Busting Myths About RISAS
If you have any questions about RISAS, please do get in touch with us using the contact details at the bottom of this page. However, in the first instance the section below has been prepared to correct some common misconceptions about the scheme.
- ‘RISAS certification should mean that I never see an NIR raised about this supplier’s products or services again.’
This is not necessarily the case.
A RISAS certificate is evidence that an independent, robust, rigorous and transparent assessment of the supplier has taken place, by experts. The supplier will have had to demonstrate how they meet requirements, not just ‘on paper’ but ‘walking the talk’.
The assessments are challenging in nature. Suppliers who do enough for their products and services to be awarded RISAS certification are likely to be the best performers in the marketplace. Rail vehicles they work on are less likely to encounter defects than those without the benefits of a rigorous assessment under RISAS.
However, this doesn’t mean rail vehicles will be immune from safety-related defects altogether. It will still be possible for National Incident Reports (NIRs) to be raised in relation to vehicles that may have undergone work on a relevant service by a RISAS-certificated supplier.
- ‘When an NIR is raised about a RISAS-certified supplier, the approval body (RISAB) won’t take any action.’
This is not the case.
There is a formalised mechanism for controlled feedback and resolution of customer issues when NIRs are raised which concern RISAS-certificated suppliers. This mechanism involves Railway Industry Supplier Body (RISAB).
It’s important to note that a NIR may be raised in good faith but the underlying cause may emerge as having nothing to do with the vehicle’s maintenance history, the work undertaken on it or RISAS.
- ‘There is no (or little) difference between RISAS supplier certification and RISQS supplier qualification, except for the price.’
The RISAS and RISQS schemes offer the opportunity to reduce duplication and costs associated with supplier assurance in official rail industry schemes. However, but they offer different types of assurance in proportion with the supply chain risk involved.
Companies will need to apply the Rail Industry Standard on Supplier Assurance (RIS-2750-RST) (or an equivalent approach) to meet legal requirements for managing supply chain risk. This RIS sets out what companies need to do and explains how different levels of risk will require corresponding levels of intervention. This may include the use of schemes like RISAS and RISQS.
By being registered and qualified for relevant products and services on the RISQS platform suppliers become visible to buyers on the RISAS website. Furthermore, this removes potential duplication of auditing efforts.
Registration is not onerous and usually only requires company details and product information. This requires a lower effort to manage the low levels of risk associated with procurement of less critical products and services.
Qualification requires a little more effort and means that companies need to provide more evidence that they can meet key legal and safety requirements. It could also trigger an audit by RISQS to confirm the capability of the supplier concerned. This mid-level effort is suitable for products and services where more assurance is needed.
By being registered and qualified for the relevant product codes on RISQS means suppliers can be identified and shortlisted by buyers from the web portal. Furthermore, this removes potential duplication of effort in auditing.
RISAS provides suppliers with certification for safety-critical products and services, and generates higher levels of supplier assurance in keeping with the higher risk. This involves a deep-dive assessment which goes beyond a conventional audit. It’s much more invasive and challenging.
So, RISQS alone does not prove a supplier is capable of providing products and services representing the highest criticality and risk to rail. Likewise, RISAS would be ‘a sledgehammer to crack a nut’ for suppliers of lower risk products.
Both RISQS and RISAS are managed by RSSB as official rail industry schemes.
- ‘There are no customers actually asking for RISAS certification as a pre-condition for being supplied to.’
This is not the case.
Companies will need to apply the RIS on Supplier Assurance (RIS-2750-RST) or an equivalent approach to meet legal requirements for managing supply chain risk. The RIS sets out what companies need to do and explains how different levels of risk will require corresponding levels of intervention.
Where companies are procuring critical products and services, they will need to ensure suppliers meet challenging standards. This may be via RISAS, as the only rail industry scheme in this field to provide the high levels of assurance required.
Where buyers don’t specify RISAS, they will need to do the equivalent amount of homework to assure themselves that the supplier is fit and capable of delivering those products and services safely.
However, RISAS provides buyers with the benefit of doing that thorough assessment via a third party and so reduces or eliminates the need for them to do their own assessment. This is why RISAS is an attractive option for buyers and why they are likely to expect it in suppliers of relevant critical products and services.
- ‘Nobody who is RISAS certificated can say what business benefits being certificated has actually brought them.’
RISAS provides clear benefits to certificated suppliers. This is especially so where buyers are specifying RISAS as a requirement to do business. Without RISAS, suppliers may risk being overlooked or have to spend extra time, money and effort in providing the equivalent level of assurance to buyers.
Many companies promote their RISAS certification with pride and raise awareness through media channels when certificates are awarded.
Case studies of companies who have benefited from RISAS certification are available on the RSSB website from Northern and ZF Services.
- ‘No customers are willing to state and commit to reducing their audit intensity or frequency of my facility if I were to achieve RISAS certification.’
Buyers may still need to do some auditing and assessing of their own, even when a supplier has a RISAS certificate. This may be because the work is not fully covered by the RISAS certificate in question, or to satisfy additional assurance that wouldn’t be covered by RISAS in any case.
However, this should only really be as a result of a gap analysis and be at a much lower effort and intensity. Essentially, the RISAS certificate should cover a great deal of what’s required.
To avoid unnecessary cost and effort for all parties involved it is worth challenging buyers about whether extra auditing is genuinely required if you hold a RISAS certificate.
- ‘It’s difficult for companies to trust a RISAS certificate because the assessment details are kept confidential between the assessor (RISAB) and the company being assessed.’
The beauty of RISAS is that the assessments are conducted independently by accredited experts, who in turn are assessed regularly by RSSB to retain that accreditation. Obtaining a RISAS certificate is challenging and it is in everyone’s interests that companies can trust in their value. RISABs tend to be professional approval providers for a range of schemes who take pride in their expertise. It simply wouldn’t be in RISAB’s interests to ‘go easy’. That would instantly devalue the scheme and reduce their ability to be trusted as assessors for RISAS and other programmes and initiatives.
Deep-dive assessments can uncover facts that does not reflect the ethos or intention of the suppliers concerned (put simply, could embarrass them). It’s only fair that suppliers investing in correcting and enhancing their capabilities are not shown up¬—these are companies getting better not worse.
If a company meets the standard required for a RISAS certificate, it means they have proven their capability at a high level. Any issues and improvement opportunities found on the way effectively become irrelevant.