Management system guidance
Risk-based thinking
Defining risk-based thinking
ISO 9001:2026 (3.7) defines risk as the 'effect of uncertainty'. Therefore, all risks relating to quality, safety, commercial or the environment, etc. can be dealt with under a single 'multidisciplinary' aspect of the management system.
Risk-based thinking should ensure that risks and opportunities are considered throughout your business's operations and activities. Risk-based thinking makes preventive action part of strategic and operational planning. ISO 9001:2026 pairs it with opportunity-based thinking, which focuses on pursuing desired results.
In order to identify what your business's risks and opportunities are will depend on context of your organization. The determination of the risks and opportunities when planning for the quality management system should include the inputs arising from:
- The analysis of external and internal issues (see 4.1);
- Requirements of relevant interested parties (see 4.2);
- The scope of QMS of the organization (see 4.3);
- The processes of the organization (see 4.4);
- The strategic direction of the organization.
The need for risk identification may also be determined on the basis of information and trends regarding the performance and effectiveness of the quality management system. Risks should be identified and evaluated when quality performance data indicates that there are trends of decreasing quality capability, or effectiveness of the quality management system.
Risks and opportunities in ISO 9001:2026
ISO 9001:2026 divides clause 6.1 into three sub-clauses and treats risks and opportunities as distinct topics, which you can handle through separate processes if that suits your business:
- 6.1.1 Determining risks and opportunities - taking account of your context (4.1) and interested party requirements (4.2), decide which risks and opportunities need attention so that the QMS delivers its intended results, undesired effects are prevented or reduced, desired effects are enhanced and continual improvement is achieved;
- 6.1.2 Actions to address risks - identify, analyse and evaluate the risks that could undermine your ability to supply conforming products and services consistently and to enhance customer satisfaction. Plan actions in proportion to their potential impact, build them into your processes and decide how you will judge whether they worked. Include risks to supply during and after a disruption;
- 6.1.3 Actions to address opportunities - a new sub-clause: identify, analyse and evaluate opportunities that could benefit that same ability (for example new practices, products or services, partnerships or emerging technologies), then plan, integrate and evaluate actions that suit your context and support the results you want.
Opportunities are no longer treated simply as the positive side of risk. Top management must promote both risk-based and opportunity-based thinking (clause 5.1.1), but neither requires a formal risk management process or a documented procedure.
Developing a risk management methodology
Risk will influence every aspect of your organization’s operations. Understanding the risks and managing them appropriately will enhance your organization’s ability to make better decisions, safeguard assets, and enhance your ability to provide products and services and to achieve your mission and goals.
A risk management regime, managed by the use of risk registers so as to allow for new risks to be progressively identified, rated and mitigated, should be implemented throughout the business. The principle is to ensure that:
- All significant risks to success are identified;
- Identified risks are understood and potential consequences mitigated;
- Assessment is undertaken of individual risks relative to other risks to support priority setting and resource allocation;
- Strategies for treating risks take account of opportunities to address more than one risk;
- The process itself and the risk treatment strategies are implemented cost effectively.
There are many other tools and methodoligies that you can adopt to help manage risks and identify opportunities including; learning from the past (Lessons Learned), PEST (Political, Economic, Social, Technological), PESTLE (Political, Economic, Social, Technological, Legal, Environmental), SWOT (Strengths, Weaknesses, Opportunities, Threats), FMEA (Failure Modes and Effects Analysis) or Hazard and Operability Study (HAZOP).
By considering risk throughout your organization the likelihood of achieving stated objectives is improved, output is more consistent and customers can be confident that they will receive the expected product or service. Risk-based thinking therefore helps to:
- Improve customer confidence and satisfaction;
- Assure consistency of quality of goods and services;
- Establishes a proactive culture of prevention and improvement;
- Intuitively take a risk-based approach.
Risk management themes
We suggest that you use the familiar Plan-Do-Check-Act (PDCA) methodology to manage your organization’s transition to risk-based thinking; using an approach that ring-fences processes into ‘risk themes’ or groups such as:
- Business planning and strategic direction;
- Process risks;
- Product and service risks;
- Risks associated with the control of externally provided products and services.
Business planning and strategic direction
PDCA |
ISO 9001 Clause References |
Suggested approach |
| Plan | 4.1, 4.2 | Has the organization identified both internal and external issues and interested parties that are relevant to and/or support the strategic direction of the organization? |
| Do | 5.2.1 | Is the strategic direction being utilized as an input to the QMS policies, objectives, risk management and the management review processes? |
| Check | 4.1, 4.2, 5.1.1, 9.3.2 | Is the QMS being assessed and reviewed in accordance with the strategic direction? |
| Act | 10.1 | Is the QMS being updated as necessary in response to changes in any of the above? |
Process risks
PDCA |
ISO 9001 Clause References |
Suggested approach |
| Plan | 4.4.1, 6.1, 6.2, 6.3, 8.5.6 | When establishing the QMS and planning for change, have risks to achieving process objectives been identified? |
| Do | 8.1 | Have the identified process risks been addressed? |
| Check | 6.1.2, 9.1.3 e), 9.3.2 g) | Is the organization analyzing the effectiveness of actions taken to address process risks? |
| Act | 10.2.1, 10.1 | Following analysis and corrective action is there evidence that process risks have been updated? |
Product and service risks
PDCA |
ISO 9001 Clause References |
Suggested approach |
| Plan | 5.1.2, 6.1, 6.2, 8.1, 8.2.2, 8.2.3, 8.3.2 | Have risks to achieving product or service conformity considered, as part of the planning for operational control? When determining and reviewing customer requirements? And has product complexity been considered during design planning? |
| Do | 8.1, 8.2.3.1, 8.3.3 | Have design and operational controls to address the identified product and service risks been implemented? |
| Check | 9.1.3, 9.3.2 | Is the organization analyzing the effectiveness of actions taken to address product risks? |
| Act | 6.1.3, 10.1 | Has the organization determined and selected opportunities for improvement on product and service? |
Risks associated with externally provided products and services
PDCA |
ISO 9001 Clause References |
Suggested approach |
| Plan | 6.1.2 | Have risks associated with externally provided product, process (i.e. formerly named outsourced) or service been identified? |
| Do | 8.4.1, 8.4.2 | Are the identified risks utilized as an input into the potential impact of externally provided product, process or service? The type and extent of controls and the selection and evaluation of external providers? |
| Check | 8.4.1, 9.3.2 | Has the organization applied criteria to evaluate, select, monitor the performance of, and re-evaluate its external providers? |
| Act | 9.3.3 | Has the organization modified the controls applied to external providers based upon the results of evaluation? |
Risk management compliance
Most organizations intuitively take a risk-based approach to identifying, analysing and prioritising perceived risks and opportunities as this process forms a key part of the preventive action routine. In ISO 9001:2026, risk and opportunity feature in six clauses:
- Clause 4 - understand the context and interested party requirements that give rise to risks and opportunities, and address them within your processes (4.4.1);
- Clause 5 - top management promote risk-based and opportunity-based thinking (5.1.1) and ensure that risks and opportunities affecting customer satisfaction are addressed (5.1.2);
- Clause 6 - determine risks and opportunities (6.1.1), then plan actions on risks (6.1.2) and, separately, on opportunities (6.1.3);
- Clause 8 - implement processes which identify and address risk in its operations;
- Clause 9 - evaluate how effective your actions on risks and on opportunities have been (9.1.3 e) and f)) and review them at management review (9.3.2 g) and h));
- Clause 10 - update risks and opportunities when taking corrective action (10.2.1) and improve continually (10.1).
Compliance with ISO 9001:2026 will require objective evidence that these clauses have been fulfilled. The adoption of risk-based thinking will, over time, improve customer confidence and satisfaction by assuring the consistency of the quality of goods and services brought on by establishing a proactive culture of prevention and improvement.
Ongoing review is essential to ensure that risk management processes remain relevant and effective. The factors that affect the likelihood and consequences of an event may change, as may the factors that affect the suitability of treatment options. Process monitoring should provide information about the effectiveness of the risk management process.
Our management system templates offer a reliable way of integrating risk-based thinking into your processes and your quality management system!
More on ISO 9001
Free management system interpretation guidance
Planning - Context, leadership and management system planning
This is the 'Plan' part of the PDCA process. Establish the objectives and processes necessary to deliver results in accordance with customer requirements and the organizational policies. This is often implemented using stated objectives, work instructions or procedures as required for consistent process output.
Doing - Support and operations
This is the 'Do' part of the PDCA process. Ensure the availability of resources and information necessary to support the operation and monitoring of your processes. This may be through management review or other methods that define resource requirements.
Checking - monitoring, measuring, analysing and evaluating
This is the 'Check' part of the PDCA process. Monitor, measure and analyse process performance. Monitor and measure processes and products against policies, objectives and requirements, and report the results. The methods employed and the timing of such analysis should be based upon priorities established by the organization.
Acting - implementing improvement actions
This is the 'Act' part of the PDCA process. Implement the actions necessary to achieve the planned results, and for the continual improvement of those processes. Auditors will expect to see evidence that corrective action is taken when measurable objectives and performance indicators fall below target or a pre-defined action level.
How to apply the latest quality management principles
The latest and current quality management principles (QMPs), stated in ISO 9000:2026, are intended to provide the foundation by which any organization can continually improve its performance.
You can learn to apply the latest quality management principles in the context of your business's own particular operations by reviewing and documenting its activities in the context of each quality management principle.
Want to know more?
- Read our customer's feedback
- Client list - who's using our templates?
- How the templates are formatted and download examples
- Why we use turtle diagrams and process maps
- What's the difference between a process and a procedure?
- About documented information
SSL certification
A certificate guarantees the information your internet browser is receiving now originates from the expected domain - https://www.iso9001help.co.uk. It guarantees that when you make a purchase, sensitive data is encrypted and sent to the right place, and not to a malicious third-party.
Free PDCA guidance
ISO Navigator™ is our FREE online training tool that shows you how to apply the principles of PDCA to your operations. We also offer many helpful templates that get you on the road to documenting your management system, please visit the download page.