Risk Management in ISO 9001 Clause 6: More Practical Than You Think

2026-10-04

Executive Summary

• ISO 9001:2015 asks for risk-based thinking, not a formal risk management system or a documented risk management process. The organization decides how detailed to be.
• Clause 6.1 requires determining the risks and opportunities that need addressing, planning actions proportionate to potential impact, integrating them into processes, and evaluating effectiveness.
• Two common extremes both work poorly: building a huge risk matrix nobody uses, or ignoring the subject until an auditor asks.
• A practical approach for an SME: attach a few important risks to each process, revisit them after incidents or changes, and link them to actions.
• An eQMS can connect risks to processes, nonconformities and audits, but it won’t find risks for people.

The two-hundred-line matrix

An auditor asks: “How are risks to the quality system managed?”

The quality team opens a spreadsheet. In it, a matrix of over a hundred and twenty rows, one risk per row, with likelihood scores, impact scores, a product score, colored green, amber and red. The file was built two years ago, ahead of the certification audit. Nobody has opened it since.

The auditor asks: “Which risk in here relates to last month’s incident?”

None match. Nobody remembers what the matrix says.

That’s one kind of failure. The opposite is just as common: the company has nothing, and when asked, puts a table together in an afternoon. Both show risk treated as a record you must have, not as a way of thinking while operating.

This article explains what the standard actually asks for and an approach that fits small and mid-sized manufacturers.

What ISO 9001 actually requires on risk

The statements below are based on ISO 9001:2015, clause 6.1 (Actions to address risks and opportunities), summarized in practical terms.

Determining (6.1.1). When planning the quality management system, the organization considers its context (clause 4.1) and the requirements of interested parties (clause 4.2), then determines the risks and opportunities that need addressing in order to:

• give assurance the system can achieve its intended results;
• enhance desirable effects;
• prevent or reduce undesired effects;
• achieve improvement.

Planning actions (6.1.2). The organization plans actions to address those risks and opportunities, how to integrate and implement them into the system’s processes, and how to evaluate their effectiveness. Actions must be proportionate to the potential impact on the conformity of products and services.

The standard also suggests options for addressing risk: avoiding it, taking it in order to pursue an opportunity, eliminating the source, changing likelihood or consequences, sharing the risk, or retaining it by informed decision.

Three points stand out.

First, risk comes with opportunity. The standard isn’t only about bad things that might happen but also about good possibilities that can be seized: new practices, new products, new markets, partnerships, technology.

Second, risk doesn’t stand alone. Clause 4.4 asks that processes address risks and opportunities per 6.1. Clause 9.1.3 asks for evaluating the effectiveness of actions on risk, 9.3 makes that an input to management review, and 10.2 asks for risks to be updated when a nonconformity occurs.

Third, action must be proportionate. A small risk doesn’t need a big response.

Risk-based thinking versus formal risk management

This is the point most often misunderstood, so it’s worth pausing on.

Annex A of ISO 9001:2015 (section A.4, on risk-based thinking) states clearly that the standard has no requirement for formal risk management methods or a documented risk management process. Organizations decide whether to develop a more extensive methodology than the standard requires, for example by applying other guidance or standards.

That means:

• You are not required to have a likelihood-impact matrix.
• You are not required to have a document called “Risk Management Procedure.”
• You do need to show that risks and opportunities have been considered thoughtfully, that proportionate actions have been planned, and that effectiveness is evaluated.

Two other things are often confused with 6.1:

Food safety hazard analysis (HACCP) and sector-specific risk requirements are separate, sit outside ISO 9001 and are usually far more detailed. If your company is subject to them, they must be met independently.

Enterprise risk management under frameworks such as ISO 31000 is an optional reference, not a requirement of ISO 9001. A company can use it if it finds it helpful, but it isn’t a condition of certification.

How to identify risks and opportunities

Rather than starting from a blank table, start from what the company already knows.

Start from the process. For each important process, ask one simple question: what could stop this process achieving its intended result? That tends to produce more real risks than an abstract listing.

Use the data you already have. Nonconformities, complaints, audit findings, equipment failures and supplier results are real sources of risk, because they’ve already happened. This is also where risk connects to nonconformance and suppliers.

Look at change. New equipment, a key person moving on, new materials or suppliers, changes in regulation or customer requirements are where new risks tend to appear.

Look at context and interested parties. Clause 6.1 asks you to start from 4.1 and 4.2. What customers want, what regulations may change, how competitors or markets are shifting.

Don’t forget opportunities. A parallel question: what could make this process better? Opportunities are often missed because people are used to thinking of risk as bad news.

On rating. If you want to rank, something as simple as high/medium/low on impact and likelihood is often enough. Detailed scores to two decimal places give a feeling of precision without matching data. What matters is which risks deserve action first.

On quantity. A few important risks per process, genuinely revisited, are worth more than a hundred and twenty rows nobody opens.

Integrating risk into your processes

What the standard stresses in 6.1.2 is integrating actions into processes, not keeping risks in a separate record. This is where many companies break: risks sit in one file, processes live elsewhere, and the two never meet.

A few practical ways to integrate:

Attach risks to the process description. Each important process carries a few key risks and corresponding controls right in the process document, where operators and managers actually see them.

Review by event. Risks are revisited after a serious nonconformity, a change of equipment or procedure, a complaint, or an audit finding, not only on an annual schedule.

Feed management review. The effectiveness of actions on risks and opportunities is an input to management review (clause 9.3). See Management Review in ISO 9001.

Update as you learn. Clause 10.2 asks for risks and opportunities to be updated where necessary after a nonconformity. If an event happens and the corresponding risk wasn’t recorded, that’s a cue to add it.

Worth noting that the 2015 edition no longer has a separate clause on preventive action as the 2008 edition did; the preventive role sits within this risk-based thinking itself.

Illustrative example (a composite scenario, not a real customer case): a food plant has a matrix of over a hundred rows, unrevised for two years. When its only packaging supplier hits a delivery problem, the plant stops a line for two days, and the matrix has no row about dependence on a single packaging source. The team then rethinks its approach: each main process keeps only three to five important risks, in the process document, reviewed after every incident. The risk of “single-source dependence” appears in the purchasing process and triggers a concrete action: qualifying a backup supplier.

Common mistakes

Across many manufacturing operations, these problems show up often. (A general observation, not measured figures.)

• A matrix too large for anyone to use.
• Risks too generic (“human error,” “lack of resources”) to lead to any specific action.
• Risks without opportunities.
• Built once for the audit and left alone.
• Detached from processes: risk in one place, procedure in another, unconnected.
• Scoring that gives a feeling of precision: likelihood times impact to two decimal places, when the input is only estimates.
• No effectiveness evaluation of the actions planned.

Risk in eQMS

To be clear first: an eQMS won’t discover risks for you. A system can keep a hundred-row matrix tidier, but tidier isn’t the same as more useful.

What an eQMS changes is how much risk sits apart from the rest of the system:

Risk linked to process. Risks and their controls sit with the related document and process, so users see them while working.

Connected to real events. Nonconformities, complaints, audit findings and supplier results can link to the corresponding risk, and prompt an update when something new occurs.

Review reminders. Risks have a review schedule and are flagged, rather than relying on memory.

Roll-up for leadership. Risk status and action effectiveness are on hand for management review without being rebuilt.

Action tracking. Actions on risk have owners, deadlines and effectiveness checks.

A caution: if the system allows numeric scoring, beware false precision. Scores only mean something when the input data is good enough.

A practical checklist

Use these questions to review how you currently handle risks and opportunities.

1. Do your risks and opportunities come from context and interested parties, not only from a template list?
2. Does each important process have a few specific key risks identified?
3. Are risks recorded specifically enough to lead to action, not stopping at “human error” or “lack of resources”?
4. Do you consider opportunities alongside risks?
5. Do risks sit in or link to the process document, or in a separate file?
6. Are actions proportionate to potential impact, avoiding a big response to a small risk?
7. Are risks revisited on events (serious nonconformity, change, complaint, audit finding), not only on a schedule?
8. When an incident occurs, do you check whether the corresponding risk was recorded and update it if not?
9. Is the effectiveness of actions on risk evaluated and fed into management review?
10. Is the level of detail in your method proportionate to your size, or more complicated than you actually use?

If three or more answers are “no” or “not sure,” the issue likely lies in risk being treated as a record rather than a way of thinking while operating.

A note on ISO 9001 editions

This article refers to ISO 9001:2015. According to certification bodies, a revised ISO 9001:2026 was scheduled for publication in September 2026, with a transition period expected to run about three years and 2015 certificates remaining valid during it. Clause structure and wording may change; check against the edition your organization is certified to.

Is your approach to risk a record for the audit, or a way of thinking while operating?

→ Take the Knowledge Management Maturity Assessment to identify your maturity level and the first improvement to make.

Further reading:

• Supplier Qualification in ISO 9001: Beyond the Approved Supplier List (previous)
• Management Review in ISO 9001: Why the Meeting Rarely Works — and How to Change That (next)
• eQMS for Manufacturing SMEs: A Practical Guide (pillar)

Sources:

• ISO 9001:2015, clauses 6.1 (actions to address risks and opportunities), 4.1, 4.2, 4.4, 9.1.3, 9.3, 10.2 and Annex A (section A.4, risk-based thinking): iso.org/standard/62085.html
• LRQA, ISO 9001 revision update: Publication date confirmed (certification body source; verify with ISO): lrqa.com

ISO 9001:2015 clauses are summarized in practical language and do not replace the text of the standard; compliance decisions should be checked against the official edition. The example is a composite illustrative scenario based on common patterns in manufacturing SMEs, not a specific customer case. The problems described are general observations, not measured figures. The ways of identifying and integrating risk described are common approaches, not mandatory requirements of the standard.