The intent was to create “risk lite,” something flexible enough to fit a giant global corporation that might implement ERM (enterprise risk management) along the lines of COSO or some other established standard, as well as the tiny 5-man machine shop that might not have ever heard the word “risk” before. It was an admirable goal, but the execution has proven disastrous.<\/p>\n
And spew they have.<\/p>\n Release the Hounds<\/strong><\/p>\n Larry Whittington recently published a newsletter on RBT in which he, too, declares RBT is risk management, and then goes on to define the standard FMEA-style of risk assessments that requires one to assign a likelihood factor and multiply it by a consequence factor, to come up with a magical number that will solve all your problems. Nowhere does Whittington clarify that this is just his opinion on how to approach RBT, nor that it contradicts what TC 176 has said about it. A casual reader will understand this as a requirement<\/em><\/strong>, in fact. Of course, he’s selling courses on this approach, complete with FMEA style handouts<\/a>, so admitting that RBT doesn’t actually require any of this stuff would hurt his bottom line.<\/p>\n (When I confronted Larry about this, he merely changed the title of his article, but hasn’t changed a word in his training presentations or marketing.)<\/p>\n From the Whittington training materials. Not a single thing here is an actual requirement, and actually contradicts official TC 176 opinion.<\/p><\/div>\n Over at Scott Paton’s website InsideStandards, which also publishes Whittington’s stuff, Lance Coleman wrote a piece<\/a> on RBT also declaring (wrongly) that it is “risk management” not just once, but fifteen times<\/strong><\/em>. Editor Paton never seemed to notice.<\/p>\n From the InsideStandards piece by Lance Coleman; even the graphic is wrong.<\/p><\/div>\n Not to be left out whenever gross misreporting is going on, Quality Digest gets it’s spin machine rolling in an article<\/a> written by Intertek’s Paula Oddy and Jeff Eves, which declares\u00a0the new ISO 9001 draft is “proof that quality management and risk management can no longer be considered separate issues for your organization.” <\/em>Waiter, I’ll have what they’re drinking.<\/p>\n The ever-spamming CERM Academy founder Greg Hutchins is insisting<\/a>, also falsely, that ISO has adopted risk-based thinking for all<\/em> <\/strong>its management standards, when of course it hasn’t; RBT only applies to\u00a09001. Nevertheless, Hutchins — who only refers to himself in the plural (“we”) — has refused to correct this misinformation even after being confronted with it multiple times. He is using his distortion of ISO’s risk-based thinking to sell “Certified Risk Manager” certificates to anyone stupid enough to believe they mean anything. Not only that, Hutchins is just falling short of claiming he invented<\/em> <\/strong>risk-based thinking, saying he started “the journey” of RBT over a decade\u00a0ago, even though he had no role in TC 176 nor in the development of ISO 9001, and nobody on the committee knows who he is.<\/p>\n Michael Shuff at Cognidox claims<\/a>\u00a0“among the key changes …\u00a0in the ISO 9001:2015 quality management system standard, and available to read in the Draft International Standard (DIS) published in May 2014, are… the focus on risk management.”<\/em><\/p>\n The registrars, who have a lot to gain by selling risk management training courses and (soon<\/a>) organizational risk management certifications, are in on the game, too, natch. SGS just opens the fountain of nonsense by selling a course<\/a> that claims you can develop a full-blown “risk management system (RMS) based on the principles of ISO 9001.<\/em>”\u00a0As I mentioned above, Intertek is busy spreading the same stuff, but using their “content partner” Quality Digest as their platform.\u00a0BSI admits that, no, ISO 9001 doesn’t require risk management, but then goes on to lie<\/a> and tell you why you need to take their risk management training anyway:<\/p>\n While the new structure for these updated standards does not mandate a specific risk methodology, regulators and other third-party auditors require evidence of the logic behind an organization\u2019s decision process. Therefore, risk-based thinking begins to require a more formal and organized approach.<\/p><\/blockquote>\n The Fallout<\/strong><\/p>\n So what’s the impact of this mess? Other than, of course, an entire industry filling in the vacuum left by TC 176 with misinformation? There are multiple problems that will affect real ISO 9001 end users, and cost them real dollars, both problems about\u00a0which the spreaders of this junk simply don’t care.<\/p>\n First, the imposition of a single method of risk management — which, by the looks of it, will be FMEA — doesn’t allow for the flexibility originally envisioned by TC 176. In fact, it contradicts<\/em> it, and risks strangling smaller companies who don’t have the resources to do this kind of thing.<\/p>\n Next, no two sources of this misinformation agree on specifically how<\/em> RBT is equal to risk management, even as each one of them insists they are the most reliable subject matter expert. So an end user may adopt the approach of one source (probably a trainer, consultant or registrar) only to find their CB auditor — who was trained by some other<\/em> source — disagrees. Now we have conflict over what is a bogus nonconformity to begin with.<\/p>\n Finally, the costs of all these activities can mount quickly. Training, execution and then the ultimate repairs when the whole thing fails to work, will cost companies a bundle, thus increasing ISO 9001’s poor reputation for lousy ROI, and further alienating potential users.<\/p>\n If, instead, those claiming to know this stuff admitted that, no, risk-based thinking doesn’t<\/em> require full blown risk management, we would be off to a good start. Instead, such experts should be presenting a flexible, scaled idea of what companies might<\/em>\u00a0do to comply, and offer it as a suggestion, not imply that it is a single means to meet an imaginary requirement.<\/p>\n Meanwhile, TC 176 can’t seem to get its act together, is denying there’s a problem, and insists on telling us it’s all about a footbridge.<\/p>","protected":false},"excerpt":{"rendered":" The so-called professionals are declaring that the upcoming ISO 9001 revision’s New Age, beaded-curtain fabrication called “risk based thinking” is actually full-blown risk management, even as TC 176 scrambles to get them to stop saying this.<\/p>","protected":false},"author":2,"featured_media":5181,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_et_pb_use_builder":"","_et_pb_old_content":"","_et_gb_content_width":"","mc4wp_mailchimp_campaign":[],"footnotes":""},"categories":[450,5],"tags":[359,43,14,116,194,263,240,42],"class_list":["post-5174","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-best-of","category-opinion","tag-insidestandards","tag-iso","tag-iso-9001","tag-iso-90012015","tag-quality-digest","tag-rbt","tag-risk-based-thinking","tag-tc-176","et-has-post-format-content","et_post_format-et-post-format-standard"],"_links":{"self":[{"href":"https:\/\/www.oxebridge.com\/emma\/wp-json\/wp\/v2\/posts\/5174","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.oxebridge.com\/emma\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.oxebridge.com\/emma\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.oxebridge.com\/emma\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/www.oxebridge.com\/emma\/wp-json\/wp\/v2\/comments?post=5174"}],"version-history":[{"count":3,"href":"https:\/\/www.oxebridge.com\/emma\/wp-json\/wp\/v2\/posts\/5174\/revisions"}],"predecessor-version":[{"id":5183,"href":"https:\/\/www.oxebridge.com\/emma\/wp-json\/wp\/v2\/posts\/5174\/revisions\/5183"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.oxebridge.com\/emma\/wp-json\/wp\/v2\/media\/5181"}],"wp:attachment":[{"href":"https:\/\/www.oxebridge.com\/emma\/wp-json\/wp\/v2\/media?parent=5174"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.oxebridge.com\/emma\/wp-json\/wp\/v2\/categories?post=5174"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.oxebridge.com\/emma\/wp-json\/wp\/v2\/tags?post=5174"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}![\"footbridge2\"](\"http:\/\/www.oxebridge.com\/emma\/wp-content\/uploads\/2015\/04\/footbridge2.jpg\")
TC 176 attempted to clear up their scented candle, Om-gong meditative process by publishing a few official documents<\/a> on RBT, and openly stating that no, risk based thinking did not require full blown risk management. But the result comes off as a manifesto written by a stoned 60’s hippie, which probably made sense to the author, but which doesn’t quite work to anyone in the sober world. Their reliance on inane “real-world” metaphors (that goddamn\u00a0footbridge story insults the entire planet’s intelligence in one swipe) and lack of firm requirements has left RBT an open vessel, ready to be filled by whatever crap the usual suspects can spew.<\/p>\n![\"whittingtonrisk\"](\"http:\/\/www.oxebridge.com\/emma\/wp-content\/uploads\/2015\/04\/whittingtonrisk.jpg\")
![\"colemanrisk\"](\"http:\/\/www.oxebridge.com\/emma\/wp-content\/uploads\/2015\/04\/colemanrisk.jpg\")
![\"bsirisk\"](\"http:\/\/www.oxebridge.com\/emma\/wp-content\/uploads\/2015\/04\/bsirisk.jpg\")
<\/p>\n![\"riskfacepalm2\"](\"http:\/\/www.oxebridge.com\/emma\/wp-content\/uploads\/2015\/04\/riskfacepalm2.jpg\")
Next, most of the methods being proposed (such as, again, FMEA) are grossly inadequate to begin with. They are mathematically flawed, junk science magic tricks that result in nearly no reliable data with which management can work, and — in the worst cases — actually provide erroneous information, which can lead companies to pursue nonsensical risks while ignoring the more critical ones.<\/p>\n