Let’s say Pete’s company has been in business for over thirty years. Now ISO 9001:2015 comes out requiring risk-based thinking. Does that mean Pete must therefore engage in formal risk management, and that management must use a risk assessment tool to provide evidence of risk-based thinking? Continue reading →