Risks and Opportunities in ISO 9001:2026: Clause 6.1 Without a Bloated Register
Risk-based thinking has been part of ISO 9001 since the 2015 edition, but many quality systems still handle it with a spreadsheet that was filled in once for the certification audit and rarely opened since. The 2026 edition makes that approach harder to defend.
Clause 6.1 now separates actions to address risks (6.1.2) from actions to address opportunities (6.1.3). Risks and opportunities need to be determined, analyzed and evaluated, and actions taken on risks should be proportionate to their potential impact. This guide explains what that means in practice, shows a method that a small or mid-sized manufacturer can actually run, and lists the evidence an auditor will look for.
For the wider set of 2026 changes, see our ISO 9001:2026 Guide. If you are planning the whole transition, start with the ISO 9001:2026 gap assessment checklist.
What clause 6.1 asks for
Paraphrased, the 2026 requirement asks you to:
Consider the issues from clause 4.1 and the requirements of interested parties from clause 4.2 when planning the QMS
Determine the risks and opportunities that need to be addressed so that the QMS can achieve its intended results, enhance desirable effects, prevent or reduce undesired effects and achieve improvement
Analyze and evaluate those risks and opportunities
Plan actions to address risks, proportionate to their potential impact on the conformity of products and services and on customer satisfaction
Plan actions to address opportunities you decide to pursue
Integrate the actions into QMS processes and evaluate their effectiveness
Always check the exact wording in your licensed copy of the standard. The important shift is that "risks and opportunities" is no longer one list with one treatment.
What ISO 9001 does not require
It helps to be clear about the limits, because over-engineering is the most common failure:
ISO 9001 does not require a formal risk management process such as ISO 31000, and it does not require FMEA.
It does not require a numeric scoring method, although many organizations use one.
It does not prescribe a register format. It requires that you can show the risks and opportunities were determined, evaluated and acted on.
In practice, most auditors will expect to see some documented information, because it is the simplest way to show the process happened. A single register with two separate sections, or two short lists, is enough for most organizations.
Step 1: Start from context, not from a blank page
Risks and opportunities in clause 6.1 are about the QMS achieving its intended results. They come from the issues you identified in clause 4.1 and the requirements of interested parties in clause 4.2. If your risk list cannot be traced back to your context analysis, an auditor will ask how it was built.
A practical approach is to take each significant issue and each relevant interested party requirement and ask two questions:
What could go wrong for the QMS because of this?
What could we gain from this if we acted?
Example. A contract machining company lists "two customers account for 60% of revenue" as an external issue. The risk is that a quality escape at either customer could threaten the business. The opportunity is that both customers are moving to new product platforms and want suppliers who can support first article inspection and PPAP-style approvals.
Step 2: Define evaluation criteria before you evaluate
The 2026 edition asks you to analyze and evaluate risks and opportunities. That needs criteria, decided in advance and written down. Keep them simple.
For risks, a three-by-three matrix is usually enough:
Likelihood: low (not expected in the next three years), medium (could happen in the next three years), high (expected within a year or has happened recently)
Impact: low (internal inconvenience, no customer effect), medium (delayed delivery, minor customer complaint, rework), high (product reaching the customer out of specification, safety or regulatory consequence, loss of a key customer)
Evaluation: high impact with medium or high likelihood needs a planned action; medium combinations are monitored or acted on at the owner's discretion; low combinations are accepted and reviewed at the next cycle
For opportunities, use different criteria, because the question is whether the gain is worth pursuing:
Benefit: contribution to customer satisfaction, conformity, efficiency or growth
Feasibility: cost, effort and capability needed
Decision: pursue now, plan for later, or decline, with a short reason
Writing the criteria into your planning procedure is the easiest way to show an auditor that evaluation is consistent.
Step 3: Treat risks proportionately
Actions on risks should be proportionate to their potential impact on conformity and customer satisfaction. That cuts both ways. A high-impact risk with a one-line action will be challenged, and so will a low-impact risk with a major project attached.
Typical risk actions in a manufacturing QMS include:
Avoid: stop the activity, for example decline work outside your validated capability
Reduce likelihood: add a control, such as a first article inspection, a poka-yoke fixture or a second supplier qualification
Reduce impact: add detection, such as final inspection or containment rules
Accept: document that the risk is accepted and who accepted it, and review it at the next cycle
Integrate the action into the process it belongs to. A new inspection step belongs in the inspection procedure or control plan, not only in the risk register. The register should point to where the action lives.
Step 4: Decide which opportunities to pursue
Opportunities are not the opposite of risks. They are possibilities to improve the QMS or its results: new technology, a new customer or market, a better supplier, a process simplification, or a chance to reduce waste.
For each opportunity, record the decision and the reason. Pursued opportunities become actions with owners and dates, often linked to a quality objective under clause 6.2. Declined opportunities do not need actions, but recording the decision shows the evaluation happened.
Example, continued. The machining company decides to pursue the platform opportunity. The action is to qualify a second CMM programmer and adopt a standard first article inspection report by the end of the second quarter. It becomes a quality objective with a target of first-time approval on 90% of new part submissions.
Step 5: Evaluate effectiveness
Clause 6.1 asks you to evaluate the effectiveness of the actions taken. This is the step most often missing at audit. Effectiveness is a question of results, not completion: did the risk become less likely or less severe, and did the opportunity deliver the expected benefit?
Good evidence includes:
A before-and-after look at the relevant metric, such as escapes, on-time delivery or supplier rejects
A note in the register, dated, with the result
Discussion and decisions at management review, since the effectiveness of actions to address risks and opportunities is a management review input under clause 9.3
Worked example: one register, two sections
A compact register for a 60-person manufacturer might have these columns.
Risks section: reference number; source (context issue or interested party); description; likelihood; impact; evaluation result; action and where it lives in the QMS; owner; due date; effectiveness review date and result.
Opportunities section: reference number; source; description; benefit; feasibility; decision (pursue, later, decline) and reason; action and linked objective; owner; due date; result.
Typical entries:
Risk: sole-source supplier for anodizing. Likelihood medium, impact high. Action: qualify a second source under the supplier management procedure by Q3. Effectiveness: second source approved, first lots accepted.
Risk: retirement of the only experienced quality inspector within 18 months. Likelihood high, impact medium. Action: knowledge capture and cross-training plan under clause 7.1.6, with two inspectors qualified by year end.
Opportunity: customer request for electronic certificates of conformance. Benefit medium, feasibility high. Decision: pursue. Action: add CoC generation to the ERP, linked to an on-time documentation objective.
Opportunity: ISO 13485 certification to enter medical device supply. Benefit high, feasibility low this year. Decision: plan for next year's review.
Twenty to forty entries is typical for an organization of this size. Hundreds of entries usually mean product-level risks have been mixed in with QMS-level risks.
QMS risks vs product and process risks
Clause 6.1 is about risks to the QMS achieving its intended results. Product and process risks, such as a design FMEA or a process FMEA, are a different tool. They belong in design and development (clause 8.3) and operational planning (clause 8.1).
Keep them separate but linked. If a process FMEA shows a recurring high-risk failure mode that your current controls cannot manage, that can become a QMS-level risk in the 6.1 register, with an action such as capital investment or a process redesign.
Records an auditor will ask for
The planning procedure, or the part of the quality manual, that describes how risks and opportunities are determined and evaluated, including the criteria
The current register or lists, with dates and owners
Evidence of actions, in the process documents where they were integrated
Effectiveness reviews
Management review minutes covering the effectiveness of actions on risks and opportunities
Common audit findings
No link to context. The register exists but cannot be traced to clause 4.1 and 4.2.
No evaluation criteria. Risks are listed with scores, but there is no defined basis for the scores or for the decision to act.
Opportunities treated as risks. Opportunities are listed with likelihood and impact scores and no decision about whether to pursue them.
Actions never closed. Due dates passed without follow-up.
No effectiveness review. Actions were completed, but nobody checked whether they worked.
A register frozen at certification. The dates show it has not been reviewed since the last audit.
Documents that help
A.P. Lyon's QMS Context and Planning Procedure ($99) for ISO 9001:2026 covers context and interested parties, separate determination and evaluation of risks and opportunities, proportionate actions, quality objectives and planning of changes, with the forms to record them. For product and process risk tools, see the Risk Management Procedure, the Design Risk Management Procedure and the Process Risk Management Procedure.
The planning procedure is included in every ISO 9001 QMS package, from Base ($595) to Complete ($1,295). If you also supply the medical device industry, the Dual-Standard QMS Context and Planning Procedure covers ISO 9001:2026 and ISO 13485:2016 together.
The documents need to be adapted to how your organization works. They are a starting point, not certification.
Next steps
Use the gap assessment checklist to see where clause 6.1 sits in your transition, read how risks feed management review, or choose individual procedures in Build Your QMS. For help building your first 2026 register, see consulting.
Comments