Keywords

1 Introduction

Since the 1950s, quality management practices started to be widely adopted by companies as part of an effort to increase their production and behavioural factors, such as executive commitment and employee empowerment [1]. In the meantime, academic research on the subject grew in importance [2] leading to the introduction of quality management as a discipline in many business and engineering schools, being a significant object of study and application [3]. Later, quality management became more mature as a discipline and quality awards were developed, helping the adoption of common best practices by organizations around the world [4].

Quality management best practices evolved over time leading to the development of specific norms, standards, and certifications based on accumulated research and experiences [5]. One of the most important and recognized standards is the ‘9000 series—Quality Management System’ from the International Organization for Standardization (ISO), which is composed by four main standards periodically reviewed and already implemented in more than one million certified companies throughout the world [6]. The 2015 review of the ISO 9001 standard made an important change incorporating risk management as part of the quality management system [7]. However, which risk management processes must be carried out under the quality management system is still a topic under debate in the literature [8].

The current debate on academia follows two divergent arguments. On one hand, some authors argue that the changes introduced by ISO 9001:2015 may effectively improve quality management processes if companies apply the norms as it is [9]. On the other hand, another stream of authors argues that companies pursuing certification will not necessarily experience a significant improvement in their quality management processes, mainly because of the lack of commitment from the top administration [10]. Therefore, there is an important gap not addressed in the literature regarding the interdisciplinary aspects of quality and risk management, and both academia and industry may benefit from this debate. In order to address such research gap, we reviewed, analyzed and outlined a profile of the existing academic research regarding the risk management practices introduced by ISO 9001:2015 which would be incorporated into the organization’s quality management system.

The present article was structured in four further sections to better address the current research goal. In the following section, a theoretical framework is presented to introduce the main definitions and outline the current debate regarding the researched topic. Section 3 describes the methods used to search, collect, analyze and synthesize the data collected. Section 4 presents the results of the bibliometric analysis conducted and discusses the main findings uncovered by it during the analysis. Finally, Sect. 5 presents some conclusions, implications, limitations of this article and some suggestions for further research.

2 Theoretical Framework

2.1 Quality Management

Quality is a degree to which a set of inherent characteristics fulfills requirement [11]. The quality of services and products is dependent upon the way organizations perform their activities through the production chain [5] and, given its impact in the company’s business, it should be considered strategical by organization [12]. In other words, managing quality enables organizations to compete and sustain long-term competitive advantage in the market [13].

In this context, quality management is a group of processes focused on the quality of activities carried out by an organization, encompassing aspects such as planning, control, assurance and improvement of processes [5]. Some common principles, practices and techniques guide such managerial activities in organizations in general, although it may be adapted according to the particularities and cultures of each company [14].

The ISO 9001:2015 presents some quality management principles that are essential for the elaboration and interpretation of quality management guidelines, namely: customer focus, leadership, people engagement, process approach, improvement, evidence-based decision-making and relationship management. The purpose of such quality management principles, practices and guidelines are to continuously improve organizational processes in order to achieve the quality goal defined by the organization [15]. Basically, this goal is achieved through continuous improvement techniques such as Deming’s PDCA (Plan—Do—Act—Check) cycle, which consists in the systematic and continuous application of a cyclical system applied to organizational processes, including the quality management system [16].

2.2 ISO 9001:2015

ISO 9001:2015 is part of the family of standards referred to as 9000 series—Quality Management Systems. It is a standard that presents the requirements to develop a quality management system, intended to organizational procedures, certification and contractual purposes [5]. Organizations pursuing certification must adapt their processes to comply with requirements established by the standard and later be assessed by a group of examiners. If successful, the organization receives a certificate of national and international recognition because of its compliance with the quality standard [17]. A quality certification was once a way to differentiate and set itself apart from the competition, although, nowadays, due to its popularization and acceptance in the corporate world, it is practically a necessary certification for the survival of companies in the market [18].

ISO standards are continuously reviewed and improved to incorporate and adapt concepts and business management practices to today’s challenges [17]. For instance, the 2008 review focused on business process management, highlighting the importance of organizations defining processes driven by a comprehensive and systemic understanding of what quality management is, covering aspects such as identification, implementation, management and continuous improvement of the quality management system [19]. In addition to that, the 2015 review, besides its use of the PDCA cycle at all levels of the organization, the main emphasis shifts to developing a risk mentality as an essential strategy to develop an effective quality management system [11]. All those changes had the purpose of enabling companies to adapt and navigate themselves into the dynamic business environment in which they compete, allowing them to sustain growth and improve success rates. Given this dynamic nature, organizations certified by previously standards, such as ISO 9001:2008, need to adapt their practices to the current standard in order to maintain their certification.

The underlining assumption embedded into the ISO 9001:2015 is that developing incentives to towards an enterprise risk mentality would make organizations to think about threats and opportunities existing during the decision-making process [8]. By critically thinking and acting in a timely manner, organizations would ensure the quality of their products and services, ultimately leading to the achievement of their strategic goals [14].

2.3 Risk Management

Organizations are constantly under the influence of internal and external factors that make uncertain whether and when planned goals will be achieved. The effects of such factors on the organization’s goals are called risk [20]. In other words, risk is an uncertain event or condition that, if it occurs, has a positive or negative effect on one or more project objectives such as scope, schedule, cost or quality [21].

Risk management is a group of processes designed to increase the rate of success of complex, multidisciplinary and challenging activities such as managing projects and developing products [22]. In addition to that, it is an essential practice in any business environment because risks affect organizations in many ways, including main processes responsible to sustain and guarantee the achievement of strategic objectives [23]. Therefore, risk management should be incorporated into strategic plan that managers actually execute [24], taking into account specific characteristics of the internal and external organizational environments and enforcing procedures to monitor and control it.

In the context of quality management systems, risk management is a requirement that must be implemented in all organizational processes [25]. Moreover, the risk mentality created by such procedures should allow organizations to determine the factors that may cause deviations from the intended outcomes of their processes and quality management system, allowing them to adopt preventive controls measures to minimize threats and maximize opportunities [16].

3 Methods

Given the aim of this article, a bibliometric analysis was conducted to address the research gap identified, which is a technique used to better identify standards in a given theme [26]. A bibliometric analysis usually starts with a bibliographic review, which is composed of three distinct steps, namely planning, review and findings, and then a descriptive and content analysis stage aiming to discuss the results [27].

The planning phase consisted of developing the bibliographic portfolio to identify how ISO 9001 was discussed in academia in the context of quality and risk management, allowing to outline the relationship between these two themes. Following that, a content analysis was designed to identify the main topics discussed after the insertion of risk management in quality management systems by ISO 9001:2015.

The bibliographic portfolio was based on data from the Web of Science Core Collection and Scopus databases, which combined cover the most relevant journals and publications in the field. Moreover, they allow the complete extraction of bibliometric data in a way data allows later analysis.

The following criteria were used as inclusion parameters: proceedings (in the case of the Web of Science Core Collection), conference papers (in the case of Scopus) and finally, articles in both of them. The timespan used was from January 2015 to February 2018, since the latest ISO 9001 review was presented in 2015. Therefore, given the focus on recent developments, conference papers were included as a search parameter in order to capture the novelty of the subject addressed. Finally, the search strings used three main identifiers: the first for quality management, another for risk management and one more for ISO 9001:2015. Thus, in order to extract the most appropriate publications, the following search strings were applied to the titles, abstracts and authors keywords fields: ‘quality’ AND ‘management’ AND ‘risk*’ AND ‘ISO’ AND ‘9001’ (Table 1).

Table 1 Bibliographic portfolio inclusion criteria
Full size table

After the planning stage, the bibliographic portfolio review began with the analysis of the raw data extracted from the databases. Initially, the Web of Science Core Collection hit 46 documents and Scopus 58 documents. The documents were then imported to Mendeley®, revealing 27 duplicated documents that were excluded. Finally, after this initial filter, 77 documents remained in the dataset.

A second filter was applied to the dataset which consisted of screening the titles and abstracts of all remaining documents, excluding those which not addressed the relationship between risk management and ISO 9001:2015. After that, 51 documents remained in the dataset, however, three were unavailable to researchers, resulting in a final sample of 48 documents (Table 2).

Table 2 Filtering process
Full size table

Initially, descriptive analysis was developed to identify aspects such as most relevant journals, total publications per year and most cited documents. After that, a content analysis was done by reviewing the full texts of all documents in the dataset, in order to group them by topic area, identify the main definitions and understand how risk management was applied in the context of quality management systems defined in ISO 9001:2015.

4 Findings

4.1 Descriptive Analysis

A descriptive analysis was conducted with the 48 documents in the dataset to identify the most relevant journals, the total publication per year during the timespan selected and the most cited documents in that period. Regarding the most cited journal, the Total Quality Management & Business Excellence was the main source of documents addressing the topic discussed in this document, with a total of 4 published documents discussing the relationship between quality and risk management in the context of ISO 9001.

This is a widespread theme among the various types of publications since the 48 documents are published in 41 different sources. Table 3 highlights information about the journals that published at least two documents of the selected sample, thus serving as a reference for researches.

Table 3 Journal information
Full size table

The number of documents published between 2015 and 2018 is illustrated in Fig. 1, allowing to identify an expected trend towards an increasing volume of academic documents regarding ISO 9001 as an integral part of risk management. For instance, between 2015 and 2017, after the publication of ISO 9001:2015 version, the number of documents published by year in the topic increased, going from 7 publications in 2015 to 24 in 2017, a trend that demonstrates the real interest of the academy in studying the risk management from the perspective of ISO 9001.

Fig. 1
figure 1

Distribution of documents published between 2015 and 2018

Full size image

In order to identify which documents of the sample were most influential in the literature, Table 4 was developed to illustrate the three most cited documents during the period considered.

Table 4 Most cited documents
Full size table

First, it is interesting to note that none of them were published in the periodicals highlighted in Table 3, emphasizing that there is no direct relationship between the number of documents published by the journal and the number of citations per document. Subsequently, it is possible to verify, through the specificity of the journals of the most cited documents, that the researched topic permeates several areas of knowledge, being therefore a multidisciplinary subject.

The descriptive analysis of the dataset allowed us to identify and understand how ISO 9001 was discussed in academic research on quality and risk management, showing that it is a recent topic that is attracting the interest of researchers in such areas.

4.2 Content Analysis

Content analysis is a technique of textual analysis through the codification of information, aiming to analyze the content of documents in a systematic, objective and reliable way [28]. Therefore, the analysis developed in this article categorized studies into themes related to risk management and its application in quality management processes. As a result, three main categories were identified, namely: risk-based thinking; the influence of ISO 31000:2009; and integrated management system.

Risk-Based Thinking

The main modification brought by ISO 9001:2015 revision was the risk-based approach in the quality management system. For that reason, risk-based thinking is the most studied subject among researchers on the subject. For instance, Bacivarov et al. [29] analyzed the updates proposed by ISO 9001:2015 and argued that risk-based thinking could be the beginning of a new era in the development of quality management systems. Similarly, Rybski et al. [30] also analyzed the changes introduced by 2008 and 2015 versions of ISO 9001 and concluded that the application of the 2015 version, which considers risks across the organization, increases the likelihood of companies achieving planned objectives and gaining greater credibility within their customers base.

Another relevant aspect uncovered was the need for companies adapting to the new mentality based on risk management. Fonseca [7] raised some challenges to be faced by organizations already certified, such as the adaptation to a more complex, demanding and dynamic market environment, and the search for a business model that takes into consideration the requirements associated with risk. In this sense, Parra-López et al. [31] analyzed the constraints imposed to the implementation of a quality management system based on the ISO 9001:2015 requirements and concluded that companies’ management and supervision teams need to be more dynamic and willing to take risks in their strategies.

Considering risk management requirements present in ISO 9001:2015, Rodriguez et al. [32] proposed a model and partially implemented it in Rodriguez et al. [33]. As part of their work, the authors identified the strengths and weaknesses using a SWOT matrix and addressed the main issues through a risk management plan. Continuing the studies on ISO 9001 implementation, Wong [34] recommended that organizations conduct an initial review of existing process, identify potential risks and initiate ongoing risk management. The author argues that regular evaluations of implementation effort could increase the effectiveness of the quality management system and prevent negative effects.

Chiarini [25] categorized sources of risk according to the risk-based thinking for European Small and Medium Enterprises (SMEs), revealing that the main sources of risks are: making defective products; poorly trained employees; and lack of risk assessment. The author argues his findings may help quality managers involved in the new approach proposed by ISO 9001:2015.

An exploratory research was done by Sari et al. [35] to identify the main changes between ISO 9001:2008 and ISO 9001:2015. As a result, they presented processes for transition, and evaluated possible impacts to organizations. Moreover, they concluded that for efficient transition companies must identify stakeholders’ concerns, analyze internal and external organizational factors to formulate relevant strategies and objectives and register associated risks associated with business processes.

The Influence of ISO 31000:2009

By incorporating the risk management into ISO 9001:2015, quality management also became a requirement in ISO 31000:2009—Risk Management. Thus, it is possible to find in the literature documents that discusses both standards. Palacios [36], for instance, argues that both standards are part of the quality management system, meeting a set of increasingly rigorous generic guidelines with complex standards.

Similarly, Benetti [37] examined the influence of ISO 31000 and ISO 9001:2015 on organizations, arguing that corporate risk management has emerged as one of the most important business activities in the recent years, and that ISO 31000 risk requirements may help in achieving the business strategy of organizations.

Barafort [38] analyzed risk management procedures across several ISO standards in order to identify what is best suited to information security. The author argues that ISO 31000 adapts to several professional areas and the integration with aspects of other ISO, such as ISO 9001:2015, creates a better structure to support information technology management.

The influence of ISO 31000 on the requirements for ISO 91000 quality management practices is so relevant that, according to Samani et al. [39], both are similar and complementary. The author states that risk management and quality management are essential to organizational performance and ultimately suggests the development of a risk-based quality management system to reduce the number of resources allocated and as consequence improve organizational performance.

Integrated Management System

The implementation of an integrated management system is a viable strategy for organizations. In this regard, Giesen [15] proposed a risk assessment approach for integrated management contexts which takes into consideration the uncertainty that characterizes the process of business management whole process. The approach proposed by the author is based on fuzzy set theory and Monte Carlo simulation as a way to provide reliable risk estimative and support decisions regarding quality, safety, and environmental management systems.

Following a similar research stream, Nagel-Piciorus et al. [40] summarized the experience regarding the development of integrated management systems in an organization from the health sector. The authors described the steps for merging common management systems (quality, laughter, health and environment) with defined strategic planning and control.

Similarly, Muzaimi et al. [41] presented the benefits from integrating and aligning components of management system and their implementation aspects. Moreover, the authors proposed the integration of four management systems (ISO 9001, ISO 14001, OHSAS 18001 and ISO 31000), arguing that an integrated management system can be used to structure the quality management processes for sustainable practices in organizations.

Finally, Muthusamy et al. [42] proposed a comprehensive model and a holistic approach focused on implementing an integrated management system, addressing mainly four stages, namely, awareness, cooperation, consonance and combination. The authors argue that an integrated management system provides a viable and rational approach to reduce costs, allowing an efficient use of organizational resources and an interesting strategy to increase business excellence.

5 Conclusion

In order to address the literature gap concerning the interdisciplinary aspects of quality and risk management, the present research aimed to review, analyze and outline a profile of the existing academic research regarding the risk management practices introduced by ISO 9001:2015 which would be incorporated into the organization’s quality management system.

The method used to reach the aim was the bibliometric analysis, through a descriptive and later a content analysis. The documents (articles, proceedings and conference papers) were extracted from the Web of Science Core Collection and Scopus databases. The final sample that served as the basis for the descriptive and content analysis was composed of 48 documents published between 2015 and 2018.

Once the descriptive and content analyzes were completed, it was observed that the objective of drawing a profile on the insertion of risk management into the scientific productions focused on the study of the ISO 9001:2015 Quality Management standard was reached. In the first part of this research, a descriptive analysis was carried out with the proposal to obtain an overview about the relationship between ISO 9001, risk management and the quality management theme in the literature. It has been found that the subject is widespread in an important academic journal, showing that there are fields for research and publications. The association of ISO 9001 in scientific productions on quality management was established as a consolidated research relationship since between the years 2015 and 2017 the number of documents published more than tripled, confirming a growth trend, which should be confirmed until the end of the year 2018. Another relevant aspect is the interdisciplinarity with other areas of knowledge, which stood out in the subjects discussed in the most cited documents of the sample. In the final part of the research, the content analysis of the sample documents selected, sought to map the main current topics discussed in the academic literature after the insertion of risk management in quality management systems with the advent of ISO 9001:2015. When categorizing the studies, three thematic areas became evident regarding risk management and its application in quality management processes. These are risk-based thinking, the influence of ISO 31000: 2009 and the integrated management system.

The risk-based thinking was the main change in the quality management system after the publication of ISO 9001:2015. For this reason, risk-based thinking is the most researched subject among scholars in the area today. The work centers on the updates proposed by the latest version of ISO 9001 and considers that risk management may be the beginning of a new stage in the evolution of quality management systems. By introducing risk requirements into ISO 9001, quality management brings with it ISO 31000: 2009—Risk Management. With this, one finds academic productions that study the relation between these two norms. As risk management is embedded in organizations, there is an influence of ISO 31000 in the corporate world and also in the applications of ISO 9001:2015 focused on the business strategy of companies. Finally, the integrated management system is a trend in organizations. By optimizing available resources and reducing individual implementation costs, it can be used to structure processes across an entire organization.

Based on these conclusions, it is necessary for academic studies relating to ISO 31000:2009 and ISO 9001:2015. In addition, journals editors need to encourage more research and publications on the relationship between risk and quality management. For industry, its appropriate analyze how managers are dealing with the advent of risk-based thinking and how the integrated management system can contribute to the achievement of their strategic objectives.

This article contributes to the researchers of the area because through a literature review based on bibliometric and content analysis it was possible to qualify how risk management is approached in publications focused on the study of quality management with the advent of ISO 9001:2015. However, as a limitation, it is mentioned that the study has only an exploratory character, in which the descriptive analyzes of the documents of the sample, are of subjectivity. Given the limitation presented, further research is suggested to continue the conversation regarding the topic. For instance, in addition to applying a quantitative methodology, we suggest exploring the shared role of ISO 31000:2009 and ISO 9001:2015 to contribute to the debate regarding the topic, approaching it from different perspectives.