Three standards, one risk process — with every decision made once
An organization certified to all three standards runs one management system on paper and, almost always, three identification exercises in practice. This QuickStart lists the decisions that bring quality risk, environmental aspects and OH&S hazards onto one shared spine, in the order that lets each one build on the last.
Six pages, thirty decisions, five stages.
Name the owners and the boundaries. Set the criteria. Set the routes in. Set the response. Set the rhythm and the records. Each stage depends on the one before it, and skipping ahead is the usual reason a half-finished system has to be redone.
What it is
A route through the
IMS Risk Management procedure — not a replacement for it. Every decision carries the section of the procedure where it is explained, so you read the reasoning before you decide rather than guessing and correcting later.It also carries two things that stand on their own:
- What “risk” means in a standard, against what it means in a boardroom. A side-by-side comparison — what risk is, how it is judged, where opportunity sits, what done looks like, who owns it and when it is looked at — because the gap between the two is where most findings in this area come from.
- What changed in the 2026 editions. Two of the three standards are 2026 editions: ISO 9001:2026 published 16 September 2026 and ISO 14001:2026 on 15 April 2026. ISO 45001:2018 did not move, so nothing in your safety scope changes. ISO 9001 splits Clause 6.1 into three subclauses; ISO 14001 adds environmental conditions at 4.1, a separate risks-and-opportunities output at 6.1.4 and options at 6.1.5. Where one certification body holds all three certificates, ask whether the two transitions can be assessed together.
The five stages
01 · Name the owners and the boundaries
Nothing is rated until someone owns it and all three scopes are reconciled. ISO 45001 allows none of the exclusions the other two permit, so the mismatches are predictable.
02 · Set the criteria
This is the stage that decides whether the procedure works: anchors written as outcomes, a stated horizon, and a threshold that obliges action. Clauses 6.1.2 and 6.1.3 of ISO 9001:2026 now ask you to analyze and evaluate against exactly these.
03 · Set the routes in
How entries reach the register, and how opportunities reach it separately. A register only knows what its routes bring it.
04 · Set the response
What happens to an entry once it is rated. The test is not whether an action was recorded. It is whether a process changed.
05 · Set the rhythm and the records
When the register is looked at again, what triggers it, and what exists afterward. The 2026 edition asks for records to be available, not merely retained.
Questions
Is this the procedure?
No. It is six pages that route you through an eighty-nine-page procedure. It lists the decisions and points at the section where each is explained; it does not contain the explanation, the worked examples, the MSI notes or the registers. Adopting a risk process from this sheet alone would leave obligations unmet.
Then why buy it separately?
Most people should not. It is included free with the
IMS Risk Management procedure, and that is the better purchase. This standalone exists for the narrower case: you already have a risk procedure of your own and want the decision order, or you are scoping the work before committing budget.
Does it apply to the 2015 edition?
The stages and the decision order do. The clause references and section numbers are ISO 9001:2026, ISO 14001:2026 and ISO 45001:2018. If you are still certified to ISO 9001:2015, the procedure purchase includes a Transition edition marking every change, which is the more useful document for that situation.
What format is it?
Editable Microsoft Word (.docx).
Can you help us implement it?
Yes. Call MSI at
760-434-9141 to schedule a planning session.
