When organizations hear the phrase “risks and opportunities”, the discussion often moves almost immediately to spreadsheets: probability, impact, score, owner, traffic-light colour and review date. Before long, the company has a risk register with dozens — sometimes hundreds — of entries that receives serious attention mainly before an internal or certification audit.
That is not the real purpose of risk-based thinking.
The practical intent is much simpler. An organization should understand what could interfere with the results it is trying to achieve, decide whether action is needed and then determine whether those actions are effective. At the same time, it should be able to recognise favourable circumstances that could help it improve performance rather than treating “opportunities” as a mandatory extra column in a risk register.
Preventive thinking existed in earlier editions of ISO 9001, including through the former concept of preventive action. ISO 9001:2015 made the approach more systematic by embedding risk-based thinking throughout the planning and operation of the QMS instead of treating prevention as a separate activity.
ISO 9001:2026 therefore does not introduce risk-based thinking from scratch. What is changing is the clarity and balance of the approach. Official ISO material describing the revision highlights greater clarity in managing risks and opportunities and a more strategic approach to the subject. Earlier published draft material also distinguished more clearly between risk-based thinking and opportunity-based thinking.
The practical message is important: opportunities should not be treated as an afterthought added to a risk table simply to satisfy an auditor.
What is a risk?
ISO 9000:2026 describes risk in terms of the effect of uncertainty. In ISO terminology, that effect may be negative or positive. For everyday QMS management, however, a simpler question is often more useful:
What could prevent us from achieving the intended result?
Suppose an organization has an objective to deliver at least 95% of customer orders on time. Relevant risks might include:
- dependence on a single critical supplier;
- unreliable production equipment;
- insufficient staffing;
- inaccurate production planning;
- failure of a critical IT system;
- unstable incoming material quality.
The important point is that a risk becomes meaningful when it is connected to an intended result. “Equipment failure” by itself is generic. “Failure of the only production line could prevent us from achieving our 95% on-time-delivery objective” is much more useful because it explains why the issue matters.
Risk identification should therefore start with the result the organization or process is expected to achieve, not with a generic catalogue of everything that could possibly go wrong.
What is an opportunity?
For opportunities, a similarly practical question can be used:
What could help us achieve a better result?
Consider a company receiving the same customer complaint repeatedly. The risk is relatively obvious: continuing dissatisfaction may increase service costs, damage retention and eventually lead to lost business. But the same situation may also reveal an opportunity. If the company analyses the recurring problem and improves the underlying product or service, it may not only prevent customer loss but also reduce rework, improve the customer experience and create a competitive advantage.
This is why an opportunity should not simply be treated as “a risk with a plus sign.”
ISO terminology recognises that uncertainty may have positive effects and that positive effects can create opportunities. However, that does not mean every opportunity needs to be manufactured as the exact opposite of a risk.
For example, writing:
Risk: losing an important customer.
Opportunity: not losing the customer.
creates a symmetrical pair but adds little management value.
A more meaningful opportunity would be to analyse recurring customer problems, redesign the service process and use the improvement to strengthen retention across the wider customer base.
An opportunity should therefore represent something the organization can realistically use, develop or pursue to improve its results.
Connect risks and opportunities to objectives and processes
Risk- and opportunity-based thinking works best when it is part of normal process management rather than a parallel system maintained by the quality department.
Take purchasing. The purpose of the process may be to ensure that production receives conforming materials in the required quantity and at the required time. Once that intended result is clear, the process owner can ask two useful questions:
- What could prevent us from achieving this result?
- What could help us achieve it more reliably, efficiently or effectively?
Those questions naturally lead to relevant issues such as supplier performance, sole-source dependency, lead times, incoming quality problems, alternative suppliers and changing market conditions.
The same logic applies throughout the QMS. Customer service may identify risks and opportunities through complaints and service metrics. An IT team may identify them through incidents, change management, releases and new technologies. Manufacturing may use downtime, scrap, rework, process capability and supplier performance.
This is generally more useful than creating a separate “ISO risk management system” that sits alongside the way the business is actually managed.
Six practical examples
The value of these examples becomes clearer when risks and opportunities are connected to a specific objective, action and expected result.
Example 1: Dependence on a single supplier
Suppose the objective is to maintain uninterrupted production, but a critical component is purchased from only one supplier. A major disruption at that supplier could stop production entirely.
The organization may decide to identify and qualify a second source. This action reduces dependency, but it may also create opportunities beyond risk reduction. A second supplier could improve commercial terms, introduce competition between suppliers or provide access to a better material or technology.
The logic is therefore:
Objective: maintain uninterrupted production.
Risk: disruption at the sole supplier stops production.
Action: qualify an alternative supplier.
Opportunity: improve resilience and potentially supplier performance or commercial terms.
Possible result: fewer disruptions and a more robust supply chain.
The same action may reduce a risk and create an opportunity, but that does not make the two concepts identical.
Example 2: Recurring customer complaints
Suppose the objective is to improve customer satisfaction and retention, but the same complaint keeps appearing. The immediate risk is that customers become dissatisfied and eventually leave.
The organization could address the risk simply by responding to complaints more quickly. But there may be a greater opportunity. If analysis shows that the problem comes from a confusing product feature, poor onboarding or an inefficient service process, redesigning that experience could lead to several benefits:
- fewer complaints;
- higher customer satisfaction;
- lower support costs;
- stronger customer retention.
The opportunity goes beyond preventing a negative outcome. It creates the possibility of a better business result.
Example 3: A critical manual operation
A manufacturer has an objective to reduce defects below 1%, but an important operation is performed manually and depends heavily on operator attention. The risk is human error and inconsistent output.
Initial actions might include better standardisation, clearer work instructions, error-proofing or additional process controls. During the analysis, however, the organization may identify a broader automation opportunity.
If technically and financially justified, automation could reduce defects, improve repeatability, increase capacity and allow employees to focus on higher-value work. In this case, the opportunity emerges from examining the risk but is not merely the “positive version” of it.
Example 4: Ageing equipment
Older equipment may create familiar risks such as:
- breakdowns and unplanned downtime;
- unstable process parameters;
- increasing maintenance costs;
- poor repeatability;
- greater risk of defects.
The obvious response may be to replace the equipment with a similar new machine. But the organization can look further. A replacement project may also provide an opportunity to introduce automated inspection, combine operations, improve process capability or increase output.
Managing a risk can therefore become the trigger for a wider process improvement.
Example 5: Entering a new market
A new market is a good example of why an opportunity is not simply a positive risk. Suppose the organization has an objective to increase revenue by 20% and identifies expansion into a new market as a potential opportunity.
Pursuing that opportunity creates its own risks, which may include:
- different customer expectations;
- unfamiliar legal or regulatory requirements;
- insufficient internal competence;
- new logistics arrangements;
- different competitive conditions.
The organization may reasonably decide that the opportunity is attractive while simultaneously managing the risks created by pursuing it.
That is normal business management. Opportunities are not risk-free.
Example 6: A new digital or AI-based tool
Suppose a company is considering an AI-enabled tool to classify customer enquiries and identify recurring issues. The opportunity is faster processing and earlier identification of complaint trends. At the same time, potential risks may include inaccurate classification, poor-quality input data, excessive reliance on the system, insufficient human oversight or information security concerns.
A sensible management response is neither to reject the technology because risks exist nor to deploy it immediately because it appears innovative. A more balanced approach could include:
- running a limited pilot;
- defining acceptable output quality;
- comparing system results with human decisions;
- maintaining appropriate oversight;
- training users;
- reviewing whether the expected benefit has actually been achieved.
This is a good example of practical risk- and opportunity-based thinking: the organization pursues a possible improvement while managing the uncertainty associated with it.
How do you decide which risks really matter?
One of the most common mistakes is trying to identify everything that could possibly go wrong. Almost any process can generate dozens of hypothetical risks, but a register containing hundreds of near-identical entries does not necessarily make the organization better at managing uncertainty.
A more useful approach is to assess significance in relation to the intended result. Questions may include:
- How seriously could this issue affect the customer?
- Could it affect product or service conformity?
- Could it prevent a key process objective from being achieved?
- Are effective controls already in place?
- Does the situation require additional action?
ISO 9001 should not be interpreted as requiring one specific mathematical formula for every organization. A probability × impact matrix may be useful, but it is not the only possible approach.
For some manufacturing applications, FMEA may be appropriate. Strategic issues may be better addressed through scenario analysis. A small professional services firm may be able to manage relevant risks through structured process-owner discussions with clearly documented decisions and actions.
The method should help people make better decisions. If it exists mainly to generate a number, it may be adding less value than expected.
Do all opportunities need to be scored?
Not necessarily.
Applying the same probability-and-impact matrix to every opportunity can create artificial complexity. If an organization is considering process automation, for example, a more useful evaluation may ask:
- What benefit could the investment deliver?
- What will implementation cost?
- Do we have the necessary competence and resources?
- What is the expected payback?
- What new risks could the change introduce?
- Does the initiative support process or strategic objectives?
A numerical scoring method may be useful where several investments compete for limited resources, but there is little value in giving an opportunity a “probability of 4” and “impact of 5” simply because those columns already exist in the risk register.
Evaluation should support a real decision.
Do you need a risk and opportunity register?
ISO 9001:2015 does not prescribe a mandatory stand-alone risk register. Official ISO 9001 Auditing Practices Group guidance explains that evidence of risk-based thinking can appear in many parts of normal QMS activity, including:
- process planning;
- customer feedback analysis;
- product and service design;
- operational controls;
- supplier management;
- corrective action;
- management review;
- improvement activities.
For some organizations, a central register is genuinely useful because it provides visibility and helps coordinate action. For others, risks and opportunities may be managed more effectively through process reviews, project plans, supplier management, business planning or regular operational meetings.
The important issue is not the format of the document. The organization should be able to demonstrate a coherent management chain:
Intended result → Risk or opportunity → Decision → Action → Result → Effectiveness review
If that chain works, the exact location of the information is secondary.
A risk table is not the same as risk management
Consider a typical entry in a risk register:
Risk: equipment failure
Probability: 3
Impact: 4
Score: 12
Action: monitor
A year later, the entry looks exactly the same.
The important questions are not whether the score is still 12 but what actually happened. Did reliability improve? Was preventive maintenance changed? Did downtime decrease? Was replacement considered? Did the same failures continue?
If nobody knows, the spreadsheet has documented the risk but has not necessarily helped manage it.
One of the important elements of the existing ISO 9001 approach is evaluating the effectiveness of actions taken to address risks and opportunities. In practice, this means returning to the purpose of the action and asking whether it worked.
If a second supplier was qualified to reduce delivery disruption, look at supply interruptions. If maintenance was changed to reduce downtime, examine downtime. If a service process was redesigned to reduce repeat complaints, review the complaint trend.
Without this step, risk management can easily become a record-keeping exercise.
Integrate risks and opportunities into normal management
A mature QMS should not require every process owner to open a special “ISO risk register” once a year and invent entries for the quality department.
A purchasing manager probably already considers supplier performance, late deliveries, incoming defects, dependence on individual suppliers, price movements and alternative sources. That is already risk-based thinking. The role of the QMS is to make the thinking systematic, connect it with intended results and ensure that important decisions are followed through.
The same applies elsewhere. A customer service manager may use complaint trends and service metrics. An IT team may use incidents, release planning and change management. Manufacturing may use downtime, scrap, capability, defects and supplier data.
The objective is not to create a parallel management system called “ISO risks”. It is to improve the quality of ordinary management decisions.
Common mistakes
Several weaknesses appear repeatedly when organizations formalise risks and opportunities.
1. The register exists mainly for the auditor
The quality department owns the spreadsheet while process owners barely know what it contains. Risks are reviewed before audits rather than as part of normal management. This is documentation, not integration.
2. Hundreds of generic risks
Long lists may create an impression of thoroughness but can make it harder to distinguish the issues that genuinely matter. The objective is not to identify the greatest possible number of risks; it is to recognise and manage significant ones.
3. Scoring for the sake of scoring
Teams may spend considerable time debating whether probability should be 3 or 4 even though either result would lead to exactly the same action. If the score does not influence a decision, it is worth asking whether the scoring method is useful.
4. No connection to action
A risk is identified and rated, but nobody can explain what the organization decided to do about it. Identification is only the beginning.
5. No effectiveness review
An action is completed, the item is marked “closed”, but nobody checks whether the intended result actually improved. Completing an action and achieving the desired effect are not the same thing.
6. Opportunities exist only on paper
Entries such as “improve customer satisfaction”, “expand the market” or “increase efficiency” may be valid ambitions, but they are not necessarily managed opportunities. A useful opportunity should lead to a real decision, initiative, experiment or investment.
What might an auditor look for?
A competent auditor is likely to be interested in much more than the existence of a risk matrix. Relevant questions may include:
- What could prevent this process from achieving its intended results?
- Which risks does the organization currently consider significant, and why?
- What actions have been taken?
- How are those actions integrated into the process?
- What opportunities has the organization chosen to pursue?
- What result was expected?
- How was the effectiveness of the action evaluated?
ISO 9001 Auditing Practices Group guidance emphasises that risk-based thinking should not be treated as an isolated audit topic. Evidence can be gathered throughout the audit of the QMS.
For that reason, a question such as “What currently presents the greatest threat to this process achieving its objectives, and what are you doing about it?” will often reveal more than simply asking to see the risk register.
The same applies to opportunities. An auditor is not necessarily looking for a list labelled “opportunities”; the more relevant issue is whether the organization identifies favourable circumstances where appropriate, decides whether to act on them and evaluates the results.
A practical six-step approach
Most organizations do not need a complicated methodology to start working effectively with risks and opportunities.
Step 1 — Define the intended result
Start with what the process or the QMS is expected to achieve. Without a clear result, it is difficult to judge whether a risk is significant or whether an opportunity is worth pursuing.
Step 2 — Ask what could prevent that result
Identify uncertainties that are significant enough to require attention. Do not try to document every imaginable event.
Step 3 — Ask what could produce a better result
Look for genuine opportunities. They may emerge from customer feedback, new technology, changes in the market, supplier developments, process data, recurring problems or employee ideas.
Step 4 — Make a management decision
Depending on the situation, the organization may decide to:
- reduce or avoid a risk;
- accept a risk where appropriate;
- change a process;
- pursue an opportunity;
- run a pilot before committing significant resources.
Step 5 — Integrate the action into the process
Decide what needs to happen, who is responsible, what resources are needed and, where relevant, when the action should be completed. The action should become part of normal management rather than remain isolated in a spreadsheet.
Step 6 — Evaluate effectiveness
Return to the original objective and ask what changed. Did performance improve? Did failures decrease? Was the expected benefit achieved? Did the action introduce any new risks?
The logic can be summarised as:
Objective → Risk / Opportunity → Decision → Action → Result → Effectiveness
If an organization genuinely manages its processes in this way, it will often need much less additional “ISO risk bureaucracy” than it expects.
Key takeaway
Risk-based thinking in ISO 9001 is not about creating the largest possible risk matrix. For practical management, two questions are particularly useful:
Risk: What could prevent us from achieving the intended result?
Opportunity: What could help us achieve a better result?
ISO terminology is broader, because ISO 9000:2026 describes risk through the effect of uncertainty and recognises that effects can be positive or negative. But that does not mean every opportunity is simply a “positive risk”, nor does it mean that risks and opportunities need to be forced into identical scoring systems.
The strongest evidence of a working approach is not the number of rows in a register. It is the organization’s ability to connect its objectives, uncertainties, opportunities, decisions, actions and measurable results.
For organizations preparing for ISO 9001:2026, the best starting point may therefore not be a new template. Start with process owners and ask two questions: What could prevent you from achieving the result you need, and what could help you achieve a better one?
Those questions often reveal very quickly whether risk- and opportunity-based thinking is genuinely part of management — or mainly part of the paperwork.
Audit Advisor: ISO 9001:2026 Resource
This article is part of Audit Advisor’s dedicated resource covering the revised ISO 9001 standard, key changes and transition preparation: