> Risk-based thinking in ISO 9001: what the standard means by it, why no formal risk management system is needed and how to apply it proportionately – with examples.

Source: [https://docxpert.io/en/glossary/risk-based-thinking](https://docxpert.io/en/glossary/risk-based-thinking)

# Risk-based thinking in ISO 9001 explained | docxpert

## What it means

Instead of only correcting errors once they occur, an organization should recognise uncertainty early. That affects decisions at every level: which processes are tightly controlled, which loosely? Where is a peer review needed, where is self-checking enough? Which suppliers are monitored closely?

“Risk” is meant neutrally: the effect of uncertainty. It can be negative (risk in the narrow sense) or positive (opportunity). ISO 9001:2026 makes this even clearer: top management promotes opportunity-based as well as risk-based thinking, and opportunities get their own subclause 6.1.3.

## Where it appears in the standard

-   **4.1 and 4.2:** context and interested parties are the source of many risks and opportunities.
-   **4.4:** processes are determined taking risks and opportunities into account.
-   **6.1:** determine risks and opportunities, plan actions, evaluate effectiveness. From the 2026 edition separately for risks and opportunities; see [ISO 9001:2026 risks and opportunities](https://docxpert.io/en/guides/iso-9001-2026/risks-and-opportunities).
-   **9.1.3 and 9.3:** evaluate the effectiveness of actions and cover it in management review.

## Proportionate, not elaborate

Risk-based thinking does not mean filling in a risk matrix for every activity. Small companies often manage with a clear list of their ten to twenty main risks and opportunities, each with an evaluation, an action and an owner. Methods such as [FMEA](https://docxpert.io/en/glossary/fmea) make sense where products or processes are complex, but are not required.

Rule of thumb

The effort for a risk should match its potential impact. A risk that at worst means a one-day delay does not need its own work instruction.

## An example

A manufacturer buys a key component from a single supplier. Risk-based thinking raises the question of what happens if that supplier fails. Possible actions: qualify a second supplier, build up safety stock or negotiate contractual delivery commitments. The organization chooses the action that fits impact and cost and later checks whether it worked.

## Implementing it in docxpert

The “Risks and opportunities” template in the [template library](https://docxpert.io/en/features/template-library) provides a structure for evaluation, actions and effectiveness, with separate treatment for the 2026 edition. Actions meant to remove a cause are tracked in CAPA management through to the effectiveness check.

## Frequently asked questions

Do I need ISO 31000 risk management for ISO 9001?

No. ISO 9001 requires risk-based thinking and planned actions, but no formal risk management system. ISO 31000 can serve as guidance.

Do I have to document risks?

The standard does not prescribe specific documentation. To show in an audit that risks were determined and actions planned, a short list is practically indispensable though.

What happened to preventive actions?

The separate clause on preventive action from the 2008 edition was removed. Its idea lives on in risk-based thinking, which runs through the whole standard.

How often should risks be evaluated?

At least for management review and whenever context, processes or requirements change significantly.

## Read next

[GlossaryKey quality and compliance terms, explained briefly and clearly.Learn more](https://docxpert.io/en/glossary) [Risks and opportunities apart6.1.1 to 6.1.3 and 9.1.3: evaluate opportunities on their own and evidence effectiveness.Learn more](https://docxpert.io/en/guides/iso-9001-2026/risks-and-opportunities) [FMEAFailure mode and effects analysis: steps, rating and limits.Learn more](https://docxpert.io/en/glossary/fmea) [Context of the organizationDetermine, assess and keep internal and external issues up to date.Learn more](https://docxpert.io/en/glossary/context-of-the-organization) [ISO 9001:2026 transition checkRate the 17 changes, see your priorities and get the result as PDF – no sign-up.Learn more](https://docxpert.io/en/tools/iso-9001-2026-transition-check)

Free tool

## ISO 9001:2026 transition check

Rate the 17 changes, see your priorities and get the result as PDF – no sign-up.

[ISO 9001:2026 transition check](https://docxpert.io/en/tools/iso-9001-2026-transition-check)[Or try docxpert for 14 days](https://docxpert.io/en/trial)