Risk-Based Energy Planning under ISO 50001 Clause 6.1

What the requirement is, and why it exists

BS EN ISO 50001:2018 introduced risk-based thinking into energy management through the adoption of the ISO High-Level Structure. Clause 6.1.1 mandates that when planning for the energy management system, the organisation must consider external and internal issues determined under Clause 4.1 and requirements of interested parties determined under Clause 4.2. Additionally, the organisation must review its activities and processes that can affect energy performance to identify risks and opportunities requiring strategic intervention.

This requirement exists to transition energy management from a reactive operational task into an integral component of strategic decision-making. By identifying risks and opportunities during planning, organisations anticipate potential operational disruptions, energy supply restrictions, or cost shifts before undesired effects occur. The standard requires that risk planning remains consistent with the energy policy established under Clause 5.2 and leads directly to actions that achieve continual energy performance improvement.

Risk-based planning applies to all leadership levels, compliance leads, quality managers, and internal auditors across the scope and boundaries of the system. Clause 6.1.1 requires determining specific risks and opportunities to ensure the system achieves its intended outcomes, prevents or reduces undesired effects, and delivers continual improvement. Failing to link strategic context to concrete operational actions weakens system effectiveness and leaves organisations vulnerable to unmitigated energy risks.

Structuring Risk-Based Planning from Context to Action Plans

Operationalizing Clause 6.1 requires establishing a clear, documented flow from high-level context assessment to tactical action planning. The planning sequence begins at the strategic level and translates organizational issues into practical mitigation measures and improvement projects. Organizations follow a defined four-step sequence to satisfy these planning requirements.

1. Assess external and internal issues under Clause 4.1, such as energy supply reliability, price volatility, weather impacts, core business strategy, and technological maturity as outlined in Annex A.4.
2. Determine relevant interested parties and their requirements under Clause 4.2, identifying mandatory legal obligations and voluntary commitments related to energy efficiency, use, and consumption.
3. Evaluate potential risks and opportunities under Clause 6.1.1, identifying events or uncertainties that could hinder intended system outcomes or provide potential efficiency advantages.
4. Formulate targeted action plans under Clause 6.1.2 and Clause 6.2.3, assigning required resources, responsible personnel, completion schedules, and evaluation methods to verify energy performance improvement under Clause 9.1.

Auditing Risk Determination and Action Plan Integration

Internal auditors must verify that risk-based planning is systematically performed, documented, and integrated across business processes. Verification requires auditing the alignment between strategic context inputs, identified risks, and operational outputs created during the energy review under Clause 6.3. The table below outlines what auditors inspect during performance evaluations.

Example

During an internal audit of a manufacturing facility, the auditor reviews the Clause 4.1 context matrix, which identifies severe local grid instability and rising peak tariff rates as critical external issues. The auditor examines the Clause 6.1 risk register and finds that grid failure was identified as a high risk to significant energy uses. However, the auditor discovers that no action plan was established under Clause 6.1.2 or Clause 6.2.3 to mitigate this operational risk. The auditor raises a nonconformity under Clause 6.1.2 for failing to plan actions to address an identified risk that affects energy performance.

Before your audit

• Verify that external and internal issues identified under Clause 4.1 are documented and updated to reflect current operating conditions.
• Confirm that legal requirements and interested party expectations determined under Clause 4.2 directly feed into risk determination.
• Check that every identified risk and opportunity under Clause 6.1.1 links to a corresponding action or documented justification.
• Review action plans under Clause 6.2.3 to ensure each plan specifies required resources, designated owners, completion dates, and evaluation methods.
• Inspect evidence proving that actions to address risks and opportunities are evaluated for effectiveness under Clause 6.1.2 b) 2).
• Ensure that risk planning outputs and action plan statuses are prepared for presentation during management reviews under Clause 9.3.2 b).

Questions people ask

Does ISO 50001 require a formal risk management procedure?

Clause 6.1.1 mandates that the organisation must determine risks and opportunities, but it does not specify a mandatory formal procedure or separate risk register document. The organisation must demonstrate that its planning process systematically considers context issues and interested party requirements to generate actionable outcomes.

What is the difference between a risk and an opportunity in ISO 50001?

Under Clause 3.4.11, a risk is defined as the effect of uncertainty, representing potential negative deviations or operational disruptions that threaten energy performance. An opportunity represents favorable circumstances or potential advantages that the organisation can pursue to achieve energy performance improvement.

How do action plans under Clause 6.1 differ from those under Clause 6.2?

Clause 6.1.2 focuses broadly on strategic actions to address high-level risks and opportunities identified from organizational context. Clause 6.2.3 governs specific, operational action plans established to achieve measurable objectives and quantifiable energy targets.

Must internal auditors evaluate the effectiveness of risk mitigation actions?

Yes, Clause 6.1.2 b) 2) requires the organisation to plan how to evaluate the effectiveness of actions taken to address risks and opportunities. Internal auditors must review evaluation records under Clause 9.1 to confirm that implemented actions successfully prevented undesired effects or delivered performance gains.

Reference documents

• BS EN ISO 50001:2018 - Energy management systems - Requirements with guidance for use