From preventive action to risk-based thinking
The 2005 edition had preventive action: remove the causes of potential nonconformities before they occur. The 2017 edition is broader. Risk-based thinking runs through the whole management system and is required explicitly in clause 8.5. Opportunities are part of it: a new measurement technique, an additional test rig or a new customer segment are not threats but possibilities the laboratory can deliberately take up or deliberately decline.
The idea appears in several places: impartiality (4.1.4), nonconforming work (7.10), corrective action (8.7, which updates risks) and management review (8.9). Clause 8.5 is where it comes together systematically.
What clause 8.5 requires
| Subclause | Requirement |
|---|---|
| 8.5.1 | The laboratory considers risks and opportunities associated with its activities in order to (a) give assurance that the management system achieves its intended results, (b) enhance opportunities, (c) prevent or reduce undesired impacts and potential failures, and (d) achieve improvement. |
| 8.5.2 | The laboratory plans (a) actions to address these risks and opportunities and (b) how to integrate and implement them in the management system and evaluate their effectiveness. |
| 8.5.3 | Actions taken are proportional to the potential impact on the validity of laboratory results. |
The notes in the standard list the options: identify and avoid threats, take a risk to pursue an opportunity, eliminate the source of risk, change the likelihood or consequences, share the risk, or retain it by informed decision. What counts is the conscious decision, not a particular outcome.
Typical risks and opportunities in a testing lab
| Area | Example risk or opportunity |
|---|---|
| Personnel | Risk: Only one person is authorized for a test method. Opportunity: Extra authorizations cover holidays and sickness. |
| Equipment | Risk: An instrument fails shortly before its calibration is due. Opportunity: A second device as reference or for comparison measurements. |
| Environment | Risk: Climate swings in the test room affect readings. Opportunity: Monitoring with alarm limits. |
| Data | Risk: Raw data sits on a local machine without backup. Opportunity: Central storage with change history. |
| Customers and orders | Risk: A customer insists on deadlines that cannot be met without shortening the test. Opportunity: A new test type for a growing market. |
| Impartiality | Risk: Conflict of interest when the same person tests and advises the customer. Opportunity: Clear separation rules. |
A lean risk register in five steps
- 1
Walk through the processes
From enquiry through sample receipt and testing to the report: where could the validity of results suffer? Resources (people, equipment, environment) and suppliers belong here too.
- 2
Record risks and opportunities
One row per item: process, description, possible impact. Short and concrete — not “instrument fails” but “cycler 3 can only be repaired by vendor X, six-week lead time”.
- 3
Rate them
Roughly rate likelihood and impact on result validity (low, medium, high). A three-by-three matrix is enough.
- 4
Define actions
Only where proportionate: action, owner, due date. For risks retained deliberately, record the decision.
- 5
Check effectiveness and keep it current
Review in the internal audit and management review whether actions worked. Update the register after deviations, complaints and corrective actions.
Typical assessor findings
- There is no risk register, or it was created once for accreditation and never updated.
- The register lists risks or opportunities but no actions with an owner and due date.
- Actions are not proportional: a lot of effort on risks without effect on results, nothing for critical points.
- Effectiveness is not evaluated and the topic does not appear in the management review.
- Deviations, complaints and nonconforming work do not lead to an updated register.
- Impartiality risks (4.1.4) are handled separately and not linked to 8.5.
Tools and data sources
A risk register is a table. The hard part is not the tool but keeping it current: new risks show up in daily work, in test anomalies, in equipment failures and in utilization. If you capture these sources in a structured way, feeding the register takes little effort.
TestLabIQ records deviations per test case with type and description, keeps an audit log of all changes and shows test rig utilization in the calendar. These are data sources for risk assessment. The application does not include a risk register with a rating matrix; a maintained spreadsheet or your QM system covers that.