ISO 9001:2015 has created a new focus on risk with regard to context of the organization and the needs and expectations of interested parties.

The Army Techniques Publication ATP 5-19 Risk Management, by the United States Government, U.S. Army (CreateSpace Independent Publishing Platform, 2014) is a helpful public domain resource for hazard identification and risk assessment that, while designed primarily for safety applications, works for quality as well. Among its chief takeaways is the fact that risk is not, as we might infer from traditional failure mode effects analysis (FMEA) the individual probability (p) that something might go wrong. It takes the individual probability (p) times the number of opportunities (n) for something to go wrong.

According to ATP 5-19: “Probability is assessed as frequent if a harmful occurrence is known to happen continuously, regularly, or inevitably because of exposure. Exposure is the frequency and length of time [that] personnel and equipment are subjected to a hazard or hazards.”

 …