Q/EMS Risk Management Procedure Template & Guide (ISO 9001 + ISO 14001)

A complete, editable risk and aspect identification procedure for an organization certified to, or transitioning to, both ISO 9001:2026 and ISO 14001:2026 — written as a finished working document, not an outline.

Most organizations holding both certificates run two identification exercises that never meet. Quality risk is discussed in a management meeting. Environmental aspects are found on a site walk. The two outputs live in two places, are rated on two scales nobody compares, and are reviewed on two cycles.

Combining them is not a matter of merging two spreadsheets, because the two exercises genuinely differ. Send the site-walk team to find quality risk and the quality column fills with housekeeping observations — a label peeling, a bin unlabeled — and the organization concludes its quality risk is low when it has simply not been looked for.

Two identification routes, one shared spine

This procedure runs Route A, observation of the work, for environmental aspects; and Route B, analysis of process performance, customer requirements, supplier behavior and nonconformity history, for quality risk. Both feed one shared assessment and treatment spine.

That is the integration, and it is real: one methodology, one threshold discipline, one action-tracking system, one review, one management review input. What is not integrated is the finding — because the finding genuinely differs.

Where the standards disagree, the decision is already made

ISO 14001:2026 is the stricter of the two almost everywhere the process itself is concerned. ISO 9001 requires the least at Clause 6.1 — no procedure, no criteria, no register — and contributes the obligation that makes the document necessary, at Clause 4.4.1 d): determined criteria and methods for the operation and control of every process. Risk identification is such a process.

Appendix D records sixteen divergences, each with what the two standards require, the position adopted as house standard, and the alternative rejected with its reasoning — followed by a sign-off table of decisions to confirm before adoption. It is the part a buyer cannot easily assemble alone, and it is what a certification body will ask about.

What is in it

• Section 2.0 — scope reconciliation first, location by location. The two exclusions are set by different tests and rarely land in the same place.
• Section 5.0 — Developing this process in your organization, covering both criteria sets, with a calibration exercise.
• Two distinct rating scales, deliberately different in length and wording so a rating cannot be transcribed between them by accident.
• Established significance criteria judged against the receptor an impact reaches, not against volume.
• The separate Clause 6.1.4 register the 2026 edition requires, reaching external conditions acting on the organization.
• Life cycle perspective across seven stages, with control and influence determined and recorded.
• Communication of significant aspects among levels and functions, with the audience table and the record.
• A quality risk register, kept even though ISO 9001 Clause 6.1 requires no documented information at all.
• The ISO 9001 proportionality test — actions proportionate to the potential impact on conformity, reasoned and recorded.
• Integration into QMS processes — every significant entry names the document its action changed.
• Combinations of entries — shared dependencies that no single rating captures.
• Figure 1 — process interaction map, required once ISO 9001 is in scope.
• Appendix A — the registers, kept apart and linked. Appendix B — action and effectiveness record. Appendix C — desk-level work instruction with worked examples.
• Appendix D — the integration decision record: sixteen divergences, sixteen decisions, one sign-off table.
• Appendix E — determination worksheet, including the two-assessor calibration exercise.

Specification

Who it is for

Quality and environmental managers, EHS leads carrying both systems, and consultants supporting dual-certified clients. Particularly useful for multi-site operations where the two scopes were never compared, for organizations transitioning to ISO 9001:2026 and ISO 14001:2026 inside their transition windows, and anywhere the aspects register is thorough and the quality risk register was written from memory of last year's problems.

Other options in this family

If this is not the right combination

Every variant covers one certification combination, so you buy the one document that matches your certificates rather than assembling it from singles.

• IMS — ISO 9001, ISO 14001 and ISO 45001 — if you also hold ISO 45001, take this instead; it carries the hierarchy of controls and worker participation, which this variant does not
• ISO 9001 only — quality management system risk alone
• ISO 14001:2026 only — environmental aspects alone

The full documentation package

This procedure is one document in a wider system. If you are building or rebuilding the whole documentation set rather than filling a single gap, the packages below collect the procedures and guides for each standard, and work out considerably cheaper than buying them individually.

• ISO 9001 and ISO 14001 package — the combined quality and environmental documentation set — the direct match for this procedure.

  There is an ISO 9001 + ISO 14001:2026 package; the integrated package below adds ISO 45001, or buy each standard's package separately. Each package collects every MSI procedure template and guide for its standard set in one purchase, at a package price:

• ISO 9001 procedure templates and guides — the full quality management system documentation set
• ISO 14001:2026 procedure templates and guides — the full environmental management system set, written to the 2026 edition
• ISO 9001, ISO 14001 and ISO 45001 package — the integrated set, if occupational health and safety is on your roadmap