ISO9001, TQM, Lean, Six Sigma, Human Error Reduction, Quality, Environment, Safety, Health… are all ways of seeing (the same) things from a different perspective. Full of energy, we jump on every new hype or wave. Our ultimate goal: to create an ideal organization where nothing goes wrong.

But step by step, we start to realize that “zero fault tolerance” is out of reach, it’s an illusion. If we ever achieve to proactively track and tackle all the thinkable conditions that might influence the risk of error, some new conditions will loom up out of nothingness. We have to face the fact that we live in a very complex and dynamic world. Today’s reality will be completely out of date by tomorrow. Our organization continuously goes through all kinds of (sometimes drastic) changes.

Sidney Dekker, Erik Hollnagel, David Woods and some of their colleague-experts in the field of safety, human error and risk management clearly state that the one and only answer is to create a “resilient organization”. Resilience. By inspecting our organization and processes (e.g. the Swiss cheese model of James Reason) we can map most of the unnecessary conditions and contributors of errors, but it will never be enough. We must make our people and our organization more resilient: to prevent “bad” from becoming “worse”, and to be able to recover from “worse” if it happens anyway.

People are not the weakest link in the chain; on the contrary, they are the strength of every organization. If a software application contains some substantial conceptual errors, the computer system will not be able to recover without the help of developers. Human beings on the contrary are able to recover from errors without any help from outside. It would be the wrong strategy to remove the human factor form our processes. Instead, we should make our people, and thus our organization, more resilient so that they are armed against unforeseen situations, so that they are ready for battle.

People who are interested in this subject are free to contact Protecting Achilles. We will be glad to change some ideas and see how we can be of any help.

1. Schedule a formal conversation to draw up a list of all wishes and demands. Denote to the customer how crucial this meeting is to assure a good cooperation. It’s not just a “casual” trifle.
2. Ask open questions and not just questions that can be replied to with a few words. Dare to keep on asking but obviously you want to stay polite. Should you encounter a customer or prospect refusing to answer your questions, chances are real that you are being used, to get a second or third quote for example.
3. Ask them how their organization deals with quality. This can reveal an interesting opportunity to see what they will really value in a cooperation.
4. Paraphrase. You restate what the customer tells you in your own words. This has 2 advantages: for one thing the customer will feel understood and appreciated and on the other hand you will prevent misapprehension.
5. Make notes, make notes, make notes. By meticulously making notes you’re not only showing your interest in what the customer tells you. It also helps you remember what is important. Studies have shown that without making notes people forget over 50% of what has been said in less than 5 minutes.

It seems everyone is talking about risk management, whether it’s about financial investments, political strategies, or quality management. Like other quality initiatives, it may be regarded as simply another “quality program du jour”, but a well-managed risk management program helps focus improvement effort on the truly important issues, resulting in more effective and efficient means of maintaining and improving quality.

Each industry seems to promote different methods for risk management; FMEA in the automotive industry, HACCP in food and pharmaceuticals, HAZOP in chemicals, and ISO 14971 in medical devices, but each method contains similar methods for analyzing risk. Regardless of the method, potential hazards or risks are identified and evaluated to determine a cause or failure mode, and each hazard or risk is assigned a measure of criticality and a measure of the frequency of occurrence (some methods add a third measurement of failure detection). After considering the combined risk for an uncontrolled or failure state, controls methods are devised to mitigate risk, and the combined risk is re-evaluated. Risks that are above a specified threshold are subjected to further analysis to determine methods to reduce risk to an acceptable level.

Unfortunately, some organizations do not actually practice effective risk management. Instead, they go through an exercise of analyzing risk with and without controls, making impressive risk charts, wiping the sweat off their brows following the work, and simply pulling out the file whenever an auditor asks for it.

But an effective risk management program should be a living process. In programs I have managed, I’ve made it a policy to have each risk management file reviewed on at least an annual basis. Changes to risk analysis should be made using data collected from sources such as customer complaints, audit findings, industry white papers and articles, public reports, and other data sources (perhaps even an idea from a blog!). New control strategies are then developed to address previously unidentified or significantly changed hazards and risks.

Finally, managing risk is not necessarily easy, but it is rewarding. Perhaps the best comment I ever heard following some intensive sessions was from an individual who said, “I thought this would just be another exercise in bureaucracy, but I have to admit I know more about our product and processes than I ever knew before.”

What about you? Have you used risk management and has your experience been favorable? Share your thoughts with us.