Bolting risk management onto ISO 9001 and ISO 45001
Nordhavn Components (1,250 staff, six plants) holds ISO 9001 and ISO 45001 certificates. After a fire at a single-source supplier halted a customer's production line, the CEO told the management review that 'risk management must be everywhere by Q4'. The quality manager, who already owns both management systems, has drafted a 14-page risk policy, a 5x5 matrix copied from the safety system, and a plan to add a risk column to existing audit checklists. The board has not discussed risk appetite; there is no risk committee; business unit heads have not been asked for anything. The internal auditor warns that adding risk to quality and safety audits will not satisfy customers now sending ESG and resilience questionnaires.
1. Assess whether extending the two existing management systems is an adequate way to establish a risk management framework under ISO 31000. Identify the specific Clause 5 elements that are missing.
Read the worked answer
Integration is a principle, so reusing existing management systems is sensible. But a management system scoped to quality or occupational health and safety cannot substitute for an enterprise risk management framework: its scope excludes supplier concentration, customer resilience, funding, strategic and market uncertainty - precisely the risk that just materialised. A risk column on an audit checklist captures conformity, not uncertainty.
Gaps against Clause 5:
- 5.2 Leadership and commitment: the board has made no commitment and articulated no appetite. A CEO remark at a management review is not a mandate.
- 5.4.2 Articulating commitment: a 14-page policy is not commitment if no objective, authority or resource accompanies it.
- 5.4.3 Roles, authorities, responsibilities, accountabilities: the framework sits with a manager who already owns two systems and has no authority over business unit heads. That is a design fault, not a workload problem.
- 5.4.1 Understanding context: no analysis of the customer questionnaires or supplier dependencies that define the current context.
- 5.4.4 Allocating resources: none identified.
- 5.5 Implementation: a Q4 target is a date, not a plan with milestones, owners and outputs.
- 5.6 Evaluation / 5.7 Improvement: nothing measures whether the framework itself works.
Also note the matrix: inherited from safety, its consequence scales are injury-based and will mis-rate supplier failure or contract loss - a customisation failure dressed as consistency.
2. Advise the CEO on sequencing. What must happen before documentation, what can realistically be delivered by Q4, and how should the quality manager push back?
Read the worked answer
Three governance decisions must precede documents, because documents written first will encode the wrong scope:
- The board states risk appetite at least at a high level and nominates a framework sponsor with authority over business units - not the quality manager.
- Scope is agreed: enterprise risk for the group, with unit-level registers feeding it. Otherwise 'everywhere' means everywhere and nowhere.
- Business unit heads are designated risk owners for their objectives, in writing.
Realistic Q4 delivery: framework design agreed, top-level enterprise risk profile built around five or six objectives (supply continuity being first), one plant pilot, and a reporting cadence into the existing management review. 'Everywhere' is a two-year outcome, not a quarter.
How to push back: challenge the date, not the intent. Present a phased plan with dated, verifiable milestones and explicitly state what dropping the phase structure would cost - a copied matrix and a policy that business units ignore, which discredits the initiative before it starts. Ask the CEO which of the two outcomes they want to be able to describe to the customer. If overruled, record the decision and its residual risk formally; that record protects the organisation and the manager.
Practical safeguard: hold the pilot plant to a real test - did its risk profile change a scheduling or sourcing decision within eight weeks?
3. A customer's questionnaire demands evidence that Nordhavn 'complies with ISO 31000'. What can the organisation honestly provide, and what should it refuse to claim?
Read the worked answer
ISO 31000 is guidance and is explicitly not intended for certification purposes; there is no accredited certificate, and no body can legitimately issue one. Any provider offering 'ISO 31000 certification' should be treated as a red flag, and a claim of certification in a customer questionnaire would be a misrepresentation risk in its own right.
What can be provided honestly:
- A self-declaration of alignment, signed at executive level, cross-referenced to the clauses.
- A gap assessment against ISO 31000 performed by internal audit or an independent assessor, clearly labelled as an assessment and not a certification.
- Concrete artefacts that evidence a functioning framework rather than a badge: risk criteria and appetite statement, the enterprise risk profile with named owners, treatment plans with dates, monitoring indicators and their trigger thresholds, minutes showing risk informing a decision, and the framework's own review cycle.
- Alignment evidence folded into the existing ISO 9001 and 45001 audit and management review programme, which is legitimate and cheaper than a new scheme.
The quality manager should also reply to the customer explaining the standard's status and asking what assurance outcome they actually need. Procurement teams often copy the phrase 'ISO 31000 certified' without knowing its status; a calm correction plus a credible evidence pack usually resolves the requirement and builds more trust than a badge would.