Management system guidance
6.1 Actions to Address Risks and Opportunities
ISO Navigator Pro™ is a free tool that provides practical, expert guidance for businesses wishing to interpret and better implement the requirements of ISO 9001:2026, ISO 14001:2026 and ISO 45001:2018.
Our range of ISO templates cover the requirements of ISO 9001:2026, ISO 14001:2026 and ISO 45001:2018, and offer an easy way to implement your next management system.
6.1.5 Planning action
Identifying significant environmental aspects, compliance obligations and risks and opportunities is only useful if something is done about them. Clause 6.1.5 requires your organization to plan:
- Actions to address its:
- How those actions will be built into its EMS processes (objectives in 6.2, support in Clause 7, operation in Clause 8, and monitoring in 9.1) or into other business processes;
- How it will evaluate whether the actions have been effective (see 9.1).
When planning these actions, your organization must take account of its technological options and its financial, operational and business requirements.
What changed in ISO 14001:2026
The requirement is unchanged in substance, but it has been renumbered from 6.1.4 to 6.1.5 because the new 6.1.4 Risks and opportunities has been inserted before it. Item a) now refers to risks and opportunities determined in 6.1.4 (in 2015 they were identified in 6.1.1). Emergency situations are now determined as part of environmental aspects in 6.1.2, so they are addressed here through your significant environmental aspects. If your procedures, manual or audit checklists quote "6.1.4 Planning action", update the reference to 6.1.5.
Prioritizing actions
Your organization does not have to act on everything at once. Start by forming an overall view of what needs to be done for the significant aspects, obligations and risks and opportunities that matter most to the intended outcomes of the EMS, then decide which actions to take and when based on business needs and environmental goals. Legal non-compliance, high-rated significant aspects and emergency-related aspects will normally come first.
Where actions can be built in
Actions can be delivered individually or in combination through:
- Environmental objectives and action plans (6.2.1 and 6.2.2);
- Resources, such as investment in abatement equipment or monitoring (7.1);
- Competence and awareness training (7.2 and 7.3);
- Internal and external communication (7.4);
- Procedures, work instructions and other documented information (7.5);
- Operational controls, including controls on externally provided processes, products and services (8.1);
- Emergency preparedness and response arrangements (8.2);
- Monitoring, measurement, analysis and evaluation (9.1).
Actions can also be built into wider business processes, for example by adding environmental criteria to design and development, putting environmental requirements into purchasing specifications and contracts, adding competence requirements to recruitment, or including end-of-life and disposal information in sales and marketing material. Where your organization runs other management systems (quality, energy, health and safety or business continuity), some actions may be best handled through those systems as part of an integrated approach.
Considering technology and business requirements
When choosing actions, consider the technological options available, including best available techniques where they are economically viable, cost-effective and appropriate. Balance these against financial, operational and business requirements such as budget, production capacity and customer commitments. This does not mean your organization must use environmental cost accounting, but the reasons for choosing or deferring an action should be clear and defensible, especially where a compliance obligation is involved.
Planning changes arising from actions
Many actions will change a process in some way, whether its inputs, resources, people, activities, controls, measurements or outputs. Typical areas affected include procedures and documented information, infrastructure, process equipment, employee training, supplier evaluation and interested party communications. Where an action changes the EMS, manage it as a planned change under 6.3 Planning of changes, considering the purpose and potential consequences of the change, the integrity of the EMS, the resources needed and any reallocation of responsibilities and authorities.
Evaluating effectiveness
For each action, decide in advance how you will know whether it worked: for example, a reduction in emissions or waste measured against a baseline, a clean permit compliance report, fewer spills, or a reduced risk rating in the register. Record who will carry out the evaluation and when, and feed the results into management review. Actions that have not worked should be revisited and, where appropriate, handled through 10.2 Nonconformity and corrective action or 10.1 Continual improvement.
You should seek and record evidence that your organization has planned actions for each of its significant environmental aspects, compliance obligations and the risks and opportunities it has chosen to address, and that each action is linked to an EMS process (objective, control, training, communication, monitoring or emergency arrangement) or to another business process. Check that the planning took account of technological options and financial, operational and business requirements, that there is a defined method and timescale for evaluating each action’s effectiveness, and that the evaluation results are recorded and reviewed.
More information on PDCA
Planning
Context
Planning
Support
Doing
Support
Operations
Checking
Monitoring, measurement, analysis and evaluation
Acting
Improvement
Want to know more?
- Read our customer's feedback
- Client list - who's using our templates?
- How the templates are formatted and download examples
- Why we use turtle diagrams and process maps
- What's the difference between a process and a procedure?
- About documented information
SSL certification
A certificate guarantees the information your internet browser is receiving now originates from the expected domain - https://www.iso9001help.co.uk. It guarantees that when you make a purchase, sensitive data is encrypted and sent to the right place, and not to a malicious third-party.
Free PDCA guidance
ISO Navigator™ is our FREE online training tool that shows you how to apply the principles of PDCA to your operations. We also offer many helpful templates that get you on the road to documenting your management system, please visit the download page.