Do we need to maintain a 'Risk Register'?
Q: ISO 9001:2015, does it require a documented risk register ? Will it become a requirement, indirectly? I plan to identify and review all risks and opportunities in the MRM but still unsure about maintaining a separate register (document). A: 1. ISO 9001:2015 does not require neither development, nor maintenance of a Risk register . Risk register is a part of risk management methodology. Risk register development is a good practice, but not the Standard requirement. Risk- based thinking initiates the consideration of multi-variant approach in decision-making. It may be represented as a possibility of the expected result offset into a negative or positive part of a certain ‘scale’ depending on disturbances in the result achieving process. Usually, the ‘ risk register ’ development includes three stages : 1) risk formulating (naming the possible disturbances); 2) risk identification (digitization), as a rule, the negative consequences are considered; 3) ris...