ISO Insists “Risk-Based Thinking” is Easy, Then Publishes Thousands of Words Explaining It

The ISO talking points, first drafted back in December 2013, were the Ur-text of what would become the oft-repeated — and often discredited — claim that “risk has always been implicit in ISO 9001.” We discussed how that has resulted in “risk-based plagiarism” here. Those talking points have also insisted, despite all evidence to the contrary, that risk-based thinking is “easy” and “something you do every day” and even “something we all do automatically and often sub-consciously.”  

ISO went so far as to suggest that risk management, in its RBT form, is as easy as crossing the street.
So it’s a little surprising, therefore, that ISO has had to spend so much time, money and energy publishing a nearly endless string of explanatory documents teaching people how to cross the street. But ISO only makes money when selling standards, so it’s worth it to preempt any worries that ISO  9001:2015 is a complicated disaster by releasing free “stay calm and buy ISO 9001” white papers.

Here’s an accounting of all the documents published by ISO to date on the subject. (May be updated as we find more):

1. ISO 9001:2015 itself includes 1,120 words on “risk-based thinking” divided between on introductory clause, six requirements clauses, and an entire Annex.
2. ISO published document N065, a Powerpoint presentation on RBT – 575 words
3. ISO published document N1268, a Powerpoint presentation on RBT – 500 words
4. ISO published document N1222 “Risk in ISO 9001:2015” – 1500 words
5. ISO published document N1269  “ISO 9001 and risk” – 1450 words
6. ISO published document N1277  “Implementation Guidance Document” on ISO 9001, with passing reference to RBT
7. ISO Published document N1271, a FAQ on ISO 9001:2015 with about 175 words dedicated to RBT
8. ISO and IAF, through the Auditing Practices Group, published a 500-word white paper “Auditing Practices Group Guidance on: Risk Based Thinking”
9. ISO is working on ISO/TS 9002 for additional Implementation Guidance, the current draft of which includes 1,160 words dedicated to RBT
10. ISO is working on an update to its “implementation handbook” called “ISO 9001:2015 for Small Enterprises – What to do? Advice from ISO/TC 176” which includes about 800 words dedicated to explaining RBT.

That totals to about 7,780 words dedicated to explaining what ISO insists is something you were already doing. And this, of course, doesn’t touch on the overnight cottage industry ISO created for private consultants, who now charge hundreds to thousands of dollars on seminars, DVDs, books, and conferences dedicated to Risk-Based Thinking.

Meanwhile, ISO has been unable to provide any evidence that it applied risk-based thinking before inventing risk-based thinking. They’ve been asked for a design study, a peer-reviewed paper, or an analysis of any kind showing they studied RBT for creating it, and they have failed to produce a single word. Presumably the typewriters in Geneva are already booked for pumping out press releases, and not actual data.