Management system guidance
6.0 Planning
ISO Navigator Pro™ is a free tool that provides practical, expert guidance for businesses wishing to interpret and better implement the requirements of ISO 9001:2026, ISO 14001:2026 and ISO 45001:2018.
Our range of ISO templates cover the requirements of ISO 9001:2026, ISO 14001:2026 and ISO 45001:2018, and offer an easy way to implement your next management system.
6.1 Actions to address risks and opportunities
When planning the quality management system, your organization needs to work out which risks and opportunities matter and then decide what it will do about them. The risks and opportunities should be relevant to the context of your organization (Clause 4.1), as well as the requirements of relevant interested parties (Clause 4.2). In ISO 9001:2026 the clause is split into three sub-clauses, so that risks and opportunities are each dealt with in their own right:
- 6.1.1 Determining risks and opportunities – considering the issues and interested party requirements from Clauses 4.1 and 4.2 and deciding which risks and opportunities need to be addressed;
- 6.1.2 Actions to address risks – determining, analysing and evaluating risks, then planning, integrating and evaluating actions that are proportionate to their potential impact;
- 6.1.3 Actions to address opportunities – determining, analysing and evaluating opportunities, then planning, integrating and evaluating actions that suit your organization’s context.
ISO 9001:2026 now defines risk in Clause 3 as the “effect of uncertainty”. Risks and opportunities are treated as distinct – they can be identified and managed through separate processes – so an opportunity is no longer simply the positive side of a risk. Risk-based thinking (aimed at preventing undesired results) and opportunity-based thinking (aimed at pursuing desired results) both support the process approach.
There is no requirement for formal risk management, a documented risk management process or a risk matrix. Your organization may choose a more extensive approach, for example using the guidance in ISO 31000, but whatever method it uses should be applied consistently and effectively.
Where your organization has determined that climate change is a relevant issue (Clause 4.1), ensure the associated risks and opportunities have been considered and addressed.
What changed in ISO 9001:2026: the former clause 6.1.2 (planning actions to address risks and opportunities) has been divided into 6.1.2 for risks and a new 6.1.3 for opportunities. Risks and opportunities must now be analysed and evaluated as well as determined, a note highlights risks linked to disruption, and the effectiveness of actions on risks and on opportunities is evaluated and reviewed separately (Clauses 9.1.3 and 9.3.2).
If you need a risk and opportunity procedure and a risk register to help determine and document your organization's risks and opportunities, click here.
More information on PDCA
Planning
Context
Planning
Support
Doing
Support
Operations
Checking
Monitoring, measurement, analysis and evaluation
Acting
Improvement
Want to know more?
- Read our customer's feedback
- Client list - who's using our templates?
- How the templates are formatted and download examples
- Why we use turtle diagrams and process maps
- What's the difference between a process and a procedure?
- About documented information
SSL certification
A certificate guarantees the information your internet browser is receiving now originates from the expected domain - https://www.iso9001help.co.uk. It guarantees that when you make a purchase, sensitive data is encrypted and sent to the right place, and not to a malicious third-party.
Free PDCA guidance
ISO Navigator™ is our FREE online training tool that shows you how to apply the principles of PDCA to your operations. We also offer many helpful templates that get you on the road to documenting your management system, please visit the download page.