On this page
- What risk-based thinking is, and why it exists
- Identifying operational risks and opportunities in practice
- Evaluating risk controls during internal audits
- Practical audit scenario
- Example
- Before your audit
- Questions people ask
- What is risk based thinking in ISO 9001:2015?
- Is a formal risk register mandatory under ISO 9001:2015?
- How do internal auditors evaluate the effectiveness of risk actions?
- What is the difference between risks and opportunities in ISO 9001?
- Reference documents
The short version
- Risk-based thinking enables organizations to prevent process deviations and systematically capture operational opportunities.
- Clause 6.1 mandates planning proportionate actions for identified risks and integrating them into operational processes.
- ISO 9001:2015 requires objective evidence of risk controls without mandating a formal risk management software system.
- Internal auditors must verify that risk controls effectively prevent nonconformities and enhance customer satisfaction.
What risk-based thinking is, and why it exists
What is risk based thinking in ISO 9001:2015? Risk-based thinking is a systematic approach that enables an organization to identify factors that could cause its processes and quality management system to deviate from planned results, implement preventive controls to minimize negative effects, and maximize opportunities as they arise. This core principle applies to every organization implementing ISO 9001, regardless of size, sector, or operational complexity.
ISO 9001:2015 embeds risk-based thinking throughout the Plan-Do-Check-Act cycle to replace standalone preventive action requirements from earlier editions of the standard. Top management must establish leadership and commitment under Subclause 5.1.2 by ensuring that operational risks and opportunities affecting product conformity and customer satisfaction are determined and addressed. Addressing uncertainty at the planning stage prevents nonconformities, protects product quality, and establishes a foundation for continual improvement.
Important: While addressing risks and opportunities is mandatory under Clause 6.1, Annex A.4 confirms that top management may select any suitable operational methodology and is not required to maintain a formal, documented risk management system.
Identifying operational risks and opportunities in practice
Implementing risk-based thinking requires quality managers to connect context analysis directly to daily operational planning. Under Clause 4.1 and Subclause 4.2, organizations must identify internal and external issues, alongside the requirements of relevant interested parties, to establish the baseline context for operational risk assessment.
Organizations must execute a four-step procedure to transition from strategic context to effective operational risk control:
- Identify specific operational risks and opportunities arising from context issues determined under Clause 4.1 and interested party expectations determined under Subclause 4.2.
- Determine potential impacts on product and service conformity, taking into account process inputs, activity execution, and expected outputs under Subclause 4.4.1.
- Plan proportionate risk mitigation actions under Clause 6.1, which may include avoiding risk, eliminating risk sources, altering likelihood or consequences, or retaining risk by informed decision.
- Integrate control actions directly into operational planning under Clause 8.1 and process instructions under Subclause 4.4.1 to ensure execution during routine operations.
Common finding: Internal audits frequently identify nonconformities where organizations record risks in a static matrix under Clause 6.1 but fail to integrate the corresponding control actions into operational process controls under Clause 8.1.
Evaluating risk controls during internal audits
Internal auditors and compliance leads must evaluate whether risk-based thinking functions effectively within routine operational processes rather than checking for superficial documentation. Auditors must examine evidence across multiple clauses to confirm that planned actions achieve their intended results.
| Requirement | What the auditor checks | Evidence to have ready |
|---|---|---|
| Clause 6.1 Actions to address risks and opportunities | Whether the organization determined risks and opportunities based on context issues and interested party requirements. | Documented context analysis, risk registers, or management review minutes showing risk determinations. |
| Subclause 4.4.1 Process risk integration | How risk mitigation controls are embedded within operational process inputs, criteria, and outputs. | Work instructions, process flowcharts, calibration schedules, or inspection criteria incorporating risk controls. |
| Clause 8.1 Operational planning and control | Whether planned actions to address risks are implemented during production or service provision. | Completed job sheets, production logs, external provider evaluations, or change control records. |
| Subclause 9.1.3 Analysis and evaluation | Whether the organization evaluates the effectiveness of actions taken to address risks and opportunities. | Key performance indicator trend data, defect analysis reports, or customer satisfaction reviews. |
| Subclause 10.2.1 Nonconformity and corrective action | Whether determined risks and opportunities are updated following process nonconformities or complaints. | Corrective action reports showing updated risk assessments after root-cause investigations. |
Tip: Interview operational process owners directly to verify whether risk mitigation steps are executed in daily routines, rather than relying solely on quality department documentation.
Practical audit scenario
Understanding how risk-based thinking operates during an internal audit requires examining real operational situations.
Example
During an internal audit of an electronics assembly process, the auditor reviews raw material procurement controls under Clause 8.4. Context analysis under Clause 4.1 identifies a strategic issue regarding component supply chain disruption. Under Clause 6.1, the organization determined a risk of delayed production and an opportunity to dual-source critical microcontrollers.
The auditor checks operational planning under Clause 8.1 and observes that purchasing instructions include dual-sourcing criteria, while receiving inspection criteria under Clause 8.6 verify incoming component conformity. Finally, the auditor confirms that management review inputs under Subclause 9.3.2 evaluate dual-sourcing performance data under Subclause 9.1.3, demonstrating an effective risk-based process cycle.
Note: Organizations may alter the extent of documented information retained for risk controls based on process complexity and staff competence under Clause 7.5.
Before your audit
- Verify that internal and external context issues determined under Clause 4.1 are reviewed and current.
- Confirm that relevant interested party requirements determined under Subclause 4.2 feed into risk determinations.
- Check that top management actively promotes risk-based thinking across operational departments under Subclause 5.1.1.
- Ensure that actions planned to address risks under Clause 6.1 are integrated into operational controls under Clause 8.1.
- Review data analysis records under Subclause 9.1.3 to confirm that risk control effectiveness is evaluated.
- Verify that risk and opportunity determinations are updated after nonconformities under Subclause 10.2.1.
- Have documented information ready to demonstrate operational process controls under Subclause 4.4.2.
Questions people ask
What is risk based thinking in ISO 9001:2015?
Risk-based thinking in ISO 9001:2015 is a proactive approach that requires organizations to identify operational risks and opportunities, put preventive controls in place, and minimize negative effects on product quality. It integrates preventive action directly into the Plan-Do-Check-Act framework across all quality management system processes.
Is a formal risk register mandatory under ISO 9001:2015?
No, a formal risk register or documented risk management procedure is not mandatory under ISO 9001:2015. Annex A.4 clarifies that while planning actions to address risks is compulsory under Clause 6.1, organizations may select any suitable method and determine the extent of documented information needed.
How do internal auditors evaluate the effectiveness of risk actions?
Internal auditors evaluate risk action effectiveness under Subclause 9.1.3 by reviewing operational performance data, defect trends, and customer satisfaction results. They check whether planned controls under Clause 6.1 successfully prevent nonconformities and whether top management reviews these results under Subclause 9.3.2.
What is the difference between risks and opportunities in ISO 9001?
Risk is defined as the effect of uncertainty, which can produce negative or positive deviations from planned results. Opportunities represent favourable circumstances—such as acquiring new technology or expanding customer bases—that arise from positive deviations or strategic context analysis.
Reference documents
- ISO 9001:2015 Quality management systems — Requirements
Manage this work in 4Auditee
Keep audit plans, problems, corrective actions and document versions in one place. See the records behind each change and decision.
Book a demo