Risk-Based Thinking in ISO 9001: How Organizations Can Identify and Address Quality Risks

Organizations face uncertainty every day. Suppliers may fail to deliver on time, employees may make errors, equipment can break down, customer requirements may change, and processes may not always produce the expected result.

ISO 9001 addresses this uncertainty through risk-based thinking.

Risk-based thinking encourages organizations to consider what could affect the effectiveness of their Quality Management System (QMS), determine which issues require attention, and take proportionate action before problems affect customers or business performance.

With the publication of ISO 9001:2026, the concept remains an important part of quality management. The revised standard also provides clearer distinction between addressing risks and pursuing opportunities, helping organizations use both concepts as part of planning and decision-making.

What Is Risk-Based Thinking in ISO 9001?

Risk-based thinking is an approach in which an organization considers uncertainty when planning, operating, evaluating and improving its processes. Rather than waiting for a nonconformity to occur and then correcting it, organizations are encouraged to think ahead.

For example, a company may ask:

• What could prevent this process from achieving its intended result?
• What could cause a product or service to fail customer requirements?
• Which suppliers create the greatest operational risk?
• What could cause delays, errors or customer complaints?
• What opportunities could improve process performance?
• What controls are appropriate for the level of risk involved?

Risk-based thinking therefore becomes part of routine management rather than a separate exercise performed only before an audit. ISO guidance has long emphasized that different processes do not carry the same level of risk. The degree of planning and control should therefore reflect the possible consequences of failure.

Why Is Risk-Based Thinking Important?

A Quality Management System should not only describe how work is performed. It should also help an organization anticipate issues that could prevent it from achieving consistent results.

Effective risk-based thinking can help organizations:

• Prevent potential quality problems
• Improve consistency of products and services
• Reduce process failures and rework
• Protect customer satisfaction
• Improve operational decision-making
• Strengthen supplier controls
• Prioritize resources
• Identify improvement opportunities
• Respond more effectively to changing conditions

This makes risk-based thinking closely connected with the process approach and continual improvement. It should influence how processes are designed, controlled, monitored and improved.

Risk-Based Thinking Does Not Mean Creating a Complicated Risk Register

One common misunderstanding is that every organization must create a large formal risk-management system to meet ISO 9001 requirements. That is not necessarily the case. The level of formality should be appropriate to the organization's size, complexity, processes and risks.

A small organization may identify and manage risks through:

• Process reviews
• Management meetings
• Internal audits
• Corrective-action records
• Supplier evaluations
• Customer feedback
• Operational planning

A larger or more complex organization may use structured tools such as:

• Risk registers
• Failure Mode and Effects Analysis (FMEA)
• Risk matrices
• SWOT analysis
• Process risk assessments
• Business-impact assessments
• Supplier risk ratings

The purpose is not to create documentation simply for an audit. The purpose is to demonstrate that relevant risks and opportunities are being considered and acted upon.

How Does Risk-Based Thinking Work in ISO 9001?

Risk-based thinking appears throughout the Quality Management System rather than existing as one isolated activity.

1. Understand the Organization's Context

Organizations first need to understand the internal and external issues that can affect their Quality Management System.

Examples may include:

• Changes in customer expectations
• New technologies
• Supply-chain disruption
• Regulatory developments
• Workforce availability
• Market changes
• Organizational restructuring
• Changes in suppliers
• Environmental or climate-related conditions where relevant

Understanding context helps the organization identify where uncertainty may affect its ability to achieve intended results.

2. Understand Interested Parties

Organizations should also consider relevant interested parties and their requirements.

These may include:

• Customers
• Employees
• Regulators
• Suppliers
• Business partners
• Owners or shareholders
• Contractors

For example, if an important customer introduces stricter delivery requirements, the organization may need to consider the risk of late delivery and evaluate whether existing production and logistics processes remain adequate.

3. Identify Risks Within Processes

Risks should be considered at the process level. Consider a purchasing process. Possible risks might include:

• Supplier delays
• Incorrect materials
• Unapproved suppliers
• Price instability
• Incomplete specifications
• Poor supplier performance

For a production process, risks could include:

• Equipment failure
• Incorrect process settings
• Inadequate inspection
• Operator error
• Material contamination
• Uncontrolled process changes

For customer service, risks might include:

• Complaints not being recorded
• Slow response times
• Incorrect information being provided
• Failure to communicate changes

Risk-based thinking should therefore reflect the actual operation of the organization.

4. Evaluate the Significance of the Risk

Not every risk requires the same level of control. Organizations should consider factors such as:

• Likelihood of occurrence
• Potential impact
• Effect on customer requirements
• Effect on product or service conformity
• Regulatory consequences
• Existing controls
• Ability to detect a problem before it reaches the customer

A simple risk matrix may classify risks as low, medium or high. However, ISO 9001 does not require every organization to use one particular methodology. The method should help management make appropriate decisions.

5. Plan Actions to Address Risks

Once important risks have been identified, suitable action should be determined.

Possible actions include:

• Introducing additional process controls
• Providing training
• Increasing inspection
• Qualifying alternative suppliers
• Improving maintenance
• Automating process steps
• Reviewing procedures
• Adding approval stages
• Improving monitoring
• Establishing contingency arrangements

For example, if an organization relies on one supplier for a critical raw material, it may identify supplier disruption as a significant risk.

Possible actions could include qualifying a second supplier, maintaining appropriate stock levels or establishing contingency purchasing arrangements. The action should be proportionate to the potential impact.

Risks and Opportunities in ISO 9001:2026

Risk-based thinking should not focus only on preventing negative outcomes. Organizations should also consider opportunities that could improve performance.

ISO 9001:2026 places clearer emphasis on distinguishing risks from opportunities and encourages organizations to actively consider both during planning.

An opportunity may include:

• Automating a manual process
• Introducing improved equipment
• Developing employee competence
• Reducing process steps
• Improving supplier collaboration
• Using customer feedback to redesign a service
• Introducing digital monitoring
• Reducing inspection through better process control

For example, frequent customer complaints about delivery updates may represent a risk to customer satisfaction.

At the same time, implementing an automated tracking system could represent an opportunity to improve communication and customer experience. Risk and opportunity can therefore be considered together while still being treated as distinct concepts.

Examples of Risk-Based Thinking in ISO 9001

Consider the following practical examples.

The appropriate controls will depend on the organization and the potential consequences.

What Evidence Can Demonstrate Risk-Based Thinking?

During an audit, an organization may demonstrate risk-based thinking through different types of evidence.

Examples include:

• Process risk assessments
• Management-review discussions
• Internal audit results
• Quality objectives
• Supplier evaluations
• Corrective actions
• Meeting records
• Process controls
• Training records
• Performance indicators
• Customer complaints
• Improvement plans
• Change-management records

Quality objectives and performance indicators can help demonstrate whether actions taken to address risks are producing the intended results. Understanding the difference between quality objectives and KPIs helps organizations define the improvement they want to achieve and select suitable measures to track progress.

Auditors generally evaluate risk-based thinking as part of the overall management system rather than treating it as a completely separate activity. ISO/IAF auditing guidance has specifically explained that risk-based thinking should not be audited as an isolated standalone exercise.

Common Mistakes When Applying Risk-Based Thinking

Organizations sometimes make risk management unnecessarily complicated. Common mistakes include:

Creating a Risk Register Only for the Audit

A risk register that is completed once and never used provides little operational value. Risk information should influence decisions and process controls.

Listing Risks Without Taking Action

Identifying a risk is only the beginning. Where action is necessary, the organization should determine what will be done, who is responsible and how effectiveness will be evaluated.

Treating Every Risk as Equal

Minor administrative issues should not necessarily receive the same attention as risks that could cause significant product failure or customer harm. Controls should be proportionate.

Ignoring Opportunities

Risk-based thinking also supports improvement. Organizations should consider where changing a process could create better results, not simply where something may go wrong.

Keeping Risk Management Separate from Daily Operations

Risk-based thinking works best when it forms part of normal activities such as purchasing, production planning, management review, internal auditing and change management.

How Internal Audits Support Risk-Based Thinking

Internal audits can help determine whether identified risks are being controlled effectively. Rather than auditing every process with exactly the same frequency and depth, organizations can use risk information when developing the internal audit programme. Higher-risk processes may require greater attention.

For example, a process with repeated customer complaints, major operational changes or recurring nonconformities may justify more frequent auditing than a stable process with consistently effective controls.

Audit findings can then provide new information about risks and opportunities, creating a continuous improvement cycle.

Risk-Based Thinking and Continual Improvement

Risk-based thinking is closely connected with continual improvement. When organizations monitor processes, investigate nonconformities, analyse customer feedback and review performance, they gain information that can change their understanding of risk.

A process that appeared low-risk last year may become more important because of:

• New customer requirements
• New technology
• Supplier changes
• Increased production
• Regulatory changes
• Repeated complaints
• Organizational restructuring

Risk assessment should therefore not be treated as a one-time activity. It should evolve as the organization and its business environment change.

Final Thoughts

Risk-based thinking in ISO 9001 is fundamentally about making better decisions before problems affect quality or customers.

Organizations do not necessarily need complicated risk-management systems. They need a practical method for understanding uncertainty, prioritizing important risks, taking appropriate action and identifying opportunities for improvement.

ISO 9001:2026 continues this approach while providing greater clarity around the distinction between risks and opportunities.

When risk-based thinking is integrated into everyday processes rather than treated as an audit exercise, it can help organizations build a more effective, resilient and continually improving Quality Management System.

Frequently Asked Questions

What is risk-based thinking in ISO 9001?

Risk-based thinking is the process of considering uncertainties that could affect the Quality Management System and taking appropriate actions to address risks while also identifying opportunities for improvement.

Does ISO 9001 require a formal risk register?

ISO 9001 does not prescribe one specific risk-management method for every organization. The approach and level of documentation should be appropriate to the organization's context, processes and level of risk.

What is the difference between a risk and an opportunity?

A risk involves uncertainty that may affect intended results, while an opportunity represents circumstances that could lead to beneficial outcomes or improved performance. ISO 9001:2026 provides clearer distinction between the two concepts.

How often should ISO 9001 risks be reviewed?

Risks should be reviewed whenever relevant circumstances change and as part of ongoing QMS activities such as management review, process monitoring, internal audits, corrective action and organizational change.

Can internal audits identify new risks?

Yes. Internal audits can reveal weaknesses, recurring problems or changes in processes that may create new risks. Audit results can therefore be useful input for updating risk-based planning.