Management system guidance
6.1 Actions to Address Risks and Opportunities
ISO Navigator Pro™ is a free tool that provides practical, expert guidance for businesses wishing to interpret and better implement the requirements of ISO 9001:2026, ISO 14001:2026 and ISO 45001:2018.
Our range of ISO templates cover the requirements of ISO 9001:2026, ISO 14001:2026 and ISO 45001:2018, and offer an easy way to implement your next management system.
6.1.1 General
Clause 6.1.1 sets the framework for the whole of clause 6.1. When planning your OH&S management system, look back at the issues you identified when understanding your context (clause 4.1), the needs and expectations of workers and other interested parties (clause 4.2) and the boundaries you set for the system (clause 4.3). From these, decide which risks and opportunities must be addressed so that the system delivers its intended outcomes, undesired effects are prevented or reduced, and continual improvement is achieved.
In ISO 45001, ‘risks and opportunities’ is a broad term. When deciding what needs to be addressed, you must take account of four inputs, each covered by its own sub-clause:
- the hazards you have identified (6.1.2.1);
- OH&S risks and other risks to the management system (6.1.2.2);
- OH&S opportunities and other opportunities (6.1.2.3);
- applicable legal requirements and other requirements (6.1.3).
The actions you decide to take are then planned under 6.1.4 Planning action.
Planning is an ongoing process
Planning is not a one-off exercise completed when the system is first set up. Circumstances change: new contracts are won, equipment is replaced, staff turnover rises, legislation is amended and workloads peak. Your planning process should anticipate these changes and keep re-determining risks and opportunities, both for workers and for the management system itself. The undesired effects you are trying to prevent include work-related injury and ill health, failure to fulfil legal requirements and other requirements, and damage to your reputation.
Two kinds of risk and opportunity
It helps to separate the two families of risk and opportunity that ISO 45001 refers to:
- OH&S risks and OH&S opportunities – these relate directly to workers: the likelihood and severity of injury and ill health arising from hazards, and the chances to improve OH&S performance, for example by eliminating a hazard or adapting work to the people doing it;
- Other risks and other opportunities – these relate to the management system itself: for example, the risk that a restructuring leaves no one responsible for contractor control, or that budget cuts stop the inspection programme; or the opportunity to make top management’s support more visible, or to improve how incidents are investigated.
OH&S risks and opportunities can also create wider business risks and opportunities, such as higher insurance premiums, lost production or improved staff retention, so you may wish to link your OH&S risk register to your corporate risk process.
Assessing changes before they happen
Your planning process must also identify and assess risks and opportunities arising from changes to the organization, its processes or the OH&S management system, where these are relevant to the system’s intended outcomes. For a planned change, whether permanent or temporary, the assessment has to be completed before the change is introduced. In practice this links 6.1.1 to your management of change process (clause 8.1.3). Typical triggers include:
- new or modified premises, plant, equipment or substances;
- new work activities, shift patterns or staffing levels;
- organizational restructuring or a change of key personnel;
- new or amended legal requirements and other requirements;
- changes to the OH&S management system itself, such as merging procedures or moving records to a new software platform.
Worker participation
Clause 5.4 requires you to emphasize the participation of non-managerial workers in identifying hazards and assessing risks and opportunities. Workers are often the first to know when a task has drifted from the written procedure or when a new risk has appeared. Use safety committee meetings, toolbox talks, hazard reporting cards and risk assessment workshops to involve them, and remove barriers such as language, literacy or fear of reprisal. See 5.4 Consultation and participation of workers.
Documented information
You need to maintain documented information on your risks and opportunities, and on the processes and actions used to determine and address them (6.1.2 to 6.1.4), to the extent needed to be confident that they are carried out as planned. Most organizations do this with:
- a hazard identification and risk assessment procedure setting out the method and criteria;
- an OH&S risk register or a set of task-based risk assessments;
- a register of other risks and opportunities to the management system, often reviewed alongside the context issues;
- a legal and other requirements register;
- an action plan showing who is doing what, by when, and how effectiveness will be checked.
If you need a ready-made procedure and risk register, see our health and safety management system templates.
You should seek and record evidence that your organization has used the issues from 4.1, the needs and expectations from 4.2 and the scope from 4.3 when determining its risks and opportunities. Check that hazards, OH&S risks, other risks, opportunities and legal requirements have all been taken into account; that planned changes, permanent or temporary, are assessed before they are implemented; that non-managerial workers have participated; and that documented information on risks, opportunities and the related processes is maintained and up to date.
More information on PDCA
Planning
Context
Planning
Support
Doing
Support
Operations
Checking
Monitoring, measurement, analysis and evaluation
Acting
Improvement
Want to know more?
- Read our customer's feedback
- Client list - who's using our templates?
- How the templates are formatted and download examples
- Why we use turtle diagrams and process maps
- What's the difference between a process and a procedure?
- About documented information
SSL certification
A certificate guarantees the information your internet browser is receiving now originates from the expected domain - https://www.iso9001help.co.uk. It guarantees that when you make a purchase, sensitive data is encrypted and sent to the right place, and not to a malicious third-party.
Free PDCA guidance
ISO Navigator™ is our FREE online training tool that shows you how to apply the principles of PDCA to your operations. We also offer many helpful templates that get you on the road to documenting your management system, please visit the download page.