Risk-based thinking and the process approach
The process approach
A process is a set of interrelated activities that converts inputs into outputs. Auditing a process means verifying its owner and responsibilities, inputs and outputs, interfaces with other processes, resources, criteria and methods, performance indicators, and the risks that could prevent the intended result. The turtle diagram (inputs, outputs, 'with what', 'with who', 'how', 'what results') is a useful memory aid.
Risk-based thinking
Risk-based thinking runs through the requirements: clause 4.1 context, 6.1 risks and opportunities, 8.5.1 control of conditions, 9.1 monitoring, 10.2 corrective action. Note that ISO 9001 does not mandate a risk register or a formal risk methodology. ISO 14001 handles environmental aspects and compliance obligations; ISO 45001 requires hazard identification and assessment of OH&S risks and opportunities.
For an auditor risk-based thinking has two faces. First, audit the client's risk management: are risks and opportunities identified, addressed, and is the action evaluated for effectiveness? Second, audit in a risk-based way: spend more time on high-risk processes, new or changed sites, outsourced processes and areas with high complaint rates.
Trap: treating risk as purely negative - opportunities belong in clause 6.1 too. Trap: assuming a risk register proves effectiveness; evidence lies in the actions taken and their evaluation. Trap: auditing clause by clause and losing the process and its audit trail.
Rule of thumb
For every process ask five questions: what goes in and out, who owns it, how do you know it works, what could go wrong, and what happens when it does.