Risk, Compliance, and Quality Systems
Risk, compliance, and quality
Risk management identifies, assesses, treats, and monitors uncertainty. Risk appetite is how much risk the organization will accept; risk tolerance is acceptable variation around it. Assess likelihood and impact, then treat by avoiding, reducing, transferring, or accepting. Inherent risk exists before controls; residual risk remains after controls. The three lines model separates operational management, risk and compliance functions, and internal audit. Compliance programs include policy, training, monitoring, reporting, and enforcement. Quality systems such as ISO 9001 emphasize process approach, customer focus, leadership, evidence-based decisions, and continual improvement. Quality assurance prevents defects; quality control detects them. Corrective and preventive action addresses causes; audits verify conformance.
Traps
Common traps: treating the risk register as a one-time document; assuming compliance equals ethics; confusing quality assurance with quality control; closing a corrective action without root cause; and ignoring residual risk after controls. Questions often ask whether an issue is compliance, quality, or risk. Read whether the focus is a legal requirement, process conformance, or uncertainty.
Worked example
A supplier misses a specification. Quality control catches it at incoming inspection. The corrective action is not just to reject the lot; investigate why the supplier's process drifted and update the control plan.
Rule of thumb: detect, contain, root-cause, correct, verify, and prevent recurrence.