UBC — AI Solutions

Audit — Dynamic Documentation Platform

Living documentation that stays in sync with engineering, cloud, AI, and compliance activity. Documents update themselves as the organization changes.

Back to library
SOP
Fresh

SOP-QMS-06 — Risk & Opportunity Planning

Identifies, evaluates, and treats risks and opportunities affecting the QMS (ISO 9001 §6, ISO 31000).

Owner: GRC LeadApprover: Quality DirectorVersion: 2.4Updated: 12/2/1969

1. Purpose

Provide a consistent method to identify, assess, treat, and monitor risks and opportunities across UBC processes.

2. Scope

All QMS processes, projects, and services. Executed continuously with quarterly consolidation.

3. Definitions

  • Risk — Effect of uncertainty on objectives.
  • Opportunity — A circumstance that, if pursued, would improve outcomes.
  • Risk appetite — The amount and type of risk UBC is willing to pursue or retain.

4. Roles & Responsibilities (RACI)

ActivityRACICadence
Identify risksProcess ownerGRC LeadRisk ownersQuality CouncilContinuous
Assess likelihood & impactRisk ownerGRC LeadSMEProcess ownerOn identification
Approve treatment planGRC LeadQuality DirectorRisk ownerProcess ownerOn assessment
Monitor residual riskRisk ownerGRC LeadProcess ownerQuality CouncilQuarterly

5. Procedure

  1. Log each risk in the Enterprise Risk Register with a unique ID.
  2. Score likelihood (1–5) and impact (1–5); compute inherent risk = L × I.
  3. Select treatment: avoid, mitigate, transfer, or accept.
  4. Record controls, owner, target date, and evidence for mitigation.
  5. Re-score residual risk and confirm it is within appetite.
  6. Review the register quarterly at the Quality Council.
  7. Escalate risks scoring ≥ 15 to the SVP Operations within 5 business days.

6. Inputs & Outputs

Inputs

  • Context Register
  • Incident and CAPA logs
  • Audit findings
  • Threat intelligence

Outputs

  • Enterprise Risk Register
  • Treatment plans
  • Residual risk report

7. Controls & Metrics

MetricTarget
Risks reviewed on schedule≥ 98%
High risks with active treatment100%

8. Exceptions & Escalation

  • Emerging risks (new regulation, incident) require entry within 5 business days of identification.

9. Records & Retention

RecordRetention
Enterprise Risk Register10 years
Treatment evidence7 years

10. Related Documents

  • SOP-QMS-04 Context
  • SOP-QMS-10 Nonconformity & CAPA
  • ISMS Risk Assessment Procedure

11. References

  • ISO 9001:2015 §6.1
  • ISO 31000:2018
  • COSO ERM

12. Revision History

See the Versions tab for the full change history maintained by the Auto-Doc Engine.

Document code: SOP-QMS-06 · Aligned to ISO 9001:2015 §6.1 / ISO 31000:2018. Controlled document — reproduction outside the UBC QMS requires the Quality Manager's approval.

Suggested by AI
No suggestions right now.
Frameworks
ISO 9001
ISO 27001