If the company's procedures comply with QSR since they market in the US as well, don't the procedures already take a risk-based approach to QMS processes? I understand that QSR is risk-based or assumed to be risk-based. For example, having a written quality agreement is a risk control measure in the event that the supplier change product specifications.
Re: Risk based approach - Procedures already take a risk-based approach to QMS proces
It is better to think this way than to develop a separate risk management system or to bolt on a few risk management tools.
Take a look at the opertational processes and their corresponding procedures.
Do the processes have objectives and do they include planning and resourcing to prevent problems in fulfilling the objectives or do they rely on detecting problems in the results?
Lastly, do each of the procedures accurately reflect the measures taken by the its process to prevent nonconformity?
If so, you know that your procedures are assessing and managing operational risks. Make sure your colleagues are up to speed on this logic too.
Bear in mind that the rest of your organization operating as a system and its management system (as documented and undocumented) may need to address other types of risk such as those arising from competitors, the economy, the ‘flu or changing technologies.
I agree that if you have a system based on the QSR, you already are applying the risk based approach. My question is, how do you convince the editor and what evidence will you show them? Any ideas?
My understanding is that the risk must now be quantified or calculated. I am in the process of looking back at all the units we shipped and counted the number of issues related to those units. Its a bit of work and the office staff aren't too happy with me when I ask for those numbers, but I feel that the calculations indicate the true incidence of issues.