It is often useful to consider the QMS as a mechanism for identifying, controlling and continually reviewing risk. Just as an Occupational Health & Safety Management System (OHSMS) focuses quite rightly on identifying and controlling risk, the most effective QMS’ apply the same principles to “quality” risks. That is, where an OHSMS focuses fairly and squarely on the management of health and safety risks to staff and other people, the QMS can apply the same principles to risks to the integrity of the product and service, risks to customer satisfaction levels and risks to the success and continuity of the business. These risk areas may well be inter-twined, of course.

Just as an effective OHSMS is fed by an initial “suitable and sufficient” risk assessment, and this gives rise to our controls and arrangements, a QMS can be built the same way. It stands to reason after all, in OHS terms, unless you understand the risks, how can you have faith you have the right controls in place? For some reason the same logic is not always applied to the QMS, but it should be.

QMS processes should be continually assessed along the lines of “what can go wrong? what would happen if it did? and, how likely is it?” This process would naturally give rise to better and more relevant “Preventative Actions” and associated control procedures. They’d be kept under review in a similar way (carrying on the OHS theme) when we have a problem we should review our controls, and we need the right type of performance measures in place to give us faith we’ve got it right. In addition people would find it easier to understand the rationale behind the QMS, whereas in many places it’s seen as the preserve of the Quality Department and a bit of a black art