Risk-based thinking is the part of ISO 9001 that people find hardest to pin down. The standard asks you to "determine the risks and opportunities that need to be addressed" but prescribes no method, and so organizations tend toward one of two extremes: an elaborate scoring spreadsheet that is updated the week before the audit, or a single sentence in the manual saying that risk is considered. Neither helps anyone make a decision.
The idea behind the clause is simple. Before something goes wrong, ask what could stop you from delivering what you promised, and do something about the answers that matter. This article shows a way to do that which fits on one page.
What the standard requires
Clause 6.1 asks you to consider your context and the needs of interested parties, determine the risks and opportunities that bear on the quality system achieving its intended results, plan actions to address them, build those actions into your processes, and evaluate whether they worked. Actions should be in proportion to the potential effect on products and services.
The standard does not require a formal risk management process or a documented risk register. A register is nonetheless the easiest way to show an auditor what you did, and to keep track yourself.
What changed in 2026
According to certification bodies' summaries, ISO 9001:2026 divides clause 6.1 into three subclauses, with actions to address risks and actions to address opportunities treated separately, and with expanded guidance in Annex A. The practical consequence is that a register containing only threats will no longer be enough. You will be expected to show that you looked for opportunities and planned for them. See what changed from 2015 for the other changes.
Step 1: Find the risks that matter
Start from your processes and objectives. For each main process, ask the owner and two or three people who do the work:
- What could stop this process from delivering what the next step or the customer needs?
- What has gone wrong before, here or at a competitor?
- What are we dependent on: one supplier, one person, one machine, one system?
- What is changing in the next year?
You will collect more items than you need. Keep those that could affect customers, compliance or your objectives, and drop the rest. Ten to twenty risks is plenty for a small or mid-sized business.
Step 2: Rank them simply
Rate likelihood and impact as low, medium or high, and agree in a sentence what each level means for you. Three levels are enough. Five-point scales multiplied into scores from 1 to 25 give an appearance of precision that the underlying judgments do not support, and people spend the meeting arguing about whether something is a 3 or a 4.
Step 3: Decide what to do
For each risk in the upper right of the grid, choose a response: avoid it, reduce its likelihood, reduce its impact, share it through a contract or insurance, or accept it knowingly. Give each action an owner and a date, and put it where the work is done, in a procedure, a checklist or a purchase specification. A risk whose only action is "monitor" has not been addressed.
| Ref | Risk | Rating | Action | Owner | How we will know it worked |
|---|---|---|---|---|---|
| R1 | One approved supplier for the main resin grade; a stoppage halts three product lines | High / High | Qualify a second supplier; hold four weeks of stock until then | Purchasing | Second source approved; no line stoppage for lack of resin |
| R2 | Gauges used past their calibration date | High / Medium | Shared recall calendar with alerts; monthly check by cell leader | Quality | No overdue gauges at monthly check |
| R3 | The only setter who can run the large press retires next year | Medium / High | Train two setters; write setup sheets with photographs | Production | Two people signed off before retirement date |
| R4 | Job run to a superseded drawing | Medium / Low | Drawing revision shown on the job traveller and checked at first-off | Engineering | No rework from revision errors |
| R5 | Customer changes a specification after tooling is ordered | Low / Medium | Accept; contract terms cover the cost of change | Sales | Change costs recovered |
Step 4: Do the same for opportunities
An opportunity is a condition you could use to improve results. The questions are the mirror image of those for risks: what could we do better, faster or for someone new, and what is changing that we could take advantage of? Rate each by benefit and by effort, and plan the good ones in the same way.
| Ref | Opportunity | Benefit / Effort | Action | Owner | How we will know it worked |
|---|---|---|---|---|---|
| O1 | Customers ask for recycled-content parts | High / Medium | Trial two recycled grades; offer to three customers | Sales, Engineering | First order for a recycled-content part |
| O2 | In-mould sensors could detect short shots automatically | Medium / Medium | Pilot on one press for three months | Production | Scrap rate on pilot press compared with baseline |
| O3 | Complaint data is recorded but never analyzed | Medium / Low | Monthly Pareto chart reviewed at the production meeting | Quality | Top complaint cause reduced |
Step 5: Keep it alive
A register is useful only if it changes as the business changes. Three habits keep it current:
- Review it at every management review: what happened, which actions are done, what is new.
- Add to it when something changes, such as a new product, customer, supplier, system or regulation.
- Feed it from experience. A serious nonconformity or complaint often reveals a risk that was missing.
Evaluate effectiveness honestly. If a risk you rated low came true, or an action did not prevent a problem, record that and adjust. Auditors are reassured by a register that shows learning, and suspicious of one in which every action is "complete" and every risk has fallen.
Common mistakes
- Listing generic risks. "Loss of key customer" appears in every register and prompts no action. Name the customer, the cause and the consequence.
- Scoring without acting. The value is in the action column.
- Keeping risk separate from the work. If the action is not in a procedure, plan or budget, it will not happen.
- Ignoring opportunities. Under the 2026 edition this will be a visible gap.
Want a second pair of eyes? Chmltech helps Canadian organizations build, simplify and audit quality management systems. Book a strategy call or ask a question.
Sources
- DNV: ISO 9001:2026 standard revision
- DQS: ISO 9001:2026, key changes, timeline and transition checklist
- SGS: ISO 9001:2026 key updates and transition guidance
