ISO 9001:2026 risks and opportunities: evaluate them separately

What changes

In the 2015 edition, risks and opportunities shared one sentence. Many organizations therefore kept a joint register in which opportunities appeared as an afterthought. That is no longer enough under 2026. Opportunities need their own analysis, their own evaluation and their own actions, whose effect you later check separately.

Why risks and opportunities are evaluated separately

At first glance, risks and opportunities look like two sides of the same coin. Their evaluation differs, though: for risks you ask about possible undesired effects and their extent. For opportunities you ask about the possible benefit, the effort involved and whether the opportunity fits your context and strategy.

An opportunity is more than the opposite of a risk. New customer groups, a digitised process or collaboration with a supplier can be opportunities without any risk behind them. See risk-based thinking in the glossary for the underlying idea.

Adapt your register in six steps

1. 1

   Separate the register

   Keep risks and opportunities in separate lists or at least with separate evaluation columns. Assign existing entries to one of the two.

2. 2

   Define an evaluation scheme for opportunities

   Set simple criteria, for example benefit, effort and strategic fit on a scale of one to three.

3. 3

   Justify proportionality

   For risks, 6.1.2 requires actions proportionate to the potential impact. Record why a risk justifies a large action or is consciously accepted.

4. 4

   Integrate actions into processes

   Every action belongs to a process, with an owner and a due date. An action that only exists in the register is not integrated.

5. 5

   Set effectiveness criteria up front

   When planning, decide how you will later tell whether the action worked. For opportunities, this is the expected benefit.

6. 6

   Evaluate separately

   Under 9.1.3, evaluate how effective the actions on risks and those on opportunities were, and bring both results to management review.

Evidence for the audit

• registers or lists with separate evaluation of risks and opportunities,
• the evaluation method with criteria, including for opportunities,
• actions with process reference, owners, due dates and effectiveness criteria,
• the evaluation of effectiveness, separately for risks and opportunities,
• management review minutes with both results.

Common mistakes

• Entering opportunities as reworded risks, such as “opportunity: no supplier failure”.
• Using the same risk matrix for opportunities although it does not capture benefit.
• Planning actions without an effectiveness criterion and later only reporting “done”.
• Summarising the effectiveness of all actions in one sentence instead of looking at risks and opportunities separately.

Implementation in docxpert

For the 2026 edition, the “Risks and opportunities” template in the template library has a section on separate treatment, and the “Monitoring, measurement and evaluation” template one on separate effectiveness evaluation. Actions meant to remove a cause are tracked in CAPA management through to the effectiveness check.

In the transition area, the clauses belong to the “risks” step and 9.1.3 to the “review” step. There you link the revised documents and CAPAs to the step. The transition check shows how far you are overall.