------+--------+--------+--------+
  Major     |  LOW   | MEDIUM |  HIGH  |  HIGH  | EXTREME|
S           +--------+--------+--------+--------+--------+
E Moderate  |  LOW   |  LOW   | MEDIUM |  HIGH  |  HIGH  |
V           +--------+--------+--------+--------+--------+
E Minor     |  LOW   |  LOW   |  LOW   | MEDIUM | MEDIUM |
R           +--------+--------+--------+--------+--------+
I Negligible|  LOW   |  LOW   |  LOW   |  LOW   | MEDIUM |
T           +--------+--------+--------+--------+--------+
Y

The matrix is a communication tool, not a calculation. Its value is forcing a cross-functional team to agree on where each risk sits, and its danger is the same arithmetic trap as the Risk Priority Number (Section 13.2): a high-severity, low-likelihood risk can be scored down into complacency. Severity is never reduced by argument — it is reduced only by changing the design or the consequence.

The Four Mitigation Strategies

Acceptance is a legitimate decision only when it is explicit, documented, and monitored. Undocumented acceptance is just an unmanaged risk with a better name.

---

Worked Example: Reading the Inputs Before Anything Fails

Situation: A machining cell has shipped no nonconforming parts in six months. The technician assembles the monthly monitoring data:

Analysis:

1. Cpk shows a five-point downward trend. No specification has been violated, but capability is eroding steadily — the signature of progressive tool, fixture, or spindle wear.
2. The escape location is migrating downstream. Final-inspection catches rose from 0 to 3, meaning the in-process control is no longer catching what it used to. This is a risk signal about the control, not only about the process.
3. The first customer complaint arrived in August, after eight months of data that predicted it.

Action: This is a risk-assessment finding, not a nonconformance. Raise it through the control-plan review: investigate the wear mechanism, tighten the in-process frequency as an interim control, evaluate a PFMEA update for occurrence and detection ratings, and set a monitoring trigger on the Cpk trend. Waiting for a rejected lot would have converted a preventable trend into a corrective action and a customer escape.

---

Common Exam Traps for CQT Candidates

[!CAUTION] Trap 1: Believing ISO 9001:2015 removed preventive action. It removed the separate clause and distributed the requirement through risk-based thinking in clause 6.1. The obligation is stronger, not weaker.

Trap 2: Treating every monthly movement in a metric as a special cause. Apply control-chart logic to the metric first; reacting to noise is tampering (Section 5.1).

Trap 3: Counting defects without sorting them by where they were found. In-process, final, and customer discovery carry completely different risk meanings for the same defect.

Trap 4: Leaving the reaction plan column blank. A control plan that detects without prescribing a response leaves containment to improvisation.

Trap 5: Scoring severity down. Likelihood and detection can be improved by controls; severity changes only when the design or the consequence changes.

Trap 6: Letting the PFMEA, control plan, and work instruction drift apart. Inconsistency among the three is a systemic finding by itself.

Trap 7: Accepting a risk silently. Acceptance must be explicit, documented, monitored, and have a defined review trigger.