Will Risk Based Thinking (RBT) as a cultural change for organizations be successful in reducing quality or business upsets for organizations of all sizes and complexity? In the past 50 years, there have been several quality improvement initiatives that attempted to bring about a change in a company’s culture that have not had a sustainable impact on the company’s quality or business results.

Quality Circles of the 1970s, Total Quality Management (TQM) in the 1980s and Business Process Re-engineering (BPR) in the 1990s, while each had some success, few organizations have maintained these programs as core tools in their business culture. Quality initiatives that have been successful the last several years are Six Sigma and Lean Manufacturing. These two programs were originally successful and continue to be sustained because, while they do include some level of culture change for the organization’s employees- or different thought process, they are also results driven. Top management support is important; however, the middle managers and work staff can operate quite independently and effectively once they are provided a charter by management for a Six Sigma or Lean initiative.

I experienced and survived all of these initiates in my work-life over the same 50 years. The one common denominator in quality or product failures I have experienced or observed was the lack of disciplined change control. I suggest a company that has a robust- and disciplined culture of change control is the ultimate risk based thinker. The tragic ignition switch failure at GM is a prime example of an organization’s lack of both change control and quality record keeping.

The essential problem: The cars’ ignition switch, where the key is inserted and turned to start the car, could easily be bumped or moved out of the “Run” position into the “Off” or “Accessory” position. When that happens, power braking and steering, as well as airbags, can stop working. What most people at GM didn’t know was that Delphi, the company that supplied the switch, had redesigned the part in 2006 to make it harder to turn. The problem had been fixed. A GM engineer even signed off on the changes. Unfortunately, GM didn’t change the part number of the switch. As a result, manufacturing records didn’t indicate that the issue had been resolved. (CNN Money Magazine, February 28, 2014).

There were several failures in this example. The automotive sector has a requirement for new part approval: PPAP (production part approval process), which is a generic part qualification process used to determine if all customer requirements are understood by a supplier and if the process has the potential to produce product meeting requirements on a production basis (Automotive Industry Action Group (AIAG) definition). PPAP is a very powerful tool, particularly as it relates to change control and risks in product changes; however, the process takes time- and organizations take short-cuts. A drawing revision change requires fewer approval signatures and can be implemented quickly. Organizations using PPAP would be better served streamlining the approval process as opposed to bypassing it!

When the oil rig explosion occurred in the Gulf of Mexico in April 2010, there was much discussion concerning the role of the blowout preventer in mitigating the extent of the spill. Had the risk related to operation of the blowout preventer been reviewed as thoroughly as needed- were the maintenance records up to date? When it was decided to postpone the planned replacement of the blowout preventer, was the change in procedure properly described, approved and controlled- or was the cost of lost production time the dominant factor?

Other deadly examples where lack of control when making design or production changes include the failures of Firestone tires on  Ford Explorers starting in 1998 and the Takata air bags the last few years. The Takata air bag failures have been alleged to have included various changes in work area conditions- moisture, and to operators turning off an “auto defect reject” system.

I recall when the Firestone tire failures occurred around the year 2000, there was some pressure to hold the ISO 9001 auditors accountable. There is now a similar concern with ISO 9001 auditors’ culpability with the air bag quality defects, as the supplier maintained a quality management system certified by ISO approved auditors. I am not qualified to express a legal opinion on the subject of culpability, but I will suggest, as a long time auditor, we can only assess what the client allows us to see. How change control (and risk analysis) relates to ISO 9001 requirements; however, can be found in the following processes:

• Process or equipment changes;
• Raw material specification control;
• Document control and review;
• Design;
• Regulatory updates;
• Outsourced processes;
• Planning of internal Audits;
• Effectiveness of corrective action.

Process or equipment changes: When production equipment or processes are changed, the implementation plan should include the potential risk for product quality. Testing prior to release of “new” product to customers is a common technique employed, along with the application of FMEA (Failure Mode and Effects Analysis).

Raw material specification control: Any change in materials used in production should be tested before release to customers. The organization should ensure their suppliers are aware of the need to maintain control and communication of any changes in their specifications or processes.

Document control and review: The organization should ensure documents used by employees are maintained and controlled to avoid mistakes. Employee instructions should be reviewed at some frequency to ensure employees are not by-passing operating instructions.

Design:  During the design process, a robust verification and validation plan should be employed to eliminate risks related to new designs.  The new design process should also include the risk analysis related to the impact the new design process may have on employee safety and the organization’s environmental impact, including end of life disposal issues.

Regulatory updates: The organization should maintain a process to be aware of changes to statutory and regulatory obligations related to its products to eliminate risks related to non-compliance.

Outsourced processes: Processes performed by external parties can create a risk for the organization in meeting its commitment. External supplier selection should include controls related to the impact the supplier can have on producing acceptable product or services. Inspection of externally supplied products should be based on inspection cost vs. risk related to supplier errors.

Effectiveness of corrective actions: An important part of the corrective action process is how effective the correction was to reduce the risk of a recurrence of the same issue. Time and resources allocated to measuring the effectiveness of the correction should be commensurate with the risk of recurrence.

Internal Audits: The internal audit plan should be based on the impact a process may have on quality performance as well as the history the particular process has in generating nonconformances.  By focusing on the history and impact of each process, the organization can allocate auditing resources to reduce risk of errors.

A change control process used by many organizations is the ECN (engineering change notice) that manages how functions or processes interact when changes are made in product, materials or processes. An almost military-like administration of the ECN process needs to be maintained if an organization is committed to a disciplined change control culture- and risk protection and mitigation.

I am concerned that the ISO 9001:2015 standard has created another TQM with its focus on risk based thinking. RBT is now a cottage industry with an extensive gallery of consultants, books and webinars. The writings I have observed include such profound concepts as “risk is like Swiss cheese”- “RBT is everyone’s job”. The ISO Auditing Practices Group (APG) uses a person crossing the street (with all the challenges) in their guidance document to explain the RBT process- that doesn’t  relate very well to folks entrusted to design and manufacture ignition switches and air bags.

When deciding whether to adopt a culture of RBT- or strengthen their existing process of change control, I suggest quality and manufacturing leaders would serve their companies better with the latter approach, recognizing there will always be the competing pressures of profits, time to market and management override. It’s always been that way.

Bio:

Milt Dentch has a BS in mechanical engineering from Worcester Polytechnic Institute and an MS in quality management systems from the National Graduate School of Quality Management (NGS). After college, he worked as an engineer in the paper industry for 5 years, and then he worked as an engineer and senior manager at the Polaroid Corporation in Waltham, Massachusetts, for 27 years. He was plant manager for the Custom Coating and Laminating plant in Worcester for the Furon Corporation for several years.

Milt currently provides consulting, training, and auditing related to the International Organization for Standardization requirements for quality, environmental, and safety management systems. He has conducted over 500 audits worldwide for large and small companies. Milt is an Exemplar Global qualified Lead Auditor for Quality and Environmental Management Systems and a Registrar approved OHSAS 18001 Lead Auditor.

ASQ Quality Press published Milt’s books: “The ISO 9001:2015 Implementation Handbook” and “The ISO 14001:2015 Implementation Handbook.”