RKMS

The absence of problems isn't proof that your controls are working.

Sometimes you've just been lucky.

That's an uncomfortable distinction, but an important one.

A process can operate for years without a major failure despite having very little resilience built into it.

A key person hasn't left.

The machine hasn't broken.

The supplier hasn't failed.

The customer hasn't challenged something.

Then one thing changes and suddenly the weakness becomes visible.

Good management systems shouldn't only help businesses respond when something goes wrong.

They should help them spot where they're over-reliant on things continuing exactly as they are.

That's where risk-based thinking starts becoming genuinely useful.

A lot of business problems don't arrive dramatically.

They build up.

A little more waiting.

A little more rework.

Another workaround.

Another unnecessary step.

A process that once made sense gradually becomes slower and harder to manage.

That's one reason Lean and ISO work so well together.

Both encourage businesses to understand how work actually happens, identify what gets in the way and improve it.

If you've ever wondered what Lean Management actually means beyond the terminology, we've broken it down here:

👉 https://www.rkmsuk.co.uk/blog/what-is-lean-management/

What is Lean Management? (2021 Ultimate Guide) - RKMS Lean management has had a dramatic impact on both the way companies work and the products that they offer. Here's everything you need to know about the game-changing management concept.

“We've used them for 12 years. They've never let us down.”

That's reassuring.

It isn't a risk control.

Long-standing suppliers can still lose key employees, experience financial problems, suffer equipment failure, change ownership, have capacity issues or simply stop performing as well as they once did.

And this is where risk-based thinking becomes useful.

It isn't about assuming something bad will happen.

It's asking whether the business has thought about what it would do if it did.

If a supplier is genuinely critical, do you have an alternative?

Could another supplier meet the specification?

How quickly could you switch?

Would your customer be affected before you could recover?

Good risk management isn't pessimism.

It's preparedness.

Here's a useful question to take into your next management meeting:

“What are we relying on that we probably shouldn't be?”

One employee who knows how everything works?

One supplier nobody has properly challenged?

One customer providing a huge percentage of revenue?

One piece of ageing equipment?

One spreadsheet that only one person understands?

One process with no real backup?

Those conversations are often far more useful than sitting in a room trying to invent “ISO risks”.

The best risks to consider usually aren't hiding in the standard.

They're already sitting inside the business.

“We need ISO 9001.”

Okay.

But there's another question worth asking before you choose who certifies you:

What do you need the certificate for?

If it's primarily about improving internal structure or demonstrating a management system to customers who don't specify an accredited route, your options may be wider.

If you're targeting tenders, frameworks, larger supply chains or customers that specifically require UKAS-accredited certification, that changes the conversation.

Neither decision should start with:

“Which one's cheapest?”

It should start with understanding where the certificate needs to take the business.

Certification is part of the commercial decision.

Not just the final step after implementing the system.

Here's one worth clearing up:

ISO 9001 doesn't say you must have one enormous company risk register.

A register can be a perfectly good way of recording risks.

But risks can also be considered through management meetings, project planning, supplier management, process reviews, objectives, change management and everyday operational decisions.

What matters is that risks and opportunities are actually being considered and appropriate action is being taken.

That's an important distinction.

Because sometimes organisations spend more time maintaining the tool they've chosen for managing risk than actually managing the risk itself.

Your system should work for the business.

Not the other way around.

One of the most common problems with risk registers isn't that they're missing risks.

It's that they've got too many.

We've seen systems where almost everything that could conceivably go wrong has made its way onto a register.

The result?

Pages and pages of risks.

Dozens of actions.

And very little idea of what actually needs management attention.

A useful approach to risk shouldn't make every problem equally important.

If you've got 47 “high priority” risks, you've probably got no priorities at all.

The purpose is to help the business identify the things that could genuinely affect its ability to deliver what it needs to deliver - and make sensible decisions about them.

Sometimes making an ISO system better means removing things, not adding more.

ISO 9001 is sometimes described as a documentation exercise.

It really shouldn't be.

At its best, a Quality Management System gives a business a structured way to understand what's happening, identify where things could go wrong, make better decisions and improve how it operates.

That's also why Clause 6.1 matters.

Risk-based thinking isn't something that should sit separately from the way the business is managed. It should be part of how decisions are made.

If you're implementing ISO 9001 or questioning whether your existing system is genuinely adding value, there's plenty more practical ISO guidance on the RKMS blog.

👉 https://www.rkmsuk.co.uk/rkms-blog/

RKMS Blog - RKMS BLOG

Most businesses manage risk in some form.

They just don't necessarily call it “risk management.”

You probably already think about what happens if a key supplier fails, whether you've got enough capacity for a large order, what could cause a customer complaint or whether you're too dependent on one person.

ISO 9001 simply asks you to bring some structure to that thinking.

So we're interested:

How does your business mainly manage risk?

POLL:

Formal risk register
Department/process reviews
Management meetings
Mostly reactively

There's no judgement attached to the answer - we're interested in how businesses actually do this in practice.

🎢 A great day at the ADIPS Annual Conference!

Yesterday, John Keen, Managing Director of RKMS, attended the ADIPS Annual Conference in Blackpool, where he delivered a presentation sharing the findings and results from three years of auditing ADIPS Inspection Bodies.

John also covered some of the important changes affecting the industry, including developments around HSG175 and ISO/IEC 17065 accreditation requirements.

RKMS is proud to support ADIPS through its Inspection Body audit programme, helping to provide assurance around the organisations carrying out the inspections that contribute to keeping amusement devices safe for the public.

After the conference, John joined other delegates for a tour of Blackpool Pleasure Beach – including the opportunity to experience its latest multimillion-pound attraction, Aviktas! 🎢

A brilliant way to finish a day of industry learning, collaboration and discussion.

Thank you to ADIPS, ADSC and Blackpool Pleasure Beach for hosting a fantastic event.