> ISO 9001:2026 risks and opportunities: what 6.1.1 to 6.1.3 and 9.1.3 newly require, how to evaluate opportunities separately and evidence effectiveness.

Source: [https://docxpert.io/en/guides/iso-9001-2026/risks-and-opportunities](https://docxpert.io/en/guides/iso-9001-2026/risks-and-opportunities)

# ISO 9001:2026 risks and opportunities apart (6.1) | docxpert

## What changes

Our own summary; the licensed text of the standard prevails.
| Clause | Change compared with 2015 | Type |
| --- | --- | --- |
| 6.1.1 Determining risks and opportunities | Its own subclause; content corresponds to 2015. | restructured |
| 6.1.2 Actions to address risks | Determine, analyse and evaluate risks. Plan actions separately, integrate them into processes and evaluate their effectiveness, proportionate to the potential impact. | changed |
| 6.1.3 Actions to address opportunities | Determine, analyse and evaluate opportunities, plan actions and evaluate their effectiveness. Actions suit the context and support desired results. | new |
| 9.1.3 Analysis and evaluation | The effectiveness of actions on risks and on opportunities is evaluated separately. | changed |

In the 2015 edition, risks and opportunities shared one sentence. Many organizations therefore kept a joint register in which opportunities appeared as an afterthought. That is no longer enough under 2026. Opportunities need their own analysis, their own evaluation and their own actions, whose effect you later check separately.

## Why risks and opportunities are evaluated separately

At first glance, risks and opportunities look like two sides of the same coin. Their evaluation differs, though: for risks you ask about possible undesired effects and their extent. For opportunities you ask about the possible benefit, the effort involved and whether the opportunity fits your context and strategy.

| Criterion | Risk | Opportunity |
| --- | --- | --- |
| Key question | What can go wrong and how bad would it be? | What can we gain and is it worth the effort? |
| Evaluation | Impact and likelihood, proportionate to the potential impact on results | Benefit, effort, fit with context and objectives |
| Typical action | Avoid, reduce, monitor, accept consciously | Pursue, expand, pilot, consciously decline |
| Effectiveness | Has the risk become smaller or not materialised? | Has the expected benefit materialised? |

An opportunity is more than the opposite of a risk. New customer groups, a digitised process or collaboration with a supplier can be opportunities without any risk behind them. See [risk-based thinking](https://docxpert.io/en/glossary/risk-based-thinking) in the glossary for the underlying idea.

## Adapt your register in six steps

1.  1
    
    Separate the register
    
    Keep risks and opportunities in separate lists or at least with separate evaluation columns. Assign existing entries to one of the two.
    
2.  2
    
    Define an evaluation scheme for opportunities
    
    Set simple criteria, for example benefit, effort and strategic fit on a scale of one to three.
    
3.  3
    
    Justify proportionality
    
    For risks, 6.1.2 requires actions proportionate to the potential impact. Record why a risk justifies a large action or is consciously accepted.
    
4.  4
    
    Integrate actions into processes
    
    Every action belongs to a process, with an owner and a due date. An action that only exists in the register is not integrated.
    
5.  5
    
    Set effectiveness criteria up front
    
    When planning, decide how you will later tell whether the action worked. For opportunities, this is the expected benefit.
    
6.  6
    
    Evaluate separately
    
    Under 9.1.3, evaluate how effective the actions on risks and those on opportunities were, and bring both results to management review.
    

## Evidence for the audit

-   registers or lists with separate evaluation of risks and opportunities,
-   the evaluation method with criteria, including for opportunities,
-   actions with process reference, owners, due dates and effectiveness criteria,
-   the evaluation of effectiveness, separately for risks and opportunities,
-   management review minutes with both results.

Start small

Three well-evaluated opportunities with clear actions are more convincing than thirty keywords. The standard does not require a particular method, only a traceable one.

## Common mistakes

-   Entering opportunities as reworded risks, such as “opportunity: no supplier failure”.
-   Using the same risk matrix for opportunities although it does not capture benefit.
-   Planning actions without an effectiveness criterion and later only reporting “done”.
-   Summarising the effectiveness of all actions in one sentence instead of looking at risks and opportunities separately.

## Implementation in docxpert

For the 2026 edition, the “Risks and opportunities” template in the [template library](https://docxpert.io/en/features/template-library) has a section on separate treatment, and the “Monitoring, measurement and evaluation” template one on separate effectiveness evaluation. Actions meant to remove a cause are tracked in [CAPA management](https://docxpert.io/en/features/capa-management) through to the effectiveness check.

In the transition area, the clauses belong to the “risks” step and 9.1.3 to the “review” step. There you link the revised documents and CAPAs to the step. The [transition check](https://docxpert.io/en/tools/iso-9001-2026-transition-check) shows how far you are overall.

## Frequently asked questions

Do I need a new risk register for ISO 9001:2026?

Not necessarily a new one, but opportunities must be determined, analysed and evaluated separately. Separate lists or separate evaluation columns in the existing register are sufficient.

Do I need an FMEA for risks and opportunities?

No. ISO 9001 does not prescribe a method. An \[FMEA\](content:term-fmea) suits product and process risks; it is not designed for opportunities.

What does “proportionate to the potential impact” mean?

The effort of an action should match the possible damage. Small risks may be handled with small actions or consciously without action, provided this is justified.

How do I evaluate the effectiveness of an opportunity?

When planning, define the benefit you expect and later check whether it materialised. If it did not, the insight belongs in management review.

## Read next

[ISO 9001:2026 transition checkRate the 17 changes, see your priorities and get the result as PDF – no sign-up.Learn more](https://docxpert.io/en/tools/iso-9001-2026-transition-check) [ISO 9001:2026 transitionClause-by-clause changes, transition dates to 2029 and a transition plan.Learn more](https://docxpert.io/en/guides/iso-9001-2026-transition) [Risk-based thinkingWhat the standard means by it – and what it does not.Learn more](https://docxpert.io/en/glossary/risk-based-thinking) [CAPA managementCorrective and preventive actions in nine phases – with 5 Whys, Ishikawa, deadlines and effectiveness checks.Learn more](https://docxpert.io/en/features/capa-management) [Management review and improvementNew inputs in 9.3.2, customer satisfaction 9.1.2 and the merged clause 10.1.Learn more](https://docxpert.io/en/guides/iso-9001-2026/evaluation-and-improvement)

Free tool

## ISO 9001:2026 transition check

Rate the 17 changes, see your priorities and get the result as PDF – no sign-up.

[ISO 9001:2026 transition check](https://docxpert.io/en/tools/iso-9001-2026-transition-check)[Or try docxpert for 14 days](https://docxpert.io/en/trial)