Quality risk management: matrix, controls and monitoring

Quality risk management helps organizations decide where to prevent failures, strengthen controls and focus resources before uncertainty affects customers, processes or objectives. A probability-impact matrix supports prioritization, but it does not replace context, evidence and judgment.

A colored heat map without ownership, treatment and review is only a snapshot. Management begins when risks influence process decisions and recurring performance reviews.

What quality risk means

Risk is the effect of uncertainty on objectives. In a QMS it may affect conformity, customer and regulatory requirements, process continuity, suppliers, competence, documented information and customer satisfaction.

ISO 31000 presents principles, a framework and a process for identifying, analyzing, evaluating, treating, monitoring and communicating risk. ISO 9001 embeds risk-based thinking without mandating a specific tool or matrix.

Describe objective, event, cause and consequence

“Supplier risk” is too broad to guide action. A useful statement separates the protected objective, uncertain event, contributing cause and potential consequence.

Example: because no approved alternate carrier exists for a critical route (cause), pickup capacity may become unavailable (event), delaying a shipment and violating the customer deadline (consequence).

Define criteria before assigning scores

A 5×5 matrix may score likelihood and impact from 1 to 5. The organization must define what each level means through time horizons, financial values, delivery tolerances, regulatory severity and customer impact.

Risk score = likelihood × impact

Konvéz Quality currently uses these bands:

Score	Level
1–4	low
5–9	medium
10–14	high
15–25	critical

Scores organize discussion but are not mathematical truth. A rare catastrophic event and a frequent moderate event can produce similar scores while requiring different decisions. Legal obligations, safety, key customers and detectability can change priority.

Evaluate existing controls

Record what already reduces likelihood or consequence: preventive, detective, recovery and directive controls. Do not confuse existence with effectiveness. A published procedure does not prove that work follows it; examine evidence, frequency, coverage, ownership and results.

Choose a risk treatment

• Mitigate: reduce likelihood or impact with controls and actions.
• Avoid: stop the activity or remove the condition creating risk.
• Accept: retain exposure through an informed, reviewable decision.
• Transfer: allocate part of the consequence through insurance, contract or a third party.
• Share: distribute responsibilities and effects between parties.

Transfer does not erase risk. Insurance may transfer some financial impact but not necessarily delay, reputation or customer responsibility. For mitigation, turn the decision into a 5W2H action plan.

Initial and residual risk

Initial exposure is assessed before the planned treatment. Residual risk remains after controls and treatments are implemented and evaluated. Do not reduce the residual score because a plan was approved; require evidence that controls operate effectively.

Point	Likelihood	Impact	Score	Level
Initial	4	4	16	critical
After alternate supplier and capacity alert	2	4	8	medium

Impact remains high, while controls reduce likelihood. That explanation is more useful than merely changing the heat-map color.

Monitor quality risks

Every risk needs an owner, review date and reassessment triggers. Review after changes to a process, system, supplier or requirement; new nonconformities or complaints; audit results; movement in a quality indicator; or an ineffective control.

Useful measures include risks above tolerance, overdue treatments, ineffective controls, time since review, residual exposure and related occurrences.

How Konvéz Quality connects risks to operations

The Konvéz Quality Risk Map records category, cause, consequence, process, stage, department and owner. A 5×5 matrix combines likelihood and impact, with detectability available as supplementary information.

Teams can use an overview, detailed list, process view and matrix. Each risk connects controls and effectiveness, treatment, actions, evidence, documents and a timeline. Treatment-specific fields preserve the rationale for mitigation, avoidance, acceptance, transfer or sharing. Status moves through Open, In treatment, Monitoring and Closed.

The current suggestion feature can also identify candidate risks from departments with at least three nonconformities in 90 days and high or critical “Not met” audit findings. Suggestions support triage; people remain responsible for assessment and decisions.

Explore the Konvéz Quality Risk Map

Sources

• ISO 31000:2018 — Risk management guidelines
• ISO — Risk management overview
• ISO/IAF — Risk-based thinking in ISO 9001
• ASQ — The fundamentals of risk

The matrix compares, controls reduce exposure and monitoring tests whether the decision remains valid. Risk management matures when all three remain connected to real work.

Frequently asked questions

What is quality risk management?

It identifies uncertainties affecting quality objectives, analyzes likelihood and consequence, evaluates priorities, treats exposure and monitors results.

How is a risk level calculated?

A common approach multiplies likelihood by impact. The organization must define scales and bands before assessment and apply them consistently.

What is residual risk?

It is the exposure remaining after controls and treatments have been implemented and their effectiveness evaluated.

Does ISO 9001 require a risk matrix?

No. It requires risk-based thinking but does not prescribe a particular tool. A matrix is one way to support prioritization.