Failure Risk Analysis of SMEs based on ISO 31000

Higher competition makes Indonesian SMEs continue to improve their competitiveness, as it has become the biggest driver of the national economy. The limitations of SMEs in the process of meeting customer demands are a major problem so the risk of process failure accepted by SMEs is quite large. Therefore, this study aims to reduce the level of risk failure in SMEs to be able to increase success in meeting customer demand. The UKM used as a case study in this research is CV.Z, which is engaged in the fashion sector with a made-to-order system. To reduce risk, the risk management process adopted adopts the approach of ISO 31000 as an international risk management standard. In the process of assessing the magnitude of the risk, the Failure Mode Effect Analysis (FMEA) technique was used in this study. The result is that as many as 38 failure modes were identified in the production process, with the highest Risk Priority Number (RPN) value of 162. Corrective action was taken in the largest RPN failure mode by applying new methods and providing training to workers. It is expected that implementing corrective actions can reduce the failure rate in the process in SMEs.


Introduction
The level of competition in the industrial world is currently getting higher because of the impact of globalization (Enis Bulak & Turkyilmaz, 2014).For this reason, companies must continue to strive to be competitive in meeting customer demands (Ferreira, Crema, & Verbano, 2020).This is not only for large companies but also for all businesses, both small and medium scale.Small Medium Enterprises (SMEs) in Indonesia need attention because they are a major factor in national economic development (Anton, Muzakan, Muhammad, Sudin, & Sidiq, 2015).Based on data by the Ministry of Cooperatives and Small Medium Enterprises (2017), SMEs contribute 60% of the country's GDP and absorb as much as 97.02% of the workforce.SMEs tend to have more limitations than large companies to compete, especially in the production process.Manual work has an impact on quality, customer satisfaction, and profit for SMEs where the potential risk of a process failure is greater.Risk is defined as the effect of uncertainty in achieving goals so that all companies always strive for more structured risk (Proenca, Estevens, Vieira, & Borbinha, 2017).Risk management is an approach that is often used in dealing with various uncertainties (Ferreira, Crema, & Verbano, 2020).Risk management maintains company assets by reducing potential risks before they occur, mitigating the impact of losses, and making repairs immediately after losses occur (Bajo, Borrajo, De Paz, Corchado, & Pellicer 2012).ISO 31000 is one of the references that is often used to build risk management structures in all industries, regardless of the nature of the company (Proenca, Estevens, Vieira, & Borbinha, 2017).The application of ISO 31000 consists of five main steps, namely communication and consultation for interested parties; changing the context in the form of company goals; a risk evaluation process consisting of risk risks, risks, and risk evaluation; risk treatment; level and critical review (ISO, 2009).Meanwhile, to carry out the risk measurement process, a tool is needed, where the Failure Mode Effect Analysis (FMEA) is an easy tool to apply, especially in the context of SMEs.FMEA identifies potential failure modes, failures, failures, and areas that affect the error of a company (Silva, De Gusmão, Poleto, Silva & Costa, 2014).The amount of risk of failure is calculated based on three factors, namely the failure of failure if it occurs or severity (S), frequency of failure if it occurs or occurs (O), and the probability of failure detected before impact occurs or detection (D) (McDermott et al., 2009).The third-factor values are on a scale of 1 to 10 and will be multiplied to get a Risk Priority Number (RPN) (McDermott et al., 2009).The highest RPN value is prioritized for corrective action, and then the new RPN results are determined at an acceptable level for all potential failure modes (McDermott, Mikulak, & Beauregard, 2009).
One of the SMEs in Yogyakarta is engaged in fashion, namely CV.Z uses the production system on a make-to-order basis.CV.Z is experiencing major problems in the production process so it requires control.Process failures during production often occur so SMEs experience losses and increase costs.To overcome this, it is necessary to identify the risk of failure in the production process to determine the critical risks that must be corrected.Therefore, this study will mitigate risks with the ISO 31000 approach in the production section of CV.Z. Risk assessment is carried out using FMEA.Furthermore, it provides an improvement plan based on the process failure mode to lower the level of risk.

Literature Review
This section contains theory used in the research.Theories regarding the importance of risk management and techniques using FMEA are presented.

Risk Management
Risk management plays an important role for SMEs.With risk management, the uncertainty of achieving something can be detected, for example in terms of achieving increased opportunities, achieving targets, performance, and others (Mateescu, Dinu, & Maftei, 2019).With the implementation of risk management in SMEs, it can prevent expenses from an event that has the potential to occur and this supports SMEs in running and developing future businesses for the long term (Ferreira, Crema, & Verbano, 2020).
One of the studies on risk management in SMEs shows that the results of implementing risk management have a positive impact on a defensive strategic orientation that leads to increased competitiveness (Brustbauer, 2014).In risk management, there are various kinds of processes that are carried out, of which the risk assessment stage is the most important phase (He & Lu, 2018).The risk assessment is carried out both qualitatively and quantitatively.Quantitative methods are more reliable than qualitative because qualitative data relies on subjective evaluation (Mateescu, Dinu, & Maftei, 2019).However, actual risk cannot be completely objective, so in this context, quantitative assessment becomes a technique that supports qualitative assessment (assessment by experts) (Li & Zeng, 2014).

Failure Mode and Effect Analysis
Failure Model and Effect Analysis (FMEA) is a systematic method that aims to identify and prevent problems before they occur, both in products and processes (McDermott, Mikulak, & Beauregard, 2009).FMEA can increase the effectiveness of the risk assessment process by ensuring the accuracy of the process and its controls (Mateescu, Dinu, & Maftei, 2019).The main objective of FMEA is to identify failure modes, and then make efforts to reduce the occurrence of failures by ranking the highest values based on the RPN value ( Nunhes, Motta Barbosa, & de Oliveira, 2017).The failure mode is a way in which a component, system, sub-system, or process has the potential to fail in meeting a design (Liu, Liu, Bian, Lin, Dong, & Xu, 2011).When a failure mode occurs in one component, it can be the cause of a failure mode in another component.The effect of each identified failure mode needs to be known to anticipate the emergence of other failures (Liu, Liu, Bian, Lin, Dong, & Xu, 2011).Based on the assessment from FMEA, the results can be used to improve quality, design something better, and benchmarking (Doshi & Desai, 2017).Besides, FMEA is also useful for improving testing and process control, both of which are very important parts of a successful product development process (Cabanes, Hubac, Le Masson, & Weil, 2016).
As discussed in part I, there are three factors in determining risk in FMEA, namely the consequences of failure if it occurs or severity (S), the frequency of failure if it occurs or occurrence (O), and the probability of failure being detected before the impact occurs or detection (D).Here will describe each of the ranking criteria from S, O, and D based on (McDermott, Mikulak, & Beauregard, 2009), as shown in Table 1,  Table 2, and Table 3.

Methodology
This research as a whole was carried out based on the ISO 31000 approach which contains stages for building a risk management structure.The stages in ISO 31000 consist of a communication and consultation process for interested parties; defining the context in the form of company goals; a risk assessment process consisting of risk identification, risk analysis, and risk evaluation; risk treatment; monitoring, and critical review.In the risk assessment process, the FMEA technique is used, where the result is a sequence of failure modes with the highest to lowest RPN values.Next, provide corrective action on the failure mode which is prioritized to reduce the RPN value.The research stages can be seen in Figure 1.
Direct observations are made on the production process to observe problems and failure modes that occur.The results of the identification of the failure mode are assessed by the expert using a questionnaire to determine the severity (S), occurrence (O), and detection (D).Next, brainstorm to produce suggestions for corrective action.The process of brainstorming is carried out by the production team with SME management to find proposals that can be implemented following company policies.

Results and Discussion
This section discusses the process and results of risk management based on the ISO 31000 approach to CV. Z.The results of the study will show the level of risk experienced by CV.Z current and the corrective actions that can be applied to the identified failure modes.

Communication and Consultation
The initial process of ISO 31000 is communication and consultation.This is not only at the beginning, but at all stages of risk management to ensure the implementation process is following the management's decision.

Establishing the Context
Determining the context referred to in this section is determining the goals the company wants to achieve.The business system used by CV.Z is made to order so that the level of uncertainty is very high, so CV.Z wants their production process to run efficiently to minimize uncertainty.The scope of risk management in this study is focused on the production process.Responsibility and authority in carrying out risk management at CV. Z is held by the operational director.Meanwhile, the determination of risk criteria is adjusted to the policies of this company.
The risk criterion is related to the company's financing or ability from a financial point of view regarding the decision to take corrective action from the identified risks.

Risk Assessment
The risk assessment stage is finally carried out after determining the scope of using FMEA.Risk assessment is divided into three stages.
1) Risk Identification: At this stage, the identification process is carried out based on the existing production process in CV.Z.The results of risk identification carried out by FMEA assessment can be seen in Table IV (See attachment I).
In the results of risk identification, 38 failure modes were identified in all processes.The highest RPN is 162 in the defective product failure mode that passes until it is received by the customer.This failure mode will impact the low consumer confidence in the product so that if the frequency of this incident occurs frequently, it will increasingly affect long-term consumer confidence, and the opportunity to get a bigger market will be low, ultimately reducing the number of purchases When the number of purchases decreases, the income received by the company will also get smaller.This failure mode has a severity value of 9, meaning that the severity is very high and dangerous.When this error occurs, then the consumer complains, the company must bear the shipping costs twice and replace the damage to the product by making a new product.This impact provides financial losses for the company.Besides, the process of making replacement products takes time, which will increase production time.Because the replacement product must be completed as soon as possible, the production process will disrupt the existing queuing process.This ultimately disadvantages the company because the use of time becomes ineffective.For occurrence, the failure mode has a value of 3, which means that this failure mode occurs in a time span between 22-30 days.Even though it is not in a short enough timeframe, this failure mode should still be a concern because the impact that is given greatly affects the value of the business.As for detection, the failure model has a value of 6 which means the company has a fairly low chance of being able to detect the failure.
When the product has been checked by the quality control (QC) department, then the defective product is missed, and the product will be immediately packaged without any further checking processes.After being packaged, the product is sent directly to the consumer's address so that the system that is implemented does not easily detect the failure mode when it has passed the QC process.The mode of failure of the defective product that passes is caused by several possibilities, including the inaccuracy of workers in carrying out the checking process or workers not following the checking procedure that has been designed causing some parts of the product not to be checked so that it is missed and finally the defective product is delivered to the consumer's hands.Another possible cause could also be that the procedures are too complicated for workers to carry out so they are confused, causing reluctance to follow the existing procedures.
2) Risk Analysis: The 5 reasons why analysis is used to determine the cause of the failure mode.The analysis was carried out on the failure model with the highest RPN value.The analysis can be seen in Table 3.The 5 why analysis asks the cause of a failure mode five times until the root cause is found.If the root is identified, the risk treatment that is carried out will have a significant impact on reducing risk.In failure mode, the defective product escapes until the hands of the consumer identifies two causes in the second why analysis, then traced again until the causes are found in the 3rd to the 5th why.
3) Risk Evaluation: Risk evaluation aims to compare the level of risk with the risk criteria set by the company.The result is a risk-taking action decision that has the greatest benefit for the company if it is chosen to deal with.
Based on a risk analysis of the failure modes of defective products that pass into the hands of consumers, the company considers two root causes to be overcome so that defective products that pass are reduced in frequency or even don't occur again and make it easier to detect the occurrence of failure modes.Cost is a risk criterion that is considered by SMEs when making repairs.Based on the identified root causes, it is estimated that the costs incurred for repairs can still be handled by the company, but it only requires efforts from the management of SMEs to change the working methods so far.Thus, the SME decided to address the two root causes because they both contribute to reducing the occurrence of defective product failure modes that pass into the hands of consumers.

Risk Treatment
At this stage, corrective action to address the root causes of the failure mode is given.The root causes were found, among others, because there was no evaluation from the management regarding the procedures carried out during the QC process, whether the procedures provided were correct with the standards of each product or not, and the management also paid less attention to the process of evaluating the abilities of the workers regularly.Periodically so that there is no skill increase and a lack of awareness to always work well.Corrective actions to overcome failures in delivering defective products to consumers, among others, by changing the methods of work that have been carried out so far.More precisely, it provides additional processes as anticipation to reduce the possibility of a defective product dropping by considering the various conditions of the company, both in terms of human resources and the ability of the company as a whole.The first method proposed is to check the product twice by dividing the QC process into two, which are referred to as QC 1 and QC 2. Workers in QC 1 will check the product as a whole, from detailed specifications to general specifications of products based on the provisions that have been prepared by the management.Furthermore, QC 2 will carry out major checks of products that have been checked by QC 1.If a defective part of the product is found in QC 2, then the product has the right to be returned to QC 1 to be followed up by the production department for repairs.Besides, the control process related to this is carried out by defecting the product return form, meaning that a defective product has been found that has passed and the code printed on the product is delayed to proceed to the next process because it must be returned to the production department for repair.It is hoped that this checking system is proposed to reduce the occurrence of defective products that pass into the hands of consumers.The next recommended course of action is to periodically evaluate the procedure.If a high level of defect is found, the team or party responsible for QC must update the specifications of the checking process carried out.If the defect level is reduced, a standardization process must be carried out from the specifications that have been made.The next action to address the root cause of the reduced capacity of workers or low awareness to work well is to provide training.Training is given regularly to increase work motivation and the results of the training also need to be controlled for its development, whether it has an effect on increased work productivity or not.

Monitoring and Review
The steps that must be taken from risk management are the existence of a monitoring and critical review process.This step is not the last, but a step that is carried out at all stages.Each stage that is carried out is monitored whether the process is taking place as it should be, for example, monitoring in the risk identification process is correct according to the rules in the FMEA in this study.The controlling party is the management of UKM.Because the process carried out is related to production, the head of the production monitors the risk identification activities carried out by his workers.

Conclusion
This study presents the application of the use of the FMEA method to identify risks or failure modes in the production process at CV.Z based on the steps of the ISO 31000 standard.The ISO 31000 approach adopted in the research resulted in a step-by-step risk management process.
Then, FMEA contributes as a scoring technique for inprocess failure modes, by presenting a ranking of all identified failure modes based on the RPN value.
The results shown by FMEA become the focus for corrective action in this study, namely the failure mode with the largest RPN value.This is a weakness of this study because the proposed improvement is only given to the biggest failure mode.For further research, it is hoped that it can provide improvement suggestions for the three failure modes with the largest RPN value, for example.The goal is to reduce the level of risk achieved by SMEs more significantly.Besides, in the FMEA method, there are differences in the values of three risk factors, namely severity, occurrence, and detection, which have different impacts.The relative weights of the three factors are not considered in calculating the RPN value.In fact, in different cases, the risk factors may have varying degrees of severity.It is hoped that in the future we can consider a fuzzy approach to overcome this weakness which can result in a large level of importance from the input severity, occurrence, and detection parameters of the FMEA method.