New to the series? Read Part 01: What Changed, Part 02: Context and Part 03: Leadership and Quality Culture.
What Has Changed in ISO 9001:2026?
Risk-based thinking is not new. ISO 9001:2015 already required organisations to determine relevant risks and opportunities and plan appropriate actions.
The 2026 edition distinguishes managing risks from pursuing opportunities more clearly. The practical question is how both inform decisions and improvement.
ISO 9001:2015 vs ISO 9001:2026
| Area | ISO 9001:2015 | ISO 9001:2026 |
|---|---|---|
| Planning | Risks and opportunities addressed together under Clause 6.1. | Clearer distinction between managing risks and pursuing opportunities. |
| Actions | Plan actions and integrate them into QMS processes. | Give deliberate attention to responses to risks and worthwhile opportunities. |
| Effectiveness | Evaluate the effectiveness of planned actions. | Examine what the decisions and actions achieved for each. |
Risk Protects the Result. Opportunity Improves It.
Risks and opportunities are related, but they are not simply opposites.
Managing a Risk
- Situation
- Critical spare parts repeatedly arrive late.
- Potential consequence
- Delayed maintenance, missed commitments and interrupted operations.
- Possible response
- Review supplier reliability, establish contingency arrangements and strengthen procurement controls.
- Evidence of effectiveness
- Improved delivery reliability and fewer operational delays.
- Objective
- Reduce the likelihood or consequences of an undesirable outcome.
Pursuing an Opportunity
- Situation
- Condition-based monitoring could improve maintenance planning.
- Potential benefit
- Better equipment availability and more predictable service delivery.
- Possible response
- Trial monitoring on selected equipment, evaluate results and consider wider implementation.
- Evidence of effectiveness
- Reduced unplanned downtime and improved equipment availability.
- Objective
- Achieve a worthwhile beneficial outcome.
Managing risks helps protect what an organisation needs to deliver. Pursuing opportunities helps improve what it is capable of delivering.
Where Risk Registers Fall Short
A register provides visibility and responsibilities. Three weaknesses can prevent that information from becoming useful.
Identified, but not addressed
A supplier risk stays high while purchasing controls remain unchanged. Recording it has not influenced a decision.
Recognised, but not evaluated
An improvement is logged, but no one assesses its value, feasibility or alignment with business objectives.
Action closed, effectiveness unknown
A procedure is revised or training delivered. The action closes, but did the outcome improve?
From the Field: One Issue, Two Decisions
| Consideration | Risk | Opportunity |
|---|---|---|
| What is identified? | Incomplete records could delay customer acceptance and affect confidence. | Digital handover could improve accuracy and speed. |
| What action follows? | Strengthen release checks and clarify approval responsibilities. | Trial a digital handover workflow on one project. |
| Who owns it? | Quality and Operations | Operations and Process Improvement |
| How is success evaluated? | Fewer incomplete handovers and customer rejections | Less preparation time, fewer corrections and better traceability |
The company needs to distinguish the decisions, assign responsibilities and evaluate results. It does not necessarily need separate systems or registers.
Not every opportunity justifies investment. Pursue, defer or reject it according to potential value, associated risks, resources and priorities.
Connecting Clause 4 to Clause 6
In Part 02, we examined context and interested-party requirements. That understanding should influence planning.
A new traceability requirement may reveal a risk in existing records and an opportunity to improve document handling across several contracts.
- 01UNDERSTAND
What changed in our business, processes, customer requirements or operating environment?
- 02EVALUATE
Which risks affect intended quality results? Which opportunities offer worthwhile improvements?
- 03ACT
What decisions, controls, resources or trials are appropriate?
- 04VERIFY
What evidence shows whether our actions achieved their intended results?
Crosby’s practical planning approach. Not a prescribed ISO workflow.
Three Questions for Your Management Team
Does Your Risk and Opportunity Process Influence Decisions?
For reflection only. No responses are stored or submitted.
Try This Next Week
A mature QMS does more than recognise what could go wrong. It creates a disciplined way to pursue what could go better.
A Clearer Starting Point
Use the transition to examine whether risk-based thinking supports business decisions. Compare existing arrangements with the revised requirements before deciding what to change.
Crosby Quality Associates can help review risk and opportunity processes, identify relevant conformity gaps and establish practical transition priorities.
Discuss an ISO 9001:2026 Transition Gap AssessmentSources
- ISO 9001:2026 — Official overview
- ISO — What businesses need to know
- ISO 9001:2026 — Quality management systems: Requirements
- Global ACI — Transition requirements
This article distinguishes published ISO requirements from Crosby’s practical interpretation. It does not reproduce the standard or replace a review of the complete requirements.
