5.

11 Management of Change
5.11.3 MOC Notification
The organization shall notify relevant personnel, including the customer when required by
contract, of the change and residual or new risk due to changes that have either been
initiated by the organization or requested by the customer.

While Clauses 5.5 and 5.11 both contain requirements related to risk, their requirements are not explicitly
and holistically mentioned in Clause 5.3.

The note contained in Clause 5.3 as quoted below is important in understanding how to implement a
risk assessment and management procedure:

NOTE Risk assessment can include consideration of severity, detection methods, and
probability of occurrence.
Depending on your organizations vernacular, the words severity and probability could be
synonymous with the words consequence (2.18) (1) and likelihood (2.19) (1) respectively. ISO 31000
specifies the definitions for consequence and likelihood, as well as numerous other definitions associated
with risk management. These words help identify the boundaries of a risk event, the degree to which risk
could be disruptive to your organization.

In part of the risk assessment process, typically, organizations create arisk matrix that illustrates
consequence on one axis and likelihood on the other axis, which generates a risk number that is
associated with the degree of significance of a risk event.

The note in Clause 5.3 also addresses detection methods. While they appear to be self-explanatory,
detection methods may be found in other sections of Q1 and could be used to identify how or where risk
was initially identified, for example:

Control of Nonconforming Product (e.g., a product nonconformance documenting a

material problem)

Inspection and Testing (e.g., visual characteristics that considerably deviate from
acceptance criteria)

Corrective Action (e.g., a documented supplier nonconformity on a cracked fastener)

Preventive Action (e.g., a process change that requires new and different process
equipment)

Design Input (e.g., a design change due to a field failure)

Planning (e.g., a customer order requiring the use of materials not used before)

Preventive Maintenance (e.g., repetitive equipment failures for equipment used in a

critical process)

Once you gain an understanding of how the interrelatedness of other sections in Q1 provide input to the
risk assessment and management process, the documentation and implementation of the process should
not be so daunting. In short, always consider:

How Q1 clauses interrelate with other Q1 clauses

How the integration of a bibliographic reference can facilitate conformity to Q1

1. International Organization for Standardization; ISO 31000, Risk management Principles and
guidelines