Chapter 17: Turning Risk Identification Into Operational Controls

Here's where the rubber meets the road. Risk identification is worthless if it doesn't change what actually happens on the shop floor. The link between your risk output and your operational controls must be traceable and specific.

This is where many plants stumble. They identify a risk like "Supplier quality failure" and then list a control like "Incoming inspection." That's too vague. A supplier is not a process. Supplier quality failure could mean:

• Dimensional drift on machined components
• Missing documentation (certifications, test reports)
• Contamination in chemical additives
• Late delivery that cascades into production delays

Each of those demands a *different* control. Your control plan must be tied to the specific risk, not the category.

Here's the framework that works:

Risk Identification → *Specific failure mode tied to a process step* → Control Design → *Method, frequency, responsibility* → Work Instruction → *How operators execute the control* → Verification → *How you know the control is working* → Audit Checkpoint → *How you monitor control execution*

A common error we see: plants write risks that are strategically true but operationally vague. "Supply chain disruption" is a strategic risk. "Supplier X has only one production facility" is a strategic observation.

But "Incoming batch from Supplier X lacks raw material test reports, leading to undetected material contamination" is an operational risk that demands a control (request test reports before material enters the plant) and a verification method (certificate of analysis check at receiving).

The nonconformance corrective action process (Clause 8.5.2) is where your risk thinking gets tested. When something goes wrong—and it will—your CAR should trace backward to the risk that wasn't caught. If you ship a defective part, your investigation should ask: "What risk was this supposed to prevent? Why didn't the control work?" That feedback loop tightens your risk identification next time.