Risks and opportunities in ISO 9001:2026: why 6.1 was split in three, and why "we already do that" is the dangerous answer

The new shape of 6.1

In 2015, 6.1 had two parts: determine the risks and opportunities, then plan actions for both together. In 2026 it has three.

Why "we already do that" is the dangerous answer

Every quality manager reading 6.1 in the 2026 edition recognizes it, because the words are mostly the same. That recognition is the trap. Here is what a typical 2015 register looks like when a 2026 auditor opens it.

• Forty rows. Thirty-eight are risks. Two are opportunities, added in 2016 because the auditor asked, with no analysis, no action and no owner.
• Every risk has a likelihood and a severity. No opportunity has anything equivalent, because nobody decided what analyzing an opportunity means.
• Management review has one agenda line: "risks and opportunities." The minutes say "reviewed, no change."
• The actions live in the register and nowhere else. Ask which process changed because of row 14 and the answer is a pause.

Under 2015 that register passed. Under 2026, three separate requirements now catch it: 6.1.3 asks for opportunities to be analyzed and evaluated, 9.1.3 asks for the effectiveness of opportunity actions to be evaluated as its own item, and 9.3.2 asks for that effectiveness to be a management review input on its own. An auditor can raise the finding against any of the three, and the strongest write-up is the 9.3.2 one, because the minutes are already in the evidence pack.

The reason the change was made is in Annex A: risks and opportunities are different things, and the standard now says they can be run through separate processes. The 2015 wording let organizations treat an opportunity as a risk with the sign flipped. The 2026 wording does not.

Three words that changed the requirement

1. "Analyze and evaluate"

The 2015 text said determine. The 2026 text says determine, analyze and evaluate, for risks and for opportunities alike. A list is a determination. A list with a rating against a criterion you set is an analysis and an evaluation. Registers that hold risks with no rating, or ratings with no threshold that decides what gets an action, now fall short of the words. So do opportunity lists with nothing beside them.

This is not a demand for formal risk management. Annex A says so in plain terms, and offers ISO 31000 only to organizations that want to go further. A three-level scale and a rule for which level gets an action is analysis and evaluation. What no longer passes is the absence of any.

2. "Intended results," not "conformity"

In 2015, actions were sized by the possible effect on whether products and services conformed. In 2026 they are proportionate to the possible effect on the results the quality management system is meant to achieve. That is wider: customer satisfaction, the objectives, continuity of supply, and whatever else your 4.1 says the system is for. A risk to on-time delivery that never touches conformity is now squarely inside the proportionality test.

3. "During and after a disruption"

The new note under 6.1.2 says the risks you determine can include the risk to your ability to keep providing conforming products and services through a disruption and after it. Continuity has been an implicit expectation since the pandemic. Now it is written down as an example, and an auditor who reads the note will ask where your single-source suppliers, your key people and your one critical machine appear in the register. Annex A reinforces it: risk-based thinking is what keeps the system delivering when a disruptive event hits.

The options note for risk actions is unchanged in substance: avoid, take a risk to pursue an opportunity, remove the source, change the likelihood or the consequences, share it, or keep it by an informed decision. The opportunities note is new and practical: adopt a practice, launch a product or service, form a partnership, use an emerging technology, run an initiative.

Where the split reaches

Six other clauses changed to match. Any one of them can carry the finding.

• 5.1.1 k). Top management promotes both risk-based thinking and its new counterpart, opportunity-based thinking. The leadership evidence for this is the same kind as for culture: what leaders did with an opportunity someone raised.
• 5.3 e). Reporting improvement opportunities upward to top management is now its own assigned responsibility, split out of performance reporting. Someone has to own the upward path.
• 9.1.3 e) and f). The effectiveness of actions on risks and the effectiveness of actions on opportunities are two separate things your analysis has to evaluate. One line in the data review that says "risk actions effective" covers half of it.
• 9.3.2 g) and h). The same two, separately, as management review inputs. Opportunities for improvement also moved up the input list. The Management Review Pack on this site already carries them as two agenda inputs.
• 10.2 e). A corrective action still has to revisit the risks and opportunities you determined at planning. With 6.1 split, that update has two places to land.
• 10.1. Continual improvement is now fed by monitoring results and management review. Opportunities that were evaluated and acted on under 6.1.3 are the natural evidence. The clause 10 page covers the loop.

What an auditor looks for under 6.1 in 2026

1. Two populations, each with analysis. Risks with a rating against a threshold. Opportunities with an assessment of benefit and feasibility against a threshold. Not the same scale reused with the sign flipped; a rule you can explain for each.
2. Sources you can name. Annex A lists where opportunities come from: context, interested parties' needs, your capability, capacity and competence, and your monitoring data. An auditor will pick one and ask which opportunities it produced.
3. Actions that live in a process. Both sub-clauses require the actions to be built into your processes. Show the work instruction, the inspection step, the supplier approval rule or the training plan that changed because of the register row. An action that exists only in the register has not been integrated.
4. Effectiveness, in two lines. 9.1.3 e) and f) evaluated separately, with data. Then 9.3.2 g) and h) in the minutes, separately.
5. Proportion. A register where every row is medium and every action is "monitor" fails the proportionality test in one direction; a register with two hundred rows and a hundred open actions fails it in the other.
6. Disruption. Whether continuity of supply appears anywhere in the risk population. Single-source suppliers, one-of-a-kind equipment, one person who knows the setup.
7. The corrective action link. A sample of closed corrective actions and whether any of them changed a register row, as 10.2 e) expects.

Rebuilding the register in an afternoon

Do not start over. Split what you have and add the columns the words require.

1. Two tabs, or two sections. Move every opportunity out of the risk list. If there are fewer than five, that is your first finding and your first afternoon's work: hold a thirty-minute session with the sources Annex A lists and you will have fifteen.
2. Risk columns: source (which 4.1 issue or 4.2 party), description, likelihood, consequence, rating, threshold decision, action, the process it lives in, effectiveness measure, last evaluation, result. The FMEA Risk Scorer ($5+) does the rating and priority bands for process risks if you want the arithmetic done for you.
3. Opportunity columns: source, description, benefit, feasibility, rating, threshold decision, action, the process it lives in, effectiveness measure, last evaluation, result. Benefit and feasibility are the opportunity analogue of likelihood and consequence; they are what makes the row an analysis rather than a wish.
4. Write down the threshold. One sentence per tab: which ratings get an action, which get watched, which get accepted by informed decision. That sentence is your proportionality evidence.
5. Wire the outputs. The two effectiveness columns feed 9.1.3 e) and f) and become 9.3.2 g) and h) in the management review data pack. The Management Review Pack agenda already has them as two separate inputs.
6. Add a disruption sweep. One pass through the risk tab asking, for each critical supplier, machine and person: what happens to supply if this stops for a month?

The document sweep for 6.1

The full eleven-string list for the whole standard is on the document control checklist. These are the ones 6.1 produces.

Questions