Risk Management

I have mentioned "risk management" in previous blogs especially with regards to "Food Fraud".  But how do you conduct risk management and do a risk management analysis?  To start, when you find a process / procedure that has a risk associated with it there are three option.

1. Avoid dealing with the risk (poor business decision).
2. Deal with the risk via an action plan.
3. Knowingly (with reason) accept the risk and all potential  consequences.

Risk can come in various forms - Biological, physical, chemical, allergen, fraud, waste, etc.  Check our Wikipedia for a good primer on risk management   https://en.wikipedia.org/wiki/Risk_management.

Risk Management is common in the GFSI systems and HACCP programs.  The usage of risk management needs to be supported by upper management and practiced on a regular basis

HOW TO DO!

1. Perform a risk assessment.
• Based on Judgement and experience
• Identify and involve the "stakeholders" of the issue
• Uses science and knowledge
• Government laws need to be kept in mind such as "Canadian Food and Drug Act"
• Other standards used can include, BRC, SQF, Organic, Hallall, Fairtrade, ISO, Codex Alimentarius.
• Employ a risk Analysis Matrix
• Dark red area - Immediate action required.
• Red area - Critical area to have action plans and increase monitoring.
• Yellow area - regular monitoring schedules and management must be aware that the risk is present.
• Green area - May wish some monitoring if appropriate for the product.
• Matrix is used on one item / issue at a time.
• Codex (CAC/RCP1-1969, CAC/GL62-2007) has information on describing risk management but I find the above Matrix cleaner and easier to use.
2. Create Value
• Monitoring and corrective actions will cause resource and capital expenditure.  You will need to make a business case for the risk.  Some of these will be easy to do (Dark red and Red areas where Death or serious injuries may occur), other risks may need finance / accounting department to quantify the costs of the correction vs. the cost of the risk.
• The company may decide that the risk is low enough that it's acceptable to continue without correction.  Example - Overrun jelly donuts may get stale and produce customer complaints.  A solution is to scrap all overrun product.  If the cost to scrap the overrun is higher than the cost of complaints and brand image loss.
• The "Stakeholders" must buy into the analysis.
3. Must be Measurable
• Analysis is to be performed with a mind on the historical data, such as complaints, fines, loss of clients.
• Current data will need to be gathered to assess the effectiveness of the corrections.  If the correction is not effective the plan needs to be altered.  At this point a root cause analysis can be performed. A good way to see what is working, what is not working, and what needs to be done.
• Verification and Validation steps need to be put in place.  See my blog fro April 2013.
4. Transparent
• Report to management on the results and try to show how much $$$ was saved.
• Good to show staff the results in terms of lower complaint numbers, higher yields, or up time. 
• It is also beneficial to note the social / environmental impact of the change.  Customers are safer and lower waste and environment impact.

Root Cause Analysis - Revisited

Back in March I gave my thoughts on root cause analysis.  I discussed two methods that when used together are quite powerful.  These methods being Fishbone (brainstorming) and the 5 WHYS.  I have used these two methods to delve into issues that seem to be very persistent.  In other words - if a problem is persistent, the root cause has not been found.

There are a few more methods that can help in a roots cause determination.  Note: experience and judgement play a role in deciding which method(s) to use.  These other methods are;

1. The Interview.  I have used this and it can work to help find the issue.  WARNING - this can lead, very quickly, to the person being interviewed taking a very defensive attitude:  "Was not me, I don't know, why are you asking me these questions".  I think that a safe and open work culture needs to exist to make this method truly effective.
2. Flow chart.  Similar to the Fishbone but, in this case, the process steps are charted.  You must include all documented and undocumented steps.  Looking at all the steps can lead to finding the one piece that is causing the issue by being done or not done.
3. Alternate 5.  Asking Who - What - Where - When - Why - and sometimes the 6th How.
4. Pareto chart.  I discussed Pareto charts in a couple of other blogs - most recently on the blog of June 21, 2013.  This method states that 20% of causes result in 80% of your issues.  This is a great way to know what to spend your time on. 

The most current ideas behind root cause analysis tell us that the Quality Assurance department is no longer responsible for performing root cause analysis.  The best practice is to have the department with the issue be responsible for the root cause analysis.  Makes sense to me!  For example, if the issue is the amount of jelly being placed into donuts bring too variable - should it not be the people in charge of the jelly filling operation being the ones doing the root cause analysis?  After all, these operation people would have the most knowledge about the process, and have the most to gain from the root cause analysis exercise.  I think it could also help with employee engagement and empowerment.

NOTES OF CAUTION:

• Evaluation of the root cause effectiveness must be completed to evaluate if the problem has been solved.  This evaluation; if at all possible, should be accomplished through the collection and analysis of data. 
• Avoid using the words bad, poor, failed, careless, etc. when discussing the problem to be solved and it's possible causes.   Keep the analysis impersonal since you are fixing the system, not the people.