Keywords

1 Introduction

Organizations have been facing a strong and competitive market besides high customer expectations, what makes them to look for ways to stay competitive. To reach that, companies try to improve the activities that add value to the process and business [1].

The search for excellence is intimately related to their products, services and processes’ quality and to achieve it, many organizations opt for a Quality Management System (QMS) implementation, supported by several models and tools [2]. Besides not being considered a TQM model, the ISO 9001 standard can be a good start for companies that are at the beginning of the quality achievement process [3].

The ISO 9001 standard, elaborated by the Technical Commit of the International Standardization Organization (ISO/TC 176), defines requirements to support organizations on the quality and conformity of their products and services, fulfilling customers’ necessities [4]. International Organization for Standardization (ISO), in 2016, announced that there are 1,643,529 valid ISO 9001 certificates worldwide, being only 7% in ISO 9001: 2015. In Brazil, there are 20,908 certified companies, 3% in ISO 9001:2015 [5].

On its latest version, ISO 9001:2015 contains changes apparently easy but that implies big challenges for the organizations [6, 7]. One of the most significant changes was the risks approach, implicit on the preview versions of the standard and now treated as “risk-based thinking”, as a requirement for the entire organizational environment. This concept seeks to instigate organizations to be more careful and to think in long-term [3, 8,9,10].

The risk management is a very comprehensive term and the researches related to it are in contrast, much specifics, which always leads to a gap, even small, to be filled [11]. This can be inferred from a number of studies that have analyzed risk management in the context of companies QMS and ISO 9001 implementation processes.

It is important to observe that being in the Digital Transformation Era, organizations have to adapt their strategies and models for business processes to the digital reality [12], what can also be related to the risk-based thinking approach, in terms of long-term thinking and opportunities to company’s growth.

In order to assist further research in this field, the paper aims at finding relevant literature contributions on risks, with particular interest on its relation with ISO 9001 standard, in the aspects of its emerging issues, most frequent talked themes and existing gaps. This paper was structured as follows: the first section covers the introduction; Sect. 2 characterizes this paper’s research methodology; and Sect. 3 describes the findings and conclusion.

2 Research Methodology

To conduct the study, the authors based on a systematic literature review (SLR) which is a methodology used by academic researchers to manage knowledge diversity, mapping and evaluating the existing intellectual territory, being capable to develop and increase the subject aspects, contributing to the state of the art [13].

The SLR was conducted as follows: (a) establishing the research main question; (b) locating of studies, where it is established the search sources, timing and criteria; (c) analysis and synthesis (supported by QSR NVivo); and (d) findings and conclusions [14, 15]. The topics (a) and (b), described previously, are discussed on this section as follows.

2.1 Locating of Studies

The SLR process (Fig. 1) was conducted as follows: the main field of research was choose to answer the question “what kind of methodologies and methods, companies that have a QMS based on ISO 9001 can use as a support to the risk-based thinking requirement?”. The location of articles considered the key words in two electronic databases: Scopus and ISI Web of Science (WoS), citation indexes that coverage mainly focuses on journals [16]. Li et al. [17] affirms that WoS “is the oldest citation database with both bibliographic data and citation data going back to 1900”. Besides being oldest and having the longest coverage, WoS does not index all of the journals that are found in Scopus, what aims to the fact that Scopus “has a larger proportion of exclusive journals and this is the case in all fields” [16].

Fig. 1
figure 1

(Source adapted from [14])

SLR phases, methods, criteria and tools

Full size image

The period of research was established based on the ISO 9001 standard transition process: its past edition was published in 2008 and replaced in 2015. In terms of key words, it was observed macro themes, which are “risk” and “ISO 9001”. The standard version was not specified due to the transition process. The research included peer reviewed articles published in Journals or Proceedings of International Conferences.

From Table 1 it is possible to see the number of found papers and the selection process criteria, inferring the excluded ones. The process’s result was 46 articles.

Table 1 Systematic literature review process: papers selection (elaborated by the authors)
Full size table

2.2 Analysis and Synthesis

As inferred from Table 1, the locating of studies resulted in a final number of 46 articles, 18 of them found in both WoS and Scopus databases. To analyze the selected articles, it was used the thematic synthesis approach, coding and extracting data with QSR NVivo, an effective computer software used to code data from full articles [15].

QSR NVivo supported the most frequent words used in the literature analysis (see Fig. 2), making it easier to find the main subjects approached by each article.

Fig. 2
figure 2

50 most frequent words (elaborated by the authors supported by QSR NVivo)

Full size image

In parallel with the investigation above, the articles were analyzed by year of publication, indexed databases and types of publications (see Fig. 3); Table 2 presents the selected articles list.

Fig. 3
figure 3

Articles classification (elaborated by the authors)

Full size image
Table 2 Articles included in the literature review by author(s)/year, title and database
Full size table

The main analysis of the present article is described in this section. To answer the question proposed at the beginning of the SLR, the 46 papers were analyzed by methodologies, methods, models and/or tools presented in (see Fig. 4).

Fig. 4
figure 4

Articles x methodologies/methods/models/tools

Full size image

It was found from the selected papers, 16 (P1; P3; P4; P6; P8; P11; P12; P13; P14; P19; P23; P28; P31; P32; P39; P44) that do not mention any of the topics listed above. Therefore, besides presenting subjects related to risks, quality management system and ISO 9000, they were not used to compose the final chart. All of the others, propose, explain or mention some methodology, method, model or tool to support the risk management activities and to the “risk-based thinking” required by ISO 9001.

It can be inferred from the Fig. 4 that 15 papers describe methodologies, while 22 present some method/model/tool. The most frequent methodologies observed were ISO 31000 and PDCA cycle. Regarding to them it is important to highlight that ISO 31000 is based on PDCA, prescribing a risks approach unfolded in: to identify, to analyze and to evaluate (P—plan), to treat (D—do), to monitor (C—check) and to analyze (A—act). The most related tool was the FMEA (Failure Modes and Effects Analysis), probably due to its wide dissemination and customers’ requirements (for example automotive and aeronautic sectors and healthcare products). However, FMEA has its limitations.

The analysis process can become cumbersome and long, with possible costs for application; and the method is not prepared to discover complex failure modes involving various failures or subsystems. To solve that question it should be used the FTA (Fault Tree Analysis) [18].

In addition, the mathematical formulation for the Risk Priority Number (RPN) is questionable and discussible since there is not any justification that, the product of Severity, Occurrence Probability and Detectability, results in the RPN [19, 20].

That tree factors are hard to be determined precisely because most of the FMEA’s information is expressed by a linguistic form, what makes the interpretation in a subjective way for the reader [19]. The same problem can happen with the Risk Matrix.

3 Findings and Conclusion

Nowadays, researches in risks and ISO 9001 are increasing, once that the companies are in an embryonic and underdeveloped stage to integrate the risk management approach into their QMS’s. This SLR addresses a current challenge for companies that want to maintain their QMS’s, helping them to understand how the risks approach can be realized, supported by theoretical models designed and described, in the most part, in conformity to ISO 31000 methodology.

As it was described in the preview section, qualitative tools may have issues that, if not observed or treated adequately, can give unexpected results to the analysis. To avoid problems like that, companies should look for combinations of qualitative and quantitative tools that better adequate to their necessities.

However, it has much more to be done regarding to the applicability of the tools in the companies’ contexts and about the efficiency of them. The authors suggest as future researches the application of some methodology in the context of certified companies, to evaluate its efficiency for the risk-based thinking approach.