Management system guidance
6.1 Actions to Address Risks and Opportunities
ISO Navigator Pro™ is a free tool that provides practical, expert guidance for businesses wishing to interpret and better implement the requirements of ISO 9001:2026, ISO 14001:2026 and ISO 45001:2018.
Our range of ISO templates cover the requirements of ISO 9001:2026, ISO 14001:2026 and ISO 45001:2018, and offer an easy way to implement your next management system.
6.1.4 Risks and opportunities
Clause 6.1.4 is where ISO 14001:2026 asks your organization to look beyond its environmental aspects and identify the risks and opportunities that could affect its environmental management system. When planning the EMS, your organization must consider its external and internal issues (4.1), the relevant requirements of interested parties (4.2) and the scope of the EMS (4.3). From these, it must determine the risks and opportunities related to:
- Its environmental aspects (6.1.2);
- Its compliance obligations (6.1.3);
- Any other issues and requirements identified in 4.1 and 4.2.
The risks and opportunities to be addressed are those needed to:
- Give confidence that the EMS can deliver its intended outcomes (enhanced environmental performance, meeting compliance obligations and achieving environmental objectives);
- Prevent or reduce undesired effects, including the possibility that external environmental conditions affect the organization;
- Achieve continual improvement.
Your organization must make the risks and opportunities it intends to address available as documented information.
What changed in ISO 14001:2026
6.1.4 is a new sub-clause number, but most of its content comes from the 2015 clause 6.1.1. The main changes are that risks and opportunities now have their own sub-clause, the "undesired effects" purpose now explicitly includes the potential for external environmental conditions (such as climate change, flooding, drought, water scarcity or biodiversity loss) to affect the organization, the documented information requirement for the planning process(es) now sits in 6.1.1 while 6.1.4 requires the risks and opportunities to be addressed to be available, and potential emergency situations are no longer determined here but in 6.1.2. The definition of "risk" has also been removed from clause 3; the standard now uses only the combined phrase "risks and opportunities". What used to be 6.1.4 Planning action is now 6.1.5.
Choosing a method
The standard does not prescribe a method, a number of steps or a format. A small, low-impact organization might use a simple qualitative workshop and a short register; a complex or high-hazard site might use a scored likelihood and consequence matrix. Factors that influence the level of formality include the size of the organization and the nature of its activities, the complexity of its processes, the need to demonstrate compliance, and the competence of the people applying the method. You can run one combined process covering aspects, compliance obligations and risks and opportunities, or keep separate registers, provided the outputs are linked.
Useful inputs include:
- Your context analysis (e.g. SWOT or PESTLE), including environmental conditions such as climate change, pollution levels, availability of natural resources, biodiversity and ecosystem health;
- The interested party register and any commitments your organization has adopted;
- The significant environmental aspects register;
- The compliance obligation register and the results of compliance evaluations;
- Incidents, nonconformities, audit findings and management review outputs;
- Planned changes to the business, sites, products or processes.
Examples of environmental risks
- Extreme weather, flooding, drought or wildfire damaging sites or disrupting operations;
- Water scarcity limiting the operation of pollution control equipment;
- Supply chain disruption or limited access to critical raw materials;
- Workers who cannot understand procedures because of language or literacy barriers, leading to spills or other incidents;
- Insufficient resources to maintain the EMS because of economic constraints;
- Failure to meet a compliance obligation leading to enforcement action, fines or reputational damage.
Examples of environmental opportunities
- Redesigning products or processes along circular economy principles to cut waste and resource use;
- Using real-time monitoring of energy and water consumption to target savings;
- Government grants to fund cleaner technology;
- Improved land management that enhances biodiversity on your sites;
- Partnerships with suppliers, local communities or environmental groups;
- Preparing early for emerging legislation to gain a competitive advantage;
- Training and engaging employees so that they contribute ideas and improve day-to-day environmental practices.
Risk and opportunity register
A risk and opportunity register is the simplest way to make your risks and opportunities available as documented information. For each entry, record a description, the source (context issue, interested party requirement, aspect or compliance obligation), the potential effect on the EMS or on the organization, a rating of likelihood and consequence (or benefit), existing controls, the owner, planned actions and the date of the last review. Treat it as a living document and review it when context, aspects, obligations or the business change, and at least before each management review. Your organization does not need to address every risk at once; it can decide which ones to act on, and when, based on its capacity, business needs and environmental goals. The actions themselves are planned under 6.1.5 Planning action and may become environmental objectives under 6.2.1. Our ISO 14001 templates include a risk and opportunity procedure and register.
You should seek and record evidence that your organization has considered its context, interested party requirements and EMS scope when planning, and has determined the risks and opportunities related to its environmental aspects, compliance obligations and other relevant issues. Check that external environmental conditions affecting the organization (e.g. climate-related risks) have been considered, that the risks and opportunities to be addressed are available as documented information, that the method is applied consistently, and that the results feed into planned actions (6.1.5), environmental objectives (6.2.1) and management review inputs (9.3).
More information on PDCA
Planning
Context
Planning
Support
Doing
Support
Operations
Checking
Monitoring, measurement, analysis and evaluation
Acting
Improvement
Want to know more?
- Read our customer's feedback
- Client list - who's using our templates?
- How the templates are formatted and download examples
- Why we use turtle diagrams and process maps
- What's the difference between a process and a procedure?
- About documented information
SSL certification
A certificate guarantees the information your internet browser is receiving now originates from the expected domain - https://www.iso9001help.co.uk. It guarantees that when you make a purchase, sensitive data is encrypted and sent to the right place, and not to a malicious third-party.
Free PDCA guidance
ISO Navigator™ is our FREE online training tool that shows you how to apply the principles of PDCA to your operations. We also offer many helpful templates that get you on the road to documenting your management system, please visit the download page.