Document:

D601012105-PRO-001

# 1.7 Risk Assessment, Management,

Contingency Planning and Management of
Change

Page 1 of 4
Revision Date
Revision No:
Approved By:

February 2014
01
Robert Ybarra

API Q1 5.2 d, 5.2 g, 5.3, 5.5, 5.11.1, 5.11.2, 5.11.3

1.0

PURPOSE
To establish methods for identifying and controlling risk associated with impact
on delivery and quality of product and contingency planning needed to address
identified risk. The procedure identifies the techniques, tools and their
application for risk identification, assessment and mitigation.

2.0

SCOPE
Applies to the Managers or Directors of TOTs Quality, Engineering, Sales,
Service, Projects, Purchasing, Planning, Materials Management and
Manufacturing departments.

3.0

REFERENCE
Texas Oil Tools Quality System
Management of Change Form

4.0

3.1

Definitions
Risk Refers to anything which can prevent meeting objectives. All
forms of risk shall be managed, including technical, programmatic,
supportability, costs, and scheduled risks.

3.2

Acceptable Risks Risk that is understood and agreed to by the

organization management and customer and is sufficient to achieve the
defined success criteria within the approved level of resources.

3.3

Risk Assessment Matrix - A quick guide to provide an overview of the risk

management process and the risk-scoring tool with mitigation plans.

3.4

Risk Register A listing of known or perceived risk within the operating

system at Texas Oil Tools.

3.5

Contingency plan Plan(s) determined to minimize the identified risk

(Mitigation).

PROCEDURE
4.1

Risk Management Strategy

Document:
D601012105-PRO-001

# 1.7 Risk Assessment, Management,

Contingency Planning and Management of
Change

Page 2 of 4
Revision Date
Revision No:
Approved By:

February 2014
01
Robert Ybarra

API Q1 5.2 d, 5.2 g, 5.3, 5.5, 5.11.1, 5.11.2, 5.11.3

The purpose of the risk management is to identify risks early so that

appropriate abatement plans can be implemented to reduce the
consequences of the risk or likelihood that the risk will occur.
4.2

Process
The risk management process is defined below. Once a risk is identified,
it must be analyzed to determine the scope, magnitude, likelihood and
urgency. This information is used as the basis for making the decision of
how to handle the risk. Once the decision is made, plans are developed
and communicated to all involved, executed and tracked.

Figure 1

Risk Management Process Responsibility of all Managers

Identify the risk

Actions required in response to significant risk scenarios to mitigate effect
of disruptive incidents.
a) identification and assignment of responsibilities and authorities, and
b) internal and external communication controls. (See # 1.5
Communication)

Assess magnitude using the likelihood ratings in Figure 2 for impact on

quality or delivery and cost
Communicate department risks and mitigations plans to employees
Status at Management Review Meetings
1) Risk Assessment Matrix
2) Number of new risks identified
3) Number of risk removed
Update risk, as required.

Figure 2

Likelihood Rating

High

Likely to happen in the life of the job or project Controls have significant
limitations or uncertainty

Medium

Could happen in the life of the job or project or job Controls exist, with some
limitation or uncertainty

Low

Unlikely to happen in the life of the job or project Controls have minor
limitations or uncertainty

Document:
D601012105-PRO-001

# 1.7 Risk Assessment, Management,

Contingency Planning and Management of
Change

Page 3 of 4
Revision Date
Revision No:
Approved By:

February 2014
01
Robert Ybarra

API Q1 5.2 d, 5.2 g, 5.3, 5.5, 5.11.1, 5.11.2, 5.11.3

4.3

Risk Identification

Threats to completion or change to a product, job, project or process are

identified through the normal course of business. All Managers will have the
responsibility to identify and communicate risks within their areas of
responsibility, as well as notifying Quality and Top Management of changes
occurring in their area of responsibility to determine if the QMS will be affected.
Risk triggers are observable events that indicate a risk event can be discovered,
has occurred, or is about to occur. A list of triggers may include but not limited
to, follows:
4.3.1 Risk assessment associated with product delivery includes;
a) Facility/equipment availability and maintenance; and
b) Supplier performance and material availability/supply.
4.3.2 Risk assessment associated with product quality includes, as
applicable;
c) Delivery of nonconforming product; and
d) Availability of competent personnel.
4.3.3 Records of risk assessments and management of change including
actions taken will be maintained.
4.4

Contingency Planning (Mitigation)

Contingency planning process focuses on the decisions to be made when a risk

is identified. Mitigation is a risk handling decision that focuses on reducing the
likelihood of the risk event and or consequences should the risk occur.
4.4.1 The contingency plan shall include, at a minimum:
a) actions required in response to significant risk scenarios to
mitigate effects of disruptive incidents or change
b) identification and assessment of responsibilities and authorities;
and
c) internal and external communication controls.

Document:
D601012105-PRO-001

# 1.7 Risk Assessment, Management,

Contingency Planning and Management of
Change

Page 4 of 4
Revision Date
Revision No:
Approved By:

February 2014
01
Robert Ybarra

API Q1 5.2 d, 5.2 g, 5.3, 5.5, 5.11.1, 5.11.2, 5.11.3

4.4.2 Each department will be responsible to maintain their own

contingency planning records.

4.5

Management of Change
Texas Oil Tools must ensure that the integrity of the quality management
system is maintained when changes to the QMS are planned and
implemented.
For Management of Change, TOT shall identify the potential risks
associated with the change and required approvals prior to the
introduction of such changes with the use of the MOC Form. ```````````
4.5.1 MOC Implementation
TOT shall use the MOC process for any of the following that may
negatively impact the quality of the product:
a) changes in the organizational structure;
b) changes in key or essential personnel;
c) changes in critical suppliers; and or
d) changes to the management system procedures, including
changes resulting from corrective and preventive actions.
4.5.2 MOC Notification
TOT shall notify relevant personnel, including the customer when
required by contract, of the change and residual or new risk due to
changes that have either been initiated by the organization or requested
by the customer.
Records of MOC activities shall be maintained.