From theory to practice: a risk management model for SMEs in the context of ISO 9001

Abstract

Paper aims  To fulfill risk-based thinking (RBT), most companies opt for widespread methods as FMEA, even with their limitations. This research aims to develop a model for small and medium-sized enterprises (SMEs) relying on literature, practical and normative aspects, to accomplish RBT required by ISO 9001:2015.

Originality  This study represents an original contribution once its analysis and results guide a highlighted need in the literature. By discussing RBT from three different perspectives, this paper provides relevant insights for researchers and practitioners in quality and risk management.

Research method  The action research was conducted within a Brazilian SME, where the risk management model was implemented and analyzed through five cycles. The techniques to collect data were participant observation, documentary analysis, and semi-structured interviews, analyzed through attribute agreement analysis.

Main findings  Unlike the isolated use of widespread methods, this model contains all the aspects needed for RBT. Its applicability is directly related to the level of experience on risks and ISO 9001, emphasizing the organizational aspects needed.

Implications for theory and practice  A comprehensive model allows SMEs to understand better the concepts associated with RBT while incorporating an adapted approach to their contexts. Researchers can use the model to analyze its applicability for SMEs from different contexts.

Keywords  Quality management system; ISO 9001:2015; Risk-based thinking; Risk management; Action research