Fortune-Telling Requirements

Recently I became aware that the ISO 9001 requirements pertaining to preventive action are sometimes referred to as the “fortune-telling clause.” The deprecating implication is that attempting to implement preventive actions is as silly as relying on a two-bit sideshow palm reader to help you make life-altering decisions. Once they’ve sufficiently disparaged the value of the quality management system (QMS) requirement, individuals shrug their shoulders and proceed to assemble a tidy file of superfluous paperwork attesting to preventive measures implemented, just in time for the surveillance audit dog-and-pony show.

The prevailing sentiment is that it’s impossible to foresee everything that can go wrong and, further, the cost for the level of vigilance required to predict many things is wasteful and prohibitive. So, why bother doing anything?

It’s disingenuous to abdicate responsibility for preventive action because the goal abides in the realm of potentiality.

We conduct preventive actions every day as a matter of course. There are safety belts, fire drills, dental cleanings, electrical grounds, stop signs, immunizations, and condoms. They all help prevent bad things from happening. We have reliable data that allow us to predict the probability of certain occurrences and additional historical data substantiating the effectiveness of the corresponding preventive measures.

Organizations need to determine what preventive actions are appropriate. There’s got to be a happy medium. We wouldn’t want to conduct fire drills everyday or put stop signs on every street corner of the city. At one end is carelessness bordering on anarchy and at the other is watchfulness approaching paranoia.

So how do we find the happy medium? The answer is: It depends. There are multiple factors that determine the level and variety of preventive actions that are appropriate. Some are driven by the nature of the product (e.g., implanted medical devices), while others can be driven by processes (production of volatile chemicals) or the internal culture (multilingual workforce). Each carries its own risks. The first engenders a life-threatening risk for the customer; the second, risk of harm to a production worker; the third, a risk of miscommunication of important information that might lead to defective products, increased errors or accidents. The commonality in all cases is risk. Mitigation of risk is at the heart of all preventive actions.

Risks can relate to bodily harm, monetary loss or customer dissatisfaction. It’s directly related to change management. Preventive actions seek to minimize the likelihood of any negative scenarios resulting from risks associated with change. We need to be able to assess the risk and decide what action is warranted, so that we can implement effective preventive actions.

Mathematical calculations of varying sophistication allow us to predict the likelihood of occurrence and the risk associated with an occurrence. This provides us with a measure of predictability and gives us the necessary insight to be able to assess potential negative consequences. Based on that measurement, we decide what preventive actions are reasonable. Other times, it’s a no-brainer. If you don’t use ESD precautions, you’ll destroy sensitive electronic components; if you don’t perform preventive maintenance on your production equipment, it will eventually breakdown. These are basic laws of physics. Cost associated with failing to conduct preventive action is the value of the damaged components or the cost of replacing capital equipment.

I’ve long thought that failure modes and effects analysis (FMEA) is the archetype of preventive actions. It’s perhaps the most structured and elaborate form of preventive action. Examining how FMEAs work helps individuals comprehend how most preventive actions can be identified and implemented. Through assessment of such things as possible occurrence, likelihood, criticality and ease of detection, it’s possible to prioritize the actions that will result in the greatest mitigation of risk, thereby decreasing potential drain on resources and, eventually, the bottom line.

Regardless of how formalized any assessment of the need for preventive action is, it always manifests these features of risk and prioritization: potentiality, likelihood, criticality, and detectability.

Change is all around us. Some changes are initiated internally, while others originate from external factors and require us to take action in order to respond appropriately. Typical changes in most organizations include reengineering a process, outsourcing, new environmental standards, shifts in the marketplace, decreased availability of raw materials, new product launch, increased threats to security of electronic infrastructure and relocation.

Let’s say, for example, you decide to outsource a manufacturing process that you’ve always done in-house. What could go wrong and how can we prevent it from happening? If the risk is that you’ll lose control of your production schedule, what action do you need to take? You may need to redesign your production router and other documentation to ensure effective communication and traceability. You may need to adjust your schedule to account for transit time. There may be a need to train personnel in how to ship materials. You may additionally have to establish inspection procedures or acceptance criteria for when the material is received after processing. In essence, you put together a plan to make sure this great new idea you had to improve your ability to serve your customers doesn’t blow up in your face because you didn’t adequately consider the consequences of the change.

It’s not mumbo-jumbo. Preventive action is the responsible reaction to potential consequences predicated on reliable data. It said so in my crystal ball.

About The Author

Denise Robitaille

Denise Robitaille is the author of thirteen books, including: ISO 9001:2015 Handbook for Small and Medium-Sized Businesses.

She is chair of PC302, the project committee responsible for the revision to ISO 19011, an active member of USTAG to ISO/TC 176 and technical expert on the working group that developed the current version of ISO 9004:2018. She has participated internationally in standards development for over 15 years. She is a globally recognized speaker and trainer. Denise is a Fellow of the American Society for Quality and an Exemplar Global certified lead assessor and an ASQ certified quality auditor.

As principal of Robitaille Associates, she has helped many companies achieve ISO 9001 registration and to improve their quality management systems. She has conducted training courses for thousands of individuals on such topics as auditing, corrective action, document control, root cause analysis, and implementing ISO 9001. Among Denise’s books are: 9 Keys to Successful Audits, The (Almost) Painless ISO 9001:2015 Transition and The Corrective Action Handbook. She is a frequent contributor to several quality periodicals.