Risks and Opportunities in ISO 9001:2026: Two Registers, Not One

InsightsRisks & Opportunities2026

Why the 2026 edition separates actions on risks from actions on opportunities, and how to redesign your register

Key takeaways

• ISO 9001:2026 splits risk-based thinking into three sub-clauses: determining risks and opportunities (6.1.1), actions on risks (6.1.2) and actions on opportunities (6.1.3).
• Actions on risks must be proportionate to the potential effect, and may cover risks to delivery during and after a disruption.
• Treatment options are now spelled out more clearly: avoid, take, remove the source, change likelihood or consequence, share, or retain by informed decision.
• Opportunities deserve their own register: new practices, products, partnerships and emerging technology are not just “positive risks”.
• Management review must look separately at the effectiveness of actions on risks and on opportunities.

---

1. The problem with combined registers

Since 2015 many organisations have kept one “risks and opportunities” register in which opportunities appear as an afterthought: one line saying “opportunity: improve customer satisfaction” next to twenty well-analysed risks. Auditors rarely found evidence that opportunities were evaluated, resourced or followed up.

The 2026 edition makes the distinction explicit. Risks and opportunities are still determined together from the context, interested parties and the scope, but actions on each are planned, integrated into processes and evaluated separately.

---

2. The new structure

Sub-clause	Focus	Typical evidence
6.1.1 Determining risks and opportunities	Using context (4.1), interested parties (4.2) and scope (4.3) to identify what could affect conformity and customer satisfaction	Workshop records, process-level risk identification, link to context review
6.1.2 Actions to address risks	Proportionate actions, integrated into processes, with effectiveness evaluated	Risk register with treatment option, owner, process link, due date and effectiveness check
6.1.3 Actions to address opportunities	Deciding which opportunities to pursue and how	Opportunity register with expected benefit, resources, decision and follow-up
9.3.2 Management review inputs	Effectiveness of each type of action reviewed separately	Management review minutes with two distinct agenda items

---

3. Treatment options for risks

The edition lists the familiar options from risk management practice. Using them explicitly in your register makes decisions transparent:

Option	Example in a manufacturing company
Avoid the risk	Stop accepting orders for a product the line cannot produce reliably
Take the risk to pursue an opportunity	Accept a new demanding customer with a validation plan
Remove the source	Replace a single-source critical component
Change the likelihood	Add preventive maintenance to a bottleneck machine
Change the consequence	Hold safety stock for key customers
Share the risk	Contractual terms or insurance for transport damage
Retain by informed decision	Accept a minor risk with documented justification

The key word is proportionate: a risk with minor impact does not need a project, while a risk that could stop deliveries to the main customer does.

---

4. Risks during and after disruption

The 2026 edition notes that risks to the delivery of products and services during and after a disruption may be included. This links ISO 9001 with business continuity thinking without requiring a full ISO 22301 system. Practical examples:

• Loss of a key supplier, utility or IT system.
• Extreme weather affecting logistics, linked to the climate change consideration in clause 4.1.
• Absence of key personnel with critical knowledge (7.1.6 organisational knowledge).

For each, the register should show the planned response and how quickly deliveries can resume.

---

5. Building a useful opportunity register

Column	Purpose
Opportunity	Clear description: new market, technology, partnership, process change
Source	Context issue, customer feedback, audit, staff suggestion
Expected benefit	Quality, customer, cost or capacity benefit, quantified if possible
Resources needed	People, budget, time
Decision	Pursue / defer / reject, with date and decision maker
Integration	Which process or project carries it
Effectiveness	How and when the benefit will be measured

A rejected opportunity with a documented reason is valid evidence; an opportunity listed for three years without a decision is not.

---

6. Integrating actions into processes

The standard asks that actions are integrated into the QMS processes. In practice:

• Each risk or opportunity is linked to a process owner and a process (e.g. purchasing, production planning).
• Controls appear in that process’s procedures, work instructions, KPIs or audit checklists.
• Internal audits test the controls in the process, not only in the register.

---

7. Common mistakes

1. Generic risks copied from templates with no link to the organisation’s context.
2. Scoring without criteria, so scores cannot be compared.
3. No evaluation of effectiveness, only “action completed”.
4. Opportunities written as risks with positive wording.
5. Registers reviewed once a year just before the audit.

---

Conclusion

The separation in ISO 9001:2026 is more than a numbering change. It pushes organisations to manage risks with proportionate, effective controls and to treat opportunities as decisions that deserve resources and follow-up. Two focused registers reviewed at management review are a clear sign of a mature system.

Open your register today and count: how many opportunities have a decision, an owner and a measured result?

← All insights