_1762866128417-DS2_OO1j.png)
What it means
Instead of only correcting errors once they occur, an organization should recognise uncertainty early. That affects decisions at every level: which processes are tightly controlled, which loosely? Where is a peer review needed, where is self-checking enough? Which suppliers are monitored closely?
“Risk” is meant neutrally: the effect of uncertainty. It can be negative (risk in the narrow sense) or positive (opportunity). ISO 9001:2026 makes this even clearer: top management promotes opportunity-based as well as risk-based thinking, and opportunities get their own subclause 6.1.3.
Where it appears in the standard
- 4.1 and 4.2: context and interested parties are the source of many risks and opportunities.
- 4.4: processes are determined taking risks and opportunities into account.
- 6.1: determine risks and opportunities, plan actions, evaluate effectiveness. From the 2026 edition separately for risks and opportunities; see ISO 9001:2026 risks and opportunities.
- 9.1.3 and 9.3: evaluate the effectiveness of actions and cover it in management review.
Proportionate, not elaborate
Risk-based thinking does not mean filling in a risk matrix for every activity. Small companies often manage with a clear list of their ten to twenty main risks and opportunities, each with an evaluation, an action and an owner. Methods such as FMEA make sense where products or processes are complex, but are not required.
An example
A manufacturer buys a key component from a single supplier. Risk-based thinking raises the question of what happens if that supplier fails. Possible actions: qualify a second supplier, build up safety stock or negotiate contractual delivery commitments. The organization chooses the action that fits impact and cost and later checks whether it worked.
Implementing it in docxpert
The “Risks and opportunities” template in the template library provides a structure for evaluation, actions and effectiveness, with separate treatment for the 2026 edition. Actions meant to remove a cause are tracked in CAPA management through to the effectiveness check.
Frequently asked questions
Do I need ISO 31000 risk management for ISO 9001?
No. ISO 9001 requires risk-based thinking and planned actions, but no formal risk management system. ISO 31000 can serve as guidance.
Do I have to document risks?
The standard does not prescribe specific documentation. To show in an audit that risks were determined and actions planned, a short list is practically indispensable though.
What happened to preventive actions?
The separate clause on preventive action from the 2008 edition was removed. Its idea lives on in risk-based thinking, which runs through the whole standard.
How often should risks be evaluated?
At least for management review and whenever context, processes or requirements change significantly.