vaayaa Inclusive Education
Professional risk assessment

Quality Management and Process Excellence Risk Assessment: Process Failures, Controls and Continuous Improvement

A worked example of how a process excellence team identifies, scores and controls the risks that disrupt quality, process flow and continuous improvement, from equipment failure and handover errors to supplier variation, weak corrective action and safety breaches.

Updated November 2026 8 hazards assessed Review every 6 months Highest risk: High to Medium
See the Quality Management and Process Excellence course

Executive summary

This assessment shows how a process excellence team can find, rate and control the risks that threaten product and service quality, smooth flow and lasting improvement. Eight risks were chosen because they are plausible in everyday operations, quality and improvement work. Process breakdown, handover errors and technology outages are the most likely to disrupt output, while safety and legal breaches are less likely but carry serious consequences. Each risk is scored before controls and again after existing and added controls. Most risks fall to Medium or Low once the added controls are in place, but process breakdown and data loss stay at Medium because their impact remains serious. The first actions are a standard handover template, a tested restore of the quality records, a supplier quality review and a corrective action log with named owners. The operation is a teaching example, so every score illustrates method rather than a real business.

Focus area
Quality management and process excellence
Setting
Operations function of a mid-sized manufacturing and service business running documented processes and improvement programs
Method
Five by five likelihood and impact risk register

Scope

This assessment covers the quality management system of a mid-sized operations function, from incoming materials and core processes to inspection, corrective action, customer feedback and improvement projects. It looks at risks to product and service quality, process flow, people, data, safety and legal duties. It does not cover a real organization, a formal audit or any particular product design. Sector, jurisdiction, site count and systems are assumptions made for teaching and are labelled as such in the assumptions.

Context

The operation runs three production or service lines across one main site and a smaller satellite site. Work follows documented procedures, with a quality team that inspects output, a process engineering group that runs improvement projects and shift leaders who manage daily flow. Records are kept in a shared quality system and in spreadsheets for trend analysis. Suppliers provide materials and some subcontracted services. Each risk is scored before controls to show its natural level, then scored again after the existing controls and the additional controls that should be added.

Objectives, assets and stakeholders

The objective is to deliver consistent quality, stable process flow and steady improvement while protecting people, records and customer trust. The assets in scope are the core processes and their equipment, the work instructions and quality records, inspection data and improvement project files, supplier relationships and the reputation of the quality function. Stakeholders include frontline operators and shift leaders, the quality team, process engineers, senior management, customers who receive output, suppliers and subcontractors, and the bodies that inspect or certify the work where the sector requires it. Every risk has one owner role. The head of operations keeps the register current and reports to the leadership team each quarter.

Risk matrix: before and after controls

Each cell shows hazard numbers placed by likelihood and impact. Compare the two grids to see how controls move each hazard.

Before controls

Inherent risk

Risk before controls: rows are likelihood from almost certain to rare, columns are impact from insignificant to catastrophic. Cells list hazard numbers.
1
Insignificant		 2
Minor		 3
Moderate		 4
Major		 5
Catastrophic
5 Almost certain
4 Likely Likelihood 4, impact 3, score 12, high: H02 H05 Likelihood 4, impact 4, score 16, high: H01
3 Possible Likelihood 3, impact 3, score 9, medium: H08 Likelihood 3, impact 4, score 12, high: H04 H07 Likelihood 3, impact 5, score 15, high: H03
2 Unlikely Likelihood 2, impact 5, score 10, high: H06
1 Rare

After controls

Residual risk

Risk after controls: rows are likelihood from almost certain to rare, columns are impact from insignificant to catastrophic. Cells list hazard numbers.
1
Insignificant		 2
Minor		 3
Moderate		 4
Major		 5
Catastrophic
5 Almost certain
4 Likely
3 Possible Likelihood 3, impact 2, score 6, medium: H07 Likelihood 3, impact 3, score 9, medium: H04
2 Unlikely Likelihood 2, impact 2, score 4, low: H02 H08 Likelihood 2, impact 3, score 6, medium: H01 H05 Likelihood 2, impact 4, score 8, medium: H03
1 Rare Likelihood 1, impact 5, score 5, medium: H06
  • Low 1 to 4
  • Medium 5 to 9
  • High 10 to 16
  • Critical 17 to 25

Hazard register

A summary first, then the detail for each hazard.

Summary of hazards with scores before and after controls
No.HazardBeforeAfterOwner
H01 Process breakdown and service interruption 16 High 6 Medium Operations manager
H02 Human error and handover failure 12 High 4 Low Shift leader supervisor
H03 Technology outage and data loss 15 High 8 Medium IT manager
H04 Supplier dependency and incoming quality variation 12 High 9 Medium Supplier quality engineer
H05 Ineffective corrective action and ownership gaps 12 High 6 Medium Quality lead
H06 Safety and legal compliance breach in process work 10 High 5 Medium Health and safety lead
H07 Reputational damage from customer quality failures 12 High 6 Medium Customer quality manager
H08 Fraud, errors and financial leakage from rework and scrap 9 Medium 4 Low Finance business partner
H01

Process breakdown and service interruption

Operational Before 16 After 6

A core process stops or runs below standard because equipment fails, materials run short, staffing is thin or steps are unclear, so output is late or out of specification.

Who or what is affected: Operators, customers and shift leaders

Causes

Ageing equipment, unplanned absence, unclear work steps and shortages of spares.

Consequences

Late delivery, scrap, overtime costs and lost customer confidence.

Existing controls

  • Planned maintenance runs on a fixed schedule for key equipment.
  • Shift leaders review the daily output plan before each shift.

Control gaps

Spares levels are not reviewed against the actual failure history of each machine.

Additional controls

  • Prevent: Set minimum staffing and spares levels for each critical process step.
  • Respond: Hold a standard stop procedure with a named decision maker and a restart checklist.
Likelihood 4 x impact 4 before; 2 x 3 after Owner: Operations manager Target: Within 45 days Early warning: Unplanned line stoppages longer than the agreed limit in a month.
H02

Human error and handover failure

People Before 12 After 4

Shift changes, training gaps or unclear instructions cause work to be repeated, skipped or set up wrongly, and the next team does not know the true state of the process.

Who or what is affected: Frontline staff, incoming shift and customers

Causes

Fatigue, long shifts, verbal handovers and work instructions that are out of date.

Consequences

Nonconforming output, repeated work, injury risk and rework cost.

Existing controls

  • Work instructions are posted at each workstation.
  • Operators complete a basic induction before working alone.

Control gaps

Handovers are given verbally and no one checks whether the checklist was used.

Additional controls

  • Prevent: Use a standard handover template signed by outgoing and incoming shift leaders.
  • Detect: Audit a sample of handovers each week and record the gaps found.
Likelihood 4 x impact 3 before; 2 x 2 after Owner: Shift leader supervisor Target: Within 30 days Early warning: Handovers recorded without a signed checklist for a shift.
H03

Technology outage and data loss

Technology and data Before 15 After 8

The quality system, inspection data or shared spreadsheets fail, become corrupted or are lost, so records of conformity, traceability and trend data cannot be relied on or recovered.

Who or what is affected: Quality team, auditors, customers and suppliers

Causes

Hardware failure, software update errors, copies of files on local drives and no tested recovery plan.

Consequences

Loss of traceability, delayed release of product, failed customer reviews and regulatory exposure.

Existing controls

  • The quality system is backed up each night.
  • Access to the quality system is limited to named users.

Control gaps

Backups have never been restored in full, so the recovery time is unknown.

Additional controls

  • Recover: Test a full restore of quality records each quarter and record the time taken.
  • Prevent: Move trend spreadsheets into the controlled system with version history and access control.
Likelihood 3 x impact 5 before; 2 x 4 after Owner: IT manager Target: Within 30 days Early warning: Failed restore tests or backups not verified in the last month.
H04

Supplier dependency and incoming quality variation

Supplier Before 12 After 9

A small number of suppliers provide critical materials or subcontracted services, and when their quality, delivery or capacity slips, the operation receives out-of-specification inputs or stops.

Who or what is affected: Operations staff, customers and procurement

Causes

Single sourcing, supplier capacity limits and specifications that are unclear.

Consequences

Line stoppage, customer returns and penalties under supply contracts.

Existing controls

  • Incoming inspection samples each delivery against the specification.
  • The approved supplier list is reviewed once a year.

Control gaps

The approved list is not reviewed when a supplier changes ownership or site.

Additional controls

  • Prevent: Agree quality agreements and a second approved source for each critical material.
  • Detect: Track supplier reject rates and delivery performance each month against agreed limits.
Likelihood 3 x impact 4 before; 3 x 3 after Owner: Supplier quality engineer Target: Within 60 days Early warning: Supplier lots rejected at incoming inspection in a quarter.
H05

Ineffective corrective action and ownership gaps

Operational Before 12 After 6

Problems are logged but no one owns them, root causes are not found, or actions close without checking whether the problem has gone away, so the same failure returns.

Who or what is affected: Quality team, process engineers and customers

Causes

Unclear ownership, time pressure and root causes recorded as operator error.

Consequences

Repeat failures, customer complaints and wasted improvement effort.

Existing controls

  • Non-conformances are logged in the quality system.
  • Root cause analysis is required for major findings.

Control gaps

Actions are closed when a task is finished, not when there is evidence of effect.

Additional controls

  • Respond: Assign each finding a named owner and a due date at the daily meeting.
  • Detect: Check that closed actions have reduced the repeat rate after an agreed period.
Likelihood 4 x impact 3 before; 2 x 3 after Owner: Quality lead Target: Within 45 days Early warning: Open corrective actions past their due date.
H06

Safety and legal compliance breach in process work

Safety Before 10 After 5

Guards are removed, chemicals are handled without controls, lifting or machine changes are done without training, or records required by law are missing, so people are injured or the operation breaches its legal duties.

Who or what is affected: Operators, maintenance staff and visitors

Causes

Pressure to keep output moving, skipped checks and changes made without a risk review.

Consequences

Injury, enforcement action, fines and possible loss of operating permission.

Existing controls

  • Machine guards are fitted and inspected at each shift start.
  • Safety training is recorded for each operator.

Control gaps

Near miss reports are rarely read beyond the immediate team.

Additional controls

  • Prevent: Lock out machines before maintenance and require a written permit for high risk tasks.
  • Detect: Review near miss reports each month and link them to recent process changes.
Likelihood 2 x impact 5 before; 1 x 5 after Owner: Health and safety lead Target: Within 60 days Early warning: Near miss reports that repeat a hazard already logged in the past month.
H07

Reputational damage from customer quality failures

Reputational Before 12 After 6

A defect or late delivery reaches a customer, the complaint is handled slowly or inconsistently, and the failure is shared publicly, damaging confidence in the quality claims the business makes.

Who or what is affected: Customers, sales staff and senior management

Causes

Slow complaint routing, unverified claims and weak links between complaints and process data.

Consequences

Lost contracts, negative reviews, refunds and reduced trust.

Existing controls

  • Customer complaints are logged and answered by the customer service team.
  • Quality claims are checked against test records before publication.

Control gaps

Complaints are not linked to lot numbers, so the affected batch is hard to trace.

Additional controls

  • Respond: Prepare a customer communication plan with approved wording for common failure types.
  • Recover: Review each significant complaint for root cause and send the customer a written close out.
Likelihood 3 x impact 4 before; 3 x 2 after Owner: Customer quality manager Target: Within 60 days Early warning: Repeat complaints about the same defect from different customers in a month.
H08

Fraud, errors and financial leakage from rework and scrap

Financial Before 9 After 4

Scrap, rework and overtime are recorded inaccurately, materials are diverted, or false inspection results are entered to hide losses, so the true cost of poor quality is unseen and money leaks away.

Who or what is affected: Finance team, managers and shareholders

Causes

Pressure to meet output targets, weak checks on records and shared login details.

Consequences

Hidden losses, misreported cost savings and inaccurate release of batches.

Existing controls

  • Scrap is weighed and recorded at each line each shift.
  • The monthly cost of poor quality is reported to management.

Control gaps

The cost of poor quality is reported as a total without line level detail.

Additional controls

  • Detect: Compare recorded scrap with material usage and investigate gaps above an agreed level.
  • Prevent: Separate the person who records inspection results from the person who approves release.
Likelihood 3 x impact 3 before; 2 x 2 after Owner: Finance business partner Target: Within 90 days Early warning: Scrap figures that differ from material usage by more than the agreed margin.

Rating method and evaluation

Each risk is rated on two five-point scales. Likelihood runs from Rare to Almost certain, and impact runs from Insignificant to Severe. Multiplying the two gives a score from 1 to 25, which falls into one of four bands: Low from 1 to 4, Medium from 5 to 9, High from 10 to 16 and Critical from 17 to 25. The score is a guide for ordering work, not a measurement. Inherent risk is the score before any controls are applied. Residual risk is the score after the existing controls and the additional controls are in place, and it must never be higher than the inherent score. Impact is judged on customer harm, scrap and rework cost, lost output time, injury, legal exposure and damage to trust. A risk is never rated down only because it has not happened yet. Anything still High needs senior attention and a dated plan, anything Medium needs routine controls with a named owner, and anything Low is accepted and watched. Critical risks stop or limit the affected work until they are reduced. The people who do the work should challenge every rating at the monthly review, and a rating is changed when evidence from an indicator, audit or incident supports it.

Likelihood, impact and rating bands

Likelihood

  • 5 Almost certain: Expected to happen in most circumstances.
  • 4 Likely: Will probably happen in many circumstances.
  • 3 Possible: Could happen at some time.
  • 2 Unlikely: Not expected, but it could happen.
  • 1 Rare: Only in exceptional circumstances.

Impact

  • 1 Insignificant: No lasting effect. Handled within routine work.
  • 2 Minor: Small effect that is quickly corrected.
  • 3 Moderate: Noticeable effect that needs managed effort to correct.
  • 4 Major: Serious effect on people, delivery or reputation.
  • 5 Catastrophic: Severe or lasting effect that threatens the whole activity.

Bands (likelihood x impact)

  • Low (1 to 4): Accept and monitor.
  • Medium (5 to 9): Manage with routine controls.
  • High (10 to 16): Senior attention and a treatment plan.
  • Critical (17 to 25): Act first. Do not proceed until reduced.

Monitoring, escalation and review

Review this assessment every 6 months, and sooner when an indicator below reaches its threshold.

Early-warning indicators and escalation thresholds
Indicator to watchEscalate when
Open corrective actions past their due date.Escalate to the quality lead when any action is more than 14 days overdue, and to the head of operations after 30 days.
Handovers recorded without a signed checklist for a shift.Escalate to the operations manager on the first occurrence in a week, and to the head of operations if it repeats.
Unplanned line stoppages longer than the agreed limit in a month.Escalate to the maintenance lead when a stop exceeds the agreed limit, and to the operations manager if stops repeat within a week.
Supplier lots rejected at incoming inspection in a quarter.Escalate to the supplier quality engineer on any rejection, and to procurement when a supplier exceeds the agreed reject rate.
Failed restore tests or backups not verified in the last month.Escalate to the IT manager at once, and to the head of operations if the restore test has not passed within 14 days.

Contingency arrangements

If a serious event occurs, such as a critical process stoppage, a confirmed nonconforming batch reaching a customer or a loss of quality records, the operations manager stops the affected line and quarantines suspect product. The quality lead records what was made, where it went and which controls failed. The IT manager isolates the system and restores records from the latest tested backup. Safety, legal and customer contacts are made through the head of operations as required in the relevant jurisdiction. Customers are told what they need to know early and plainly, and work restarts only after the cause is confirmed.

Prioritized action plan

  1. Introduce a standard shift handover template with sign-off, owner shift leader supervisor, within 30 days.
  2. Test restoring the quality records from backup and document the recovery steps, owner IT manager, within 30 days.
  3. Run a supplier quality review for the two critical materials, owner supplier quality engineer, within 60 days.
  4. Open a corrective action log with a named owner and due date for every finding, owner quality lead, within 45 days.
  5. Set a monthly review of safety near misses against process changes, owner health and safety lead, within 60 days.

Conclusion

Reliable quality depends on steady habits: clear handovers, stable equipment, verified suppliers, closed corrective actions and tested backups. The highest scores sit with process breakdown, handover error and technology outage, and each has actions that bring the residual score down. Treat the register as a living record, review it on the stated cycle and seek qualified advice for any real safety, legal or certification question.

Assumptions and limitations

Assumptions

  • The operation runs documented processes with trained staff who follow work instructions and record inspection results.
  • Jurisdiction and sector are not specified, so legal and safety duties are described in general terms only.
  • The quality system is held in a shared electronic tool that the IT function backs up.
  • Two suppliers provide most critical materials, which is a teaching assumption rather than a fact about any business.

Limitations

  • The scores are examples for learning and do not describe any real organization or audit result.
  • Quality, safety and legal requirements differ by sector and country and change over time, so specialist review is needed.
  • This is educational content and does not replace a formal site-specific risk assessment or licensed professional advice.

Related frameworks to study

  • Plan, do, check, act improvement cycle
  • Failure mode and effects analysis
  • Root cause analysis such as the five whys
  • Hierarchy of controls
  • Three lines model of risk ownership

Professional Risk Assessment

China, India, United States, Indonesia, Pakistan, Nigeria, Brazil, Bangladesh, Russia, Japan, Mexico, Philippines, Vietnam, Egypt, Turkey, Germany, United Kingdom, France, Italy, Canada, South Korea, Australia, Spain.

For Learning Reference Only: This assessment demonstrates how risk assessment principles are applied in a practical setting, providing a useful reference for learning and understanding. Actual assessments may be adapted to suit specific site conditions and circumstances.

Keep learning

Study the subject behind this assessment.

Quality Management and Process Excellence course Read the best practices for this course

More Professional risk assessments

Hourly Active: 39,499 Learners