Clause 6

Thank you

Answer:

FEMA alone is often not sufficient in terms that it only covers risks and not opportunities and it focuses on the risks within the processes and not on other element of the context. The standard requires organization to address risks and opportunities emerging from the entire context of the organization and not only processes.

On the other hand, the standard does not require any methodology to be used or document to be created, so the auditor cannot raise non conformity, he can only raise observation and that is not obligatory for the company. The organization alone can decide what level of risks assessment is appropriate for its QMS.

For more information, see: How to address risks and opportunities in ISO 9001 https://advisera.com/9001academy/blog/2016/06/21/how-to-address-risks-and-opportunities-in-iso-9001/