Today’s business world is constantly changing—it’s unpredictable, volatile, and becoming more and more complex every day.  By its very nature, it is fraught with risk.

Businesses have always looked at risk as a necessary evil that should be controlled, minimised or mitigated whenever possible.

In recent years, increased regulatory requirements have forced businesses to spend or waste money on resources to address risk rather than prevent the impact of risk.

Risk based auditing provides a mechanism for identifying which risks represent opportunities and which represent potential pitfalls.

SO, WHAT IS RISK BASED AUDITING?
Put very simply: Risk based auditing: “checks how input risk impacts on output requirements”.

When you apply a risk based audit methodology you will be checking the following:

1. Have all the process in-puts been identified and documented?
2. Have all the in-put risks been identified and critically rated?
3. Have all out-put impacts been identified?
4. Has a failed safe system or systems been implemented?
5. Has the cost to serve risk and the impact on bottom line profit been calculated?

Let’s look at a few examples on how risk based auditing can add value:

HOW A £2 RISK RESULTED IN A MULTIMILLION POUND LOSS 
Some years ago a  risk based investigation was requested into the premature failure of a hydraulic valve bank.

The failure started to make an impact on sales and profits. The company used FMEA’s, 8D, DOE, and called on a number of experts to try and identify the cause, but without success.  It got to the point that a service field campaign was undertaken to replace all valve banks at a cost of £12,000 each, plus labour. The field campaign amounted to a multimillion pound loss.

Each product and process input was critically ranked; within a short time the input risks were identified.

The purchase department identified a number of cost saving ideas.  One was to use a different oil supplier and machine all valve bank reducer valves in-house

The purchase department identified an annual saving of £12,000 on oil and a £2 per valve bank reducer bring in an approx. £85,000 saving.

The purchase department worked with the supplier and everything went well in the pre-production phase so full production went ahead.  Within less than two months following the production launch, failures in the field started to occur.

Oil samples were taken and a number of micro particles where found.  A check was carried out on the oil supplier and everything was normal.

I checked out the in-house reducer valve machining process. The operation was carried out by the night shift.  I found out that there was no deburring operation in place following the machining of the valve reducer.  This caused metal fibres to be left on each reducer.

I further found the start-up valve by-passed the main filter system so the metal fibres went direct into the main actuators causing the failure

When I checked if this critical risk was identified at the design stage and/or by the valve bank supplier the answer was NO.

£1,000 COST SAVINGS RESULTED IN £350,000 DAMAGES
I was called into a company to investigate why a £4,000,000 laser machine was breaking down after only six months in operation.

The company was very progressive and had three lean 6 sigma black belts working on a number of processes helping the company to reduce waste.

The production line was a well thought out Single-Minute Exchange of Die (SMED),

Production Line Process was:  Laser – Press – Fabrication – Paint –  Assembly – Dispatch

I used a risk based input tool and found they had not reviewed the building  foundations. The building was constructed on shifting sand and supporting plates.

The laser and the 150 ton press was located on the same plate – so every time the 150 ton press operated it had an impact on the laser.

So next time, think about using Risk Based Auditing to understand and minimize your risks.