Clause 6.1 of ISO 9001 asks the organization to determine the risks and opportunities that arise from its context (4.1) and its interested parties (4.2), and to plan actions that are proportionate to the potential impact on the conformity of products and services. The standard does not require a specific method or "formal risk management" — but in practice the register with likelihood x impact has become the format auditors expect to find, because it is objective and traceable. In ISO 9001:2026, risks and opportunities are handled in separate subclauses: check the numbering when you migrate your system (see what changes in the revision).
The most used scale is 5x5: likelihood from 1 (rare) to 5 (almost certain) and impact from 1 (insignificant) to 5 (critical). The product of the two gives the level: up to 4 low, 5 to 9 moderate, 10 to 16 high, above 16 critical. For opportunities, the same logic is inverted: a high level means it is a priority to pursue. The secret to consistency is to define concrete anchors for the scores — for example, impact 5 = "stops production or loses a strategic customer" — so that different assessors arrive at similar numbers.
The mistakes that hollow out the analysis: generic risks ("problems with a supplier") instead of specific ones with a cause and a consequence; everything scored as moderate to avoid an argument; and high risks with no planned action — which is exactly what clause 6.1.2 requires. Every high or critical risk needs an action with an owner and a deadline, built into the 5W2H plan of the company.
The template below brings real risks and opportunities from a small manufacturing company. Use the free risk matrix tool on this page to build your own with automatic rating and download it as a PDF.