ISO 9001:2026 separates risks from opportunities. Risks are addressed in 6.1.2 and opportunities in 6.1.3, and for each the organisation must now determine, analyse and evaluate them, plan actions, integrate those actions into its processes and evaluate whether they worked. In ISO 9001:2015 both sat in one sub-clause and the requirement was only to determine them. The change is small on the page and large in practice: a single list of “risks and opportunities” with no analysis behind it, which passed in 2015, will not pass in 2026. This page explains what changed, what an auditor will now look for, and how to rebuild a register in a way that satisfies 6.1.2, 6.1.3, 9.1.3 and 9.3.2 together.
Gap assessment, documentation update, training, internal audit and support through your transition audit, delivered end to end by our expert, experienced, professional and friendly local Filipino lead auditors.
What changed between ISO 9001:2015 and ISO 9001:2026
| Element | ISO 9001:2015 | ISO 9001:2026 |
|---|---|---|
| Structure | 6.1.1 (determine risks and opportunities) and 6.1.2 (plan actions for both) | 6.1.1 (determine both), 6.1.2 (actions to address risks), 6.1.3 (actions to address opportunities) |
| Verb applied to risks | Determine | Determine, analyse and evaluate |
| Verb applied to opportunities | Determine | Determine, analyse and evaluate |
| Proportionality test | Actions proportionate to the potential impact on the conformity of products and services | Risk actions proportionate to the potential impact on the intended results of the QMS; opportunity actions appropriate to the organisation’s context and supportive of desired results |
| Concept named in the Introduction | Risk-based thinking | Risk-based thinking and opportunity-based thinking (0.3.1) |
| Leadership | Promote risk-based thinking (5.1.1 d)) | Promote risk-based thinking and opportunity-based thinking (5.1.1 k)) |
| Evaluation of effectiveness | One item covering both (9.1.3 e)) | Two items: risks (9.1.3 e)) and opportunities (9.1.3 f)) |
| Management review | One input covering both | Two inputs: risks (9.3.2 g)) and opportunities (9.3.2 h)) |
| Guidance | Annex A.4 on risk-based thinking | Annex A.6.1.1 to A.6.1.3, including the statement that risks and opportunities are distinct and can be addressed through separate processes |
Nothing in 6.1 requires documented information, in either edition. Annex A.6.1.2 keeps the 2015 position that risk-based thinking does not imply a formal risk-management method or a documented risk-management process. What it does not say is that you can show “analyse and evaluate” without any record, which is why in practice a register remains the simplest evidence.
What “determine, analyse and evaluate” means for a risk
The three words are not decoration. “Determine” is what 2015 asked for: identify the things that could stop the QMS achieving its intended results. “Analyse” means understanding each one well enough to say how likely it is and how serious the effect would be. “Evaluate” means deciding, on the basis of that analysis, which risks matter enough to act on and in what order. An auditor who asks “how did you decide this risk was high?” is testing the analysis; one who asks “why did you treat this risk and not that one?” is testing the evaluation. A high, medium or low rating with a one-line reason meets the requirement for most organisations; a five-by-five matrix is acceptable but not required.
6.1.2 also adds a specific NOTE that determined risks can include those affecting the ability to provide conforming products and services during and after a disruption. For Philippine organisations this brings typhoons, flooding, power interruptions, port congestion and the loss of a single key supplier squarely into the QMS, without importing the whole of ISO 22301.
The treatment options are listed in 6.1.2 NOTE 2: avoid the risk, take the risk in order to pursue an opportunity, eliminate the source, change the likelihood or the consequences, share the risk, or retain it by informed decision. “Retained by informed decision” is an acceptable treatment, provided the decision is visible.
What “determine, analyse and evaluate” means for an opportunity
This is the part most 2015 systems never did. Opportunities were listed as the mirror image of risks (“risk: losing the customer; opportunity: keeping the customer”), which satisfies nobody. Under 6.1.3 an opportunity is a circumstance that could have a desired effect on the organisation’s ability to provide conforming products and services and enhance customer satisfaction. The NOTE gives the range: adopting new practices, launching new products or services, creating partnerships, using emerging technologies, and other actions that address the changing needs of customers and interested parties. Annex A.6.1.3 adds where opportunities come from: the analysis of context and interested parties, organisational capability, capacity and competence, and the results of monitoring and measurement.
Analysing an opportunity means asking what benefit it would bring and what it would take. Evaluating it means deciding which to pursue and which to leave, with a reason. The actions then have to be planned, integrated into the relevant processes, and checked for effectiveness, exactly as for risks. The test of appropriateness is different, though: opportunity actions must fit the organisation’s context and support the results it wants, so a five-person firm is not expected to pursue what a conglomerate would.
Rebuilding the register: one method that satisfies 6.1.2, 6.1.3, 9.1.3 and 9.3.2
Keep the register in two parts, or two sheets, rather than mixing rows. The structure below is deliberately plain so that process owners will keep it alive.
| Column | Risk register (6.1.2) | Opportunity register (6.1.3) |
|---|---|---|
| Source | The context issue (4.1), interested-party requirement (4.2) or process (4.4) that gives rise to it | The context issue, stakeholder need, capability, or monitoring result that reveals it |
| Description | What could go wrong and what it would affect | What could go better and for whom |
| Analysis | Likelihood and consequence, each rated with a one-line reason | Benefit and feasibility, each rated with a one-line reason |
| Evaluation | Priority and decision (act, monitor, accept by informed decision) | Priority and decision (pursue now, pursue later, decline) |
| Action | What will be done, by whom, by when; which process or procedure it lives in | What will be done, by whom, by when; which process it lives in |
| Effectiveness | Measure, review date, result (feeds 9.1.3 e) and 9.3.2 g)) | Measure, review date, result (feeds 9.1.3 f) and 9.3.2 h)) |
| Last reviewed | Date and reviewer | Date and reviewer |
Three rules make it work. First, every action must exist somewhere in a process, procedure, checklist or system control, not only in the register; 6.1.2 b) 1) and 6.1.3 b) 1) both require integration into the QMS processes. Second, the effectiveness column must be completed with a result, not a tick, because 9.1.3 e) and f) require the effectiveness of the actions to be evaluated from data, and 9.3.2 g) and h) require top management to review it. Third, the register is reviewed when the context changes, not only annually, because 4.1 and 4.2 require the issues and interested parties to be monitored and reviewed.
Where risks and opportunities connect to the rest of the standard
Clause 6.1 is the hinge of the standard, and the 2026 edition tightens every joint. The inputs come from 4.1 and 4.2. The processes in 4.4.1 g) must address the risks and opportunities determined under 6.1. Leadership must ensure that risks and opportunities affecting conformity and customer satisfaction are determined and addressed (5.1.2 b)) and must promote both kinds of thinking (5.1.1 k)). Corrective action must update the risks and opportunities determined during planning where necessary (10.2.1 e)). Analysis must show whether the actions worked (9.1.3 e), f)) and management review must consider it (9.3.2 g), h)). Auditors follow these joints in sequence; a register that is disconnected from the processes and the review will be found out at the joint, not at the register.
What an auditor will ask in a 2026 audit
Show me how you analysed and evaluated this risk. Show me an opportunity you decided to pursue, and one you decided not to, with the reason. Show me where the action for this risk lives in your process. Show me the evidence that the action worked, and where management reviewed it. Show me how a change in your context or in a stakeholder’s expectation reached the register. None of these questions needs a new document; all of them need a register that was used.
Don’t take our word for it — read our clients’.
80+ verbatim client feedback letters → — searchable by standard and industry, quoted word-for-word from signed originals you can verify. And see the organizations we serve — Unilab, McDonald’s, SAP, GE, ZTE, JLL and more.
Make your risk and opportunity registers audit-ready for 2026
Free consultation for certified companies and first-timers · ISO 9001:2026 transition and implementation planning against the ISO 9001:2026 standard · itemized quotation within 48 hours. Call +63 977 815 1204, email info@iso-philippines.com, or book your slot →.
Frequently asked questions
Does ISO 9001:2026 require a risk register? No. Clause 6.1 has no documented-information requirement, and Annex A.6.1.2 says risk-based thinking does not imply a documented risk-management process. Because risks must now be analysed and evaluated and the effectiveness of actions reviewed, a register is the practical way to show it.
What is opportunity-based thinking in ISO 9001:2026? The concept, named in 0.3.1 and 5.1.1 k), of identifying circumstances that could improve the organisation’s ability to deliver conforming products and services and satisfy customers, and pursuing them deliberately. It is the counterpart of risk-based thinking and is addressed through 6.1.3.
Do opportunities have to be the opposite of risks? No. Annex A.6.1.1 states that risks and opportunities are distinct and can be determined and addressed through separate processes. An opportunity can exist without a corresponding risk.
How detailed must the analysis be? Proportionate to the potential impact on the intended results of the QMS (6.1.2). A rating with a reason is enough for most organisations; formal methods from ISO 31000 are optional (Annex A.6.1.2 NOTE).
Does the disruption NOTE mean we need a business continuity plan? No. 6.1.2 NOTE 1 says risks can include those affecting delivery during and after a disruption; how you address them is your decision. ISO 22301 remains a separate, optional standard.
How do risks and opportunities reach management review? Through two separate inputs: the effectiveness of actions taken to address risks (9.3.2 g)) and the effectiveness of actions taken to address opportunities (9.3.2 h)), supported by the analysis required in 9.1.3 e) and f).
We already have a combined register from 2015. Do we have to split it? The standard does not prescribe the format. You must be able to show that risks and opportunities were each determined, analysed and evaluated and that their actions were each evaluated for effectiveness. Two sheets are the simplest way to show that; one sheet with clear separation is acceptable.
Read next
The clause-by-clause register of every 2026 change; management review inputs in ISO 9001:2026; the documented information list; the ISO 9001:2026 playbook; and a gap analysis against the ISO 9001:2026 standard. Transition support: ISO 9001:2026 transition consulting from Sterling.
Sources
ISO 9001:2026, Quality management systems — Requirements, sixth edition (published 16 September 2026): 0.3.1, 4.4.1 g), 5.1.1 k), 5.1.2 b), 6.1.1, 6.1.2, 6.1.3, 9.1.3 e) f), 9.3.2 g) h), 10.2.1 e), Annex A.6.1.1 to A.6.1.3. ISO 9001:2015, 6.1.1, 6.1.2 and Annex A.4 for the comparison. ISO 31000, Risk management — Guidelines (Bibliography reference).
Certified to ISO 9001:2015? Take the free ten-minute ISO 9001:2026 gap check, then let a local Sterling lead auditor turn your result into your transition plan.
