Desenvolvimento de um framework para o alcance da mentalidade de riscos como requisito da ABNT NBR ISO 9001:2015 - Cabral, Gabriella Silva (2024)
The increasing pursuit of ISO 9001:2015 certification by organizations, through the implementation of a Quality Management System (QMS), reflects the aim of securing a competitive advantage in the market by maintaining high standards of quality in processes and projects. However, obtaining certification requires organizations to embrace risk-based thinking, which is linked to their cultural aspects. Risk-based thinking during project and operational execution should naturally and intrinsically be part of organizational routines. Nevertheless, there are challenges to this implementation, such as a lack of knowledge about risk management and the difficulty in making the routine of risk-based thinking tangible or evident for certification audits. Therefore, this study aims to present the development and application of a risk management framework to introduce risk-based thinking in organizations, following an agile and assertive approach. The action research method was implemented, following a flowchart that encompasses planning, data collection, analysis, implementation of actions, and evaluation of results. The framework was developed based on an understanding of regulatory requirements and best practices in risk management and governance. It was applied in two real projects: "Project ABC" involving the importation and launch of a medical device, and "Project CQ Software", dedicated to the implementation of software within 90 business days. The implementation of the framework allowed the organization to optimize processes for identifying, analyzing, and responding to imminent risks. In "Project ABC", the model's application enabled the company to revise the pricing method for the equipment, creating opportunities for project gains. In "Project CQ Software", the quantitative analysis of the schedule demonstrated the feasibility of applying the PERT method for project schedule forecasting. In summary, the model proved to be applicable, becoming a driver for improvements in the risk management processes of the organization under study.