MSP - Certified Management Systems Professional Risk and Opportunity Management Questions and Answers — Questions and Answers
Question 1: A medical device company identifies a new automated testing technology that could significantly reduce product verification time and improve accuracy. Within the context of their ISO 13485 management system, how should this primarily be addressed according to Clause 6.1?
- As a nonconformity, because it deviates from the current validated process.
- As an opportunity to be evaluated and potentially pursued to enhance the QMS. (Correct answer)
- As a threat to be mitigated, due to the cost of implementation.
- As a corrective action to fix a known deficiency in testing speed.
Correct answer: As an opportunity to be evaluated and potentially pursued to enhance the QMS.
Modern management systems require organizations to identify not only risks but also opportunities for improvement. This new technology represents a potential for a positive gain, which aligns with the definition of an opportunity that should be evaluated as part of the planning process to enhance desirable effects and achieve improvement.
Question 2: According to the principles of risk-based thinking in ISO management systems, what is the fundamental purpose of identifying and addressing risks and opportunities?
- To eliminate all possible negative outcomes within every process.
- To create a comprehensive register of everything that could go wrong.
- To satisfy the minimum documentation requirements for an external audit.
- To give assurance that the management system can achieve its intended results. (Correct answer)
Correct answer: To give assurance that the management system can achieve its intended results.
The primary goal of addressing risks and opportunities is to ensure the management system is effective. This means proactively taking steps to increase the likelihood of achieving objectives, preventing or reducing undesired effects, and fostering continual improvement.
Question 3: An organization is conducting its risk and opportunity assessment. In addition to its strategic objectives and the scope of its management system, which other inputs are explicitly required to be considered when determining the risks and opportunities that need to be addressed?
- The results from the previous year's financial statements.
- The issues from the 'Context of the Organization' and requirements of interested parties. (Correct answer)
- A list of all customer complaints received in the last quarter.
- The performance metrics of the organization's direct competitors.
Correct answer: The issues from the 'Context of the Organization' and requirements of interested parties.
ISO 9001:2015, Clause 6.1.1, explicitly states that when planning, the organization shall consider the issues referred to in 4.1 (Context of the Organization) and the requirements referred to in 4.2 (Interested Parties) to determine the risks and opportunities.
Question 4: A construction company identifies a significant risk of project delays due to the unreliability of a single-source supplier for a specialized building material. Which of the following actions represents the most effective risk treatment strategy of 'changing the likelihood'?
- Purchasing project delay insurance to cover potential financial losses.
- Formally accepting the risk in the management review meeting.
- Initiating a program to identify, vet, and qualify an alternative supplier. (Correct answer)
- Increasing the on-site inventory of the material to buffer against shortages.
Correct answer: Initiating a program to identify, vet, and qualify an alternative supplier.
Qualifying an alternative supplier directly addresses the source of the uncertainty and reduces the likelihood that the failure of one supplier will cause a delay. Purchasing insurance shares the risk, accepting it retains it, and increasing inventory only buffers against the consequences without changing the likelihood of the supply failure.
Question 5: Which of the following is the BEST example of an action taken to address an 'opportunity' rather than a 'risk'?
- Implementing a new backup system to prevent data loss.
- Developing a contingency plan for supply chain disruptions.
- Investing in advanced employee training to enter a new, high-demand market. (Correct answer)
- Placing guards on machinery to prevent worker injury.
Correct answer: Investing in advanced employee training to enter a new, high-demand market.
Investing in training to enter a new market is a proactive action to pursue a potential gain or positive outcome, which is the definition of addressing an opportunity. The other options are focused on preventing or mitigating negative outcomes (risks).
Question 6: While ISO 9001 requires organizations to plan actions to address risks and opportunities, it does not explicitly mandate a formal, documented risk management process or a risk register. However, what must the planned actions be?
- Approved by an external third-party consultant.
- Limited to a maximum of ten per department.
- Proportionate to the potential impact on conformity of products and services. (Correct answer)
- Kept separate from all other quality management system processes.
Correct answer: Proportionate to the potential impact on conformity of products and services.
ISO 9001:2015 Clause 6.1.2 states that the actions taken to address risks and opportunities shall be proportionate to the potential impact on the conformity of products and services. This ensures that the organization focuses its efforts on the most significant issues.
MSP - Certified Management Systems Professional Risk and Opportunity Management Questions and Answers
A medical device company identifies a new automated testing technology that could significantly reduce product verification time and improve accuracy.
Within the context of their ISO 13485 management system, how should this primarily be addressed according to Clause 6.1?