What the clause requires
Clause 6.1 asks the company to look at its own context, the internal and external issues from clause 4.1 and the interested parties from clause 4.2, and decide what could go wrong and what could go right for the quality management system to deliver the result it is supposed to deliver. From there it plans actions to address those risks and to take up those opportunities, builds those actions into the day-to-day processes instead of leaving them in a spreadsheet, and afterwards evaluates whether they worked.
The point that causes most confusion: the standard does not require a formal risk management method, nor a matrix of probability and impact, nor a specific document called "risk analysis". What it requires is that the actions be proportionate to the potential impact of the risk on the conformity of products and services and on customer satisfaction. A small company can comply with a simple table; a manufacturer with a critical special process will probably need something more structured, such as an FMEA. Proportionality is the word the auditor has in mind.
The treatment options include avoiding the risk, taking the risk in order to pursue an opportunity, removing the source of the risk, changing the likelihood or the consequences, sharing the risk, or simply living with it as a conscious decision. Opportunities can be a new customer, a new technology, a cheaper process or a partnership. What the auditor wants to see is reasoning connected to the real context of this company, with the processes and the products it actually has, rather than a generic list downloaded from the internet and never opened again.
What changes in ISO 9001:2026
In ISO 9001:2026 clause 6.1 has been split: actions to address risks and actions to address opportunities now have separate subclauses, 6.1.2 and 6.1.3. The logic stays the same, but the split makes it clearer that an opportunity is not merely "the other side" of a risk and needs treatment of its own. See everything that changed in the revision.
What the auditor asks to see
- Risks and opportunities linked to the issues in clause 4.1 and the parties in clause 4.2
- A prioritisation criterion showing which risks get action and which are accepted, consistent with the size of the operation
- Planned actions with an owner and a deadline, integrated into the processes rather than filed away
- Evaluation of the effectiveness of the actions, normally taken to the management review (clause 9.3)
- Review of the assessment when the context changes: a new customer, a new process, a change in the law
Where companies most often get it wrong
- A generic list of risks ("losing customers", "economic crisis") with no link to the processes
- An assessment produced once for the certification audit and never reviewed again
- Actions with no owner, no deadline or no verification of effectiveness
- Confusing a risk with a nonconformity that has already happened: a risk is what may still occur
- Ignoring the opportunities and treating clause 6.1 as a list of threats only
Example of a nonconformity
- Requirement
- ISO 9001, 6.1: plan actions to address risks and evaluate the effectiveness of those actions.
- Evidence
- Risk matrix reviewed in 02/2026 rating the risk "delay from the single steel supplier" as high; the planned action (qualify a second supplier by 05/2026) has no progress record, and the management review of 06/2026 does not deal with the subject.
- Finding
- The action planned for a risk rated as high was neither implemented nor evaluated for effectiveness.
How to comply using PrismaBiz
Ready-made templates for this clause
Frequently asked questions
Does ISO 9001 require a probability x impact matrix?
No. The standard does not define a method. The matrix is a practical way to prioritise, but any criterion works, provided it is consistent and lets you decide which risks receive action.
Do I have to document the risk analysis?
Clause 6.1 does not require specific documented information. In practice, without a record it is hard to show the auditor what was determined, decided and verified, so almost every company keeps a table or a matrix.
How often should risks be reviewed?
There is no fixed interval. The reasonable minimum is to review them at the management review and whenever something relevant changes in the context: a new product, a large new customer, a change in legislation or in a critical supplier.