ISO 9001:2026 and Risk-Based Thinking: Are Organizations Managing Risks or Just Updating Registers?
Your risk register says the risk is controlled. But what happens when the same problem reaches the production floor?
Every year, organizations review their quality management system risks. Risk scores are updated, responsible persons are assigned, and mitigation actions are recorded. The document is approved and made available for the next audit.
Yet suppliers continue delivering defective materials. Customer complaints repeat. Equipment failures interrupt production. Corrective actions remain ineffective.
The risk register looks complete, but operational performance tells a different story.
This raises an uncomfortable question: Is the organization actually managing risks, or merely maintaining documentation about them?
ISO 9001:2026 provides an opportunity to examine that distinction.
The revised standard retains risk-based thinking as a foundational quality management principle while clarifying the treatment of risks and opportunities under Clause 6.1.
For organizations transitioning from ISO 9001:2015, the objective should not be to create larger risk registers.
It should be to strengthen the connection between identified risks, management decisions, operational controls and measurable results.
This article examines what ISO 9001:2026 means for risk-based thinking, why risk registers often become disconnected from operations, and how organizations can demonstrate that risk-related decisions are genuinely influencing their quality management systems.
What Is Risk-Based Thinking in ISO 9001?
Risk-based thinking involves considering uncertainty and its potential effects when planning, operating, evaluating and improving a quality management system.
Within ISO 9001, this approach helps organizations determine what could affect their ability to achieve intended QMS results, deliver conforming products and services, and enhance customer satisfaction.
Risk-based thinking is not limited to identifying negative events.
It also involves recognizing circumstances where appropriate action can support better outcomes.
For example, a manufacturer may identify a risk that a critical supplier could fail to deliver materials on time.
Possible responses could include evaluating alternative suppliers, adjusting inventory arrangements or strengthening supplier performance monitoring.
The effectiveness of those responses depends on how they are implemented and whether they reduce the relevant exposure.
Simply recording the risk does not control it.
What Changed in ISO 9001:2026 Clause 6.1?
Risk-based thinking was already established in ISO 9001:2015.
The 2026 revision does not introduce it as a new concept.
Instead, ISO 9001:2026 provides clearer distinction between addressing risks and pursuing opportunities.
According to ISO’s official explanation, the revised Clause 6.1 encourages organizations to proactively use both considerations in informed decision-making and continual improvement.
Managing Risks
Risk-related actions are intended to address uncertainty that could adversely affect QMS outcomes.
For example, an organization may strengthen inspection controls after identifying the possibility of receiving nonconforming raw materials.
Pursuing Opportunities
Opportunity-related actions are intended to support beneficial outcomes.
For example, an organization may identify an opportunity to improve process consistency by introducing more capable measurement technology.
Both require thoughtful decisions and appropriate evaluation.
However, preventing an undesirable result and pursuing a beneficial improvement are not necessarily the same management activity.
Does ISO 9001:2026 Require a Separate Risk Register?
Organizations should not assume that the revised standard universally requires a specific risk register format, scoring matrix or standalone risk-management procedure.
The appropriate arrangements depend on the organization’s context, processes and applicable requirements.
A risk register may be a useful tool.
But the existence of a register does not independently demonstrate effective risk-based thinking.
Why Risk Registers Often Fail to Influence Real Decisions
Risk registers become ineffective when they are treated as isolated compliance documents rather than working management tools.
Consider an organization that identifies supplier quality as a significant risk.
The risk register includes:
- Risk: Receipt of nonconforming material
- Likelihood: Medium
- Impact: High
- Control: Approved supplier evaluation
- Responsible department: Purchasing
The record appears reasonable.
But during an internal audit, the auditor discovers that suppliers are frequently selected based on price and delivery availability without consistently applying the approved evaluation process.
The organization has identified the risk, but its operational decisions do not consistently reflect the documented control.
The problem is not necessarily the risk register itself.
It is the disconnect between the register and the actual purchasing process.
1. Supplier Risk: Are Purchasing Decisions Reflecting the Assessment?
Supplier management provides a practical example of risk-based thinking.
Organizations depend on external providers for materials, components, services and outsourced processes.
Some suppliers may have a greater influence on product conformity than others.
For example, a supplier providing critical safety-related components may require a different level of evaluation and monitoring from a supplier providing low-impact office consumables.
A risk-based approach can help determine appropriate supplier controls.
Potential Risk-Based Controls
- Supplier qualification criteria based on criticality
- Verification of relevant technical capability
- Incoming inspection arrangements
- Supplier performance monitoring
- Contingency planning for critical materials
- Escalation of recurring supplier nonconformities
- Reassessment following significant changes
However, the selected controls should be supported by actual supplier performance and process evidence.
Audit question: Can purchasing demonstrate how identified supplier risks influence supplier selection, monitoring and verification activities?
2. Production Risk: Does the Risk Assessment Change Process Controls?
Manufacturing organizations routinely face uncertainty associated with equipment, materials, process settings and human interaction.
Consider a process where incorrect machine settings could produce a large quantity of defective components.
The organization identifies the risk as significant.
But the actual process still relies entirely on an operator remembering the correct setting.
No independent verification exists, and the machine allows incorrect parameters to be entered without warning.
In this situation, the risk assessment may be accurate, but the operational response may be inadequate.
Depending on the verified failure mechanism, possible improvements could include:
- Setup verification before production
- Controlled parameter access
- Clearer operating instructions
- Process monitoring
- Error-proofing arrangements
- Appropriate competence verification
Not every process requires every control.
The objective is to select proportionate measures based on the relevant risks and process characteristics.
3. Customer Requirements: Are Risks Considered Before Commitments Are Made?
Risk-based thinking should also influence commercial and customer-related decisions.
Consider a company receiving an urgent order with demanding technical specifications.
The sales team wants to accept the order immediately.
However, production capacity is limited, the required material is unfamiliar, and the delivery schedule is unusually short.
Accepting the order without adequately evaluating these conditions could create risks relating to product conformity, delivery performance and customer satisfaction.
An effective review may involve coordination between sales, production, purchasing and quality personnel.
The organization can then determine whether it has the capability and resources to meet the requirements.
Risk-based thinking should influence decisions before problems occur, not merely explain them afterward.
4. Equipment and Maintenance: Is Risk-Based Planning Preventing Failure?
Equipment failures can affect product quality, delivery commitments and operational continuity.
However, not every machine has the same significance.
A failure involving a critical production asset may have greater consequences than a failure involving equipment with available redundancy.
Organizations can consider these differences when planning maintenance, spare parts, monitoring and contingency arrangements.
For example, a critical machine with repeated breakdowns may require more intensive condition monitoring or a review of its maintenance strategy.
A documented risk score alone does not establish that the maintenance approach is effective.
Evidence may include maintenance performance, breakdown trends, completed actions and verification of improved reliability.
5. Risk-Based Thinking and Corrective Action: Are Lessons Being Applied?
Nonconformities provide valuable information about actual process weaknesses.
When a significant failure occurs, organizations should consider whether their previous understanding of the associated risks remains valid.
For example, a manufacturer may have assessed the risk of incorrect product labeling as low.
After several labeling errors and customer complaints, the original assessment may no longer reflect actual performance.
The organization should evaluate the new evidence and determine whether additional controls are needed.
Potential responses could include label verification, system controls, process redesign or changes to responsibilities.
The important connection is between observed performance and risk-related decisions.
A risk register that remains unchanged despite repeated relevant failures may not be serving its intended purpose.
6. Risks and Opportunities Are Different Management Decisions
One important refinement in ISO 9001:2026 is the clearer distinction between addressing risks and pursuing opportunities.
Consider a packaging manufacturer.
The organization identifies a risk that inconsistent raw material quality could lead to defective packaging.
It responds by strengthening incoming material verification.
Separately, the organization identifies an opportunity to introduce more advanced production monitoring technology that could improve process capability and reduce waste.
Both decisions relate to quality performance.
But they have different objectives.
| Aspect | Risk-Related Action | Opportunity-Related Action |
|---|---|---|
| Primary purpose | Reduce or control adverse uncertainty | Pursue beneficial outcomes |
| Example | Strengthen incoming material inspection | Introduce improved process monitoring |
| Management consideration | Potential consequences of failure | Potential value and feasibility |
| Effectiveness evaluation | Whether the relevant risk is adequately addressed | Whether the intended improvement is achieved |
Organizations should avoid treating every opportunity as merely a risk with a positive score.
They should determine appropriate actions based on what they intend to achieve.
7. Leadership Accountability: Who Owns the Risk Decision?
The Quality Department may coordinate risk assessments and maintain QMS documentation.
However, many risk-related decisions depend on operational and management authority.
For example:
- Purchasing leadership controls supplier selection.
- Operations management influences production capacity.
- Engineering controls equipment and process design.
- Sales management influences customer commitments.
- Top management determines major resource priorities.
Therefore, risk-based thinking should not become an activity performed exclusively by quality personnel.
Process owners and management should understand relevant risks and incorporate appropriate responses into their decisions.
Consider a recurring equipment problem requiring capital expenditure.
If the organization identifies the risk but repeatedly postpones necessary decisions without adequately managing the exposure, the weakness may involve leadership and resource allocation rather than risk identification alone.
8. A Realistic Scenario: The Supplier Risk That Existed Only on Paper
Consider a hypothetical manufacturer purchasing a critical polymer material from an external supplier.
The company’s risk register identifies inconsistent material properties as a significant risk.
The documented control requires supplier performance evaluation and verification of relevant incoming material characteristics.
However, production demand increases sharply.
Purchasing begins accepting urgent deliveries without consistently completing the required verification.
Several batches later, the manufacturer experiences product failures associated with inconsistent raw material properties.
An investigation confirms that incoming verification controls were not consistently applied.
The organization now faces two related questions.
Was the Risk Identified?
Yes. The relevant risk had already been documented.
Was the Risk Effectively Managed?
Not necessarily. The planned controls were not consistently implemented.
The corrective response should examine why those controls were bypassed and whether purchasing, production planning or management practices contributed to the problem.
Simply increasing the risk score may not address the underlying weakness.
The problem was not a lack of awareness that the risk existed. It was a failure to translate that awareness into consistent operational control.
What Evidence Demonstrates Effective Risk-Based Thinking During an Audit?
Auditors should not rely exclusively on the presence of a risk register.
Depending on the audit criteria and organizational context, relevant evidence may be found in operational decisions, process controls and performance results.
| QMS Area | Potential Evidence | What It May Demonstrate |
|---|---|---|
| Supplier management | Qualification records, monitoring results, inspection arrangements | Supplier risks influence purchasing controls |
| Production | Control plans, setup verification, process monitoring | Process risks influence operational controls |
| Customer requirements | Contract reviews, feasibility evaluations | Risks are considered before commitments |
| Maintenance | Maintenance planning, breakdown trends | Critical equipment risks influence maintenance decisions |
| Corrective action | Investigations, revised controls, effectiveness reviews | Actual failures influence risk responses |
| Leadership | Resource decisions, management-review actions | Management addresses significant risks |
| Opportunities | Improvement plans, implementation results | Beneficial opportunities are actively pursued |
This matrix is a practical assessment aid, not a prescribed ISO 9001:2026 evidence checklist.
9. Why Risk Scores Can Create False Confidence
Many organizations use numerical risk scoring systems.
For example, a risk may be assessed using likelihood and severity values.
Such methods can help structure discussion and prioritize attention.
However, numerical scores can create false confidence when the underlying assumptions are weak.
Consider a process risk initially rated as low because failures have historically been rare.
If the process has recently changed, the historical assessment may no longer be representative.
Similarly, a high risk score does not demonstrate that the organization has selected or implemented effective controls.
Risk scores should support professional judgement rather than replace it.
Organizations should also consider whether the chosen assessment method is appropriate to the complexity and significance of the activity.
10. How to Make Risk Registers Useful Again
Organizations do not necessarily need to abandon risk registers.
They need to ensure that the information is connected to actual decisions.
Step 1: Identify Relevant QMS Risks
Consider risks that could affect intended results, product and service conformity, and customer satisfaction.
Step 2: Connect Risks to Processes
Identify where the relevant risks arise and which process owners have responsibility for managing them.
Step 3: Define Appropriate Actions
Select controls or other responses proportionate to the significance of the risks.
Step 4: Integrate Actions Into Operations
Ensure risk-related decisions influence actual work instructions, purchasing controls, maintenance plans, reviews or other relevant activities.
Step 5: Assign Responsibility
Clarify who is responsible for implementation and ongoing monitoring.
Step 6: Evaluate Effectiveness
Use relevant performance information to determine whether actions are achieving their intended results.
Step 7: Review Changes
Reassess risks when significant changes, failures or new information affect the original assumptions.
Step 8: Evaluate Opportunities Separately
Identify beneficial opportunities and determine appropriate actions to pursue them, consistent with the revised Clause 6.1 approach.
Risk-Based Thinking Readiness Checklist for ISO 9001:2026
- Do identified risks reflect current business and operational conditions?
- Are significant risks connected to relevant QMS processes?
- Do process owners understand their risk-related responsibilities?
- Are planned actions implemented consistently?
- Do supplier evaluations reflect supplier criticality and performance?
- Are risks considered before accepting challenging customer requirements?
- Do maintenance and process controls reflect relevant operational risks?
- Are risk assessments updated when significant failures or changes occur?
- Can management demonstrate that risk-related actions are effective?
- Are opportunities identified and pursued through appropriate planning and evaluation?
These questions support internal readiness evaluation and are not a mandatory ISO checklist.
Common Mistakes Organizations Should Avoid
- Assuming that a completed risk register proves effective risk management
- Using identical risk scores without considering process differences
- Failing to connect risks with actual operational controls
- Assigning every risk to the Quality Department
- Ignoring customer complaints and recurring nonconformities when reviewing risks
- Creating risk assessments only before certification audits
- Confusing implementation of an action with evidence of its effectiveness
- Treating opportunities as an afterthought
- Updating documentation without reviewing the decisions that influence performance
How Shark Certification Can Support ISO 9001:2026 Readiness
ISO 9001:2026 provides an opportunity to evaluate whether risk-based thinking is genuinely embedded in organizational decisions and QMS processes.
Shark Certification supports organizations through management system consultancy, audit services and professional training.
Organizations preparing for the revised standard can review their approach to risks and opportunities, examine the effectiveness of operational controls and identify gaps between documented assessments and actual practices.
Contact Shark Certification to discuss ISO 9001:2026 gap assessment, risk-based QMS improvement and internal audit readiness.
Frequently Asked Questions
What is risk-based thinking in ISO 9001:2026?
Risk-based thinking involves considering uncertainty and its potential effects when planning and operating a QMS. ISO 9001:2026 retains this established principle while clarifying how organizations address risks and pursue opportunities.
Is risk-based thinking new in ISO 9001:2026?
No. Risk-based thinking was already fundamental to ISO 9001:2015. The 2026 edition refines the treatment of risks and opportunities under Clause 6.1.
Does ISO 9001:2026 require a risk register?
The standard does not universally prescribe a particular risk register format. Organizations should determine appropriate methods and evidence for addressing the applicable requirements.
What changed in ISO 9001:2026 Clause 6.1?
The revised edition provides a clearer distinction between managing risks and pursuing opportunities, encouraging both to be used proactively in decision-making and continual improvement.
Can an organization use a risk matrix?
Yes. A risk matrix may be a useful assessment tool where appropriate. However, numerical scoring should support informed decisions rather than replace them.
How can auditors verify risk-based thinking?
Auditors can examine how identified risks influence relevant operational controls, purchasing decisions, process planning, management actions and effectiveness evaluations.
Are risks and opportunities the same thing?
No. Risks generally concern uncertainty that could affect intended outcomes, while opportunities concern circumstances that may support beneficial results. ISO 9001:2026 gives clearer attention to the different actions associated with each.
Who is responsible for risk-based thinking?
Risk-based thinking should be integrated into relevant organizational processes. Top management, process owners and other responsible personnel may all have roles in identifying, addressing and reviewing risks.
Should risk assessments be updated after nonconformities?
Organizations should evaluate whether relevant failures or new information affect their previous risk assumptions and whether existing controls remain appropriate.
What is the biggest weakness in risk-based QMS implementation?
A common weakness is identifying risks in documents without ensuring that appropriate actions are implemented and evaluated within actual operations.
Conclusion: A Risk Register Is a Tool, Not the Result
Risk-based thinking is not demonstrated by the number of risks listed in a spreadsheet.
It is demonstrated by how an organization uses relevant information to make decisions, establish controls and improve performance.
ISO 9001:2026 retains risk-based thinking while providing clearer distinction between addressing risks and pursuing opportunities.
For organizations transitioning to the revised edition, this is an opportunity to examine whether risk assessments genuinely influence supplier management, production controls, customer commitments, maintenance planning and leadership decisions.
The objective is not to create a risk register that looks complete during an audit.
It is to operate a quality management system in which important risks are understood, appropriate actions are taken, and their effectiveness can be demonstrated.
Because a risk that exists only in a register is not necessarily a risk that is being managed.
