Management system guidance
6.0 Planning
ISO Navigator Pro™ is a free tool that provides practical, expert guidance for businesses wishing to interpret and better implement the requirements of ISO 9001:2026, ISO 14001:2026 and ISO 45001:2018.
Our range of ISO templates cover the requirements of ISO 9001:2026, ISO 14001:2026 and ISO 45001:2018, and offer an easy way to implement your next management system.
6.1 Actions to address risks and opportunities
6.1.2 Actions to address risks
When deciding how to plan and control the management system, including its component processes and activities, your organization needs to consider both the type and level of risk associated with them. ISO 9001:2026 requires your organization to determine, analyse and evaluate the risks that could have an undesired effect on its ability to provide conforming products and services consistently, and to enhance customer satisfaction. It must then plan:
- The actions it will take to address these risks;
- How those actions will be integrated into, and implemented through, its QMS processes;
- How it will evaluate whether the actions have been effective.
The actions taken should be proportionate to the potential impact each risk could have on the intended results of the QMS – a minor risk does not justify the same effort as one that could stop you delivering to your customers. Ensure that your organization is taking a planned approach to addressing risks, and that any actions taken have been recorded. Your options for dealing with a risk include:
- Avoiding the risk altogether;
- Accepting a risk in order to pursue an opportunity;
- Removing the source of the risk;
- Reducing the likelihood or the consequences;
- Sharing the risk (for example through insurance or contracts);
- Retaining risk by informed decision.
Risks during and after a disruption
ISO 9001:2026 adds a note reminding organizations that the risks they determine can include risks to their ability to keep providing conforming products and services during and after a disruption. Disruptive occurrences are incidents that negatively affect the planned provision of products and services – for example the loss of a key supplier, an IT or cyber outage, extreme weather, a utilities failure or the unavailability of key people. Consider contingency and business continuity arrangements for such events, and how relevant information will be given to customers (Clause 8.2.1).
Determining, analysing and evaluating risks
Methods your organization may use to determine, analyse and evaluate its risks include:
- SWOT analysis by the organization as part of its business strategy to identify the external risks and action plans to address them;
- Formal business risk assessment performed by the organization taking into consideration its context, associated risks and mitigation plan;
- Use of the process approach by the organization to identify sources of input, activities, output, receiver of output, performance indicators to control and monitor processes, the risks associated with them and action plans to address them.
Objective evidence that risks have been determined, analysed and evaluated may include:
- Meeting minutes;
- SWOT and/or PESTLE analysis;
- Planning, analysis and evaluation activities;
- Risk determination or evaluation records.
Risk management methodology
Understanding the risks and managing them appropriately will enhance your organization’s ability to make better decisions, safeguard assets, and enhance your ability to provide products and services and to achieve your mission and goals.
By considering risk throughout your organization the likelihood of achieving stated objectives is improved, output is more consistent and customers can be confident that they will receive the expected product or service. Risk-based thinking therefore helps to:
- Improve customer confidence and satisfaction;
- Assure consistency of quality of goods and services;
- Establish a proactive culture of prevention and improvement;
- Intuitively take a risk-based approach.
Risk-based thinking does not call for formal risk management methods or a documented risk management process, although your organization can choose a more extensive approach (for example using ISO 31000). We suggest that you use the familiar Plan-Do-Check-Act (PDCA) methodology to manage risk-based thinking in your organization; using an approach that ring-fences processes into ‘risk themes’ or groups such as:
- Business planning and strategic direction;
- Process risk;
- Product and service risk;
- Risk associated with the control of externally provided processes, products and services;
- Disruption and business continuity risk.
Risk analysis and evaluation
Assessment of the severity of a risk drives management attention and supports planning for risk mitigation. A qualitative risk assessment scheme consisting of qualitative probability and impact scales is undertaken to ensure consistency. Ensure that all accountable managers engage with risk owners to:
- Identify the control measures already applied to each risk i.e. existing control measures. These may be pro-active (reducing the probability) or reactive (reducing the impact);
- Rank the probability and impact of each risk after taking into account the actual effectiveness of the existing control measures;
- Enter the existing control measures and the associated current risk probability and impact scores into the risk register.
Forecast probability, cost and time data is assessed for each risk based on the causes and effects described, taking into account the existing controls and active responses. Probability or likelihood estimations are established giving due consideration to the effectiveness of existing control measures. The consequence evaluation criteria define the consequence criteria, assessed against the impact on product and service conformity, customer satisfaction, potential financial loss, reputation, legal and regulatory compliance and management time and effort.
Risk assessments are undertaken to provide an improved understanding of the risk profile and derive a more detailed understanding of certain cost and time risks. The evaluation then determines which risks need action and how much, so that the response is proportionate to the potential impact on the intended results of the QMS.
Risk treatment and mitigation
The objective of this step is to identify how the identified risks will be treated. Risk treatment involves identifying the options for treating each risk, evaluating those options, assigning accountability (for Very High, High and Moderate residual risks) and taking relevant action.
For each risk, the risk owner must establish an appropriate level of treatment. Control measures in addition to those already existing may be needed to achieve this level of mitigation. Accountable managers should engage with risk owners to develop a satisfactory response to each risk in order to:
- Identify a response strategy to treat, terminate, tolerate or transfer the risk;
- Identify response actions to improve control measures as required. These will be SMART;
- Decide how each action will be built into the relevant QMS process (e.g. a procedure, work instruction, inspection stage or supplier control);
- Identify a response action owner for each action and confirm with them that they accept accountability for implementing the action within the time allowed.
The risk owner is responsible for the development of the response. When a response action is completed, the risk should be reassessed to reflect any newly introduced control measure.
Monitoring and evaluating effectiveness
Continuous systematic and formal monitoring of implementation of the risk process and outputs takes place against appropriate performance indicators to ensure process compliance and effectiveness. Monitoring takes a variety of forms and ranges from self-assessment, inspections and internal audits, to detailed reviews by independent external experts. The results are used to evaluate the effectiveness of actions taken to address risks (Clause 9.1.3 e)), which is in turn an input to management review (Clause 9.3.2 g)).
Escalation
On occasion, it may be appropriate to escalate a risk to ensure it is assessed and/or managed by the person or party best placed to do so (able and with appropriate authority). For example, where a more substantial or coordinated response is required than the current risk owner can authorise or implement will justify higher level assessment and/or management, as appropriate:
- Escalate through established lines of management accountability all risks that may require mitigation;
- This may take place during formal reviews, or through other simple mechanisms at management meetings;
- Issue reports in accordance with requirements;
- Provide key information such as statistical data on numbers of active risks, unassessed risks, overdue actions, and others as appropriate.
What about opportunities?
In ISO 9001:2026 opportunities are no longer planned under this clause. They have their own requirement in Clause 6.1.3 Actions to address opportunities, which is covered on the next page.
Check that any actions taken to address risks are recorded, that each action was effective at addressing the risk, and that the action taken was proportionate to the potential impact of the risk. Objective evidence could be in the following various forms:
- Meeting minutes;
- SWOT analysis;
- Reports on customer feedback;
- Competitor analysis;
- Quality manual;
- Brain-storming activities;
- Planning, analysis and evaluation activities;
- Strategic planning documents;
- Business continuity or contingency plans;
- Design and development reviews;
- Production inspections and service reviews;
- Corrective actions;
- Nonconformance reports;
- Management review minutes;
- Risk determination or evaluation records.
More information on PDCA
Planning
Context
Planning
Support
Doing
Support
Operations
Checking
Monitoring, measurement, analysis and evaluation
Acting
Improvement
Want to know more?
- Read our customer's feedback
- Client list - who's using our templates?
- How the templates are formatted and download examples
- Why we use turtle diagrams and process maps
- What's the difference between a process and a procedure?
- About documented information
SSL certification
A certificate guarantees the information your internet browser is receiving now originates from the expected domain - https://www.iso9001help.co.uk. It guarantees that when you make a purchase, sensitive data is encrypted and sent to the right place, and not to a malicious third-party.
Free PDCA guidance
ISO Navigator™ is our FREE online training tool that shows you how to apply the principles of PDCA to your operations. We also offer many helpful templates that get you on the road to documenting your management system, please visit the download page.