One risk process for two standards — decided once, holding for both
Most organizations holding both certificates run two identification exercises that never meet: quality risk in a meeting, environmental aspects on a site walk, rated on two scales nobody compares. This QuickStart lists the decisions that put both on one shared spine, in the order that lets each one build on the last.
Six pages, twenty-nine decisions, five stages.
Name the owners and the boundaries. Set the criteria. Set the routes in. Set the response. Set the rhythm and the records. Each stage depends on the one before it, and skipping ahead is the usual reason a half-finished system has to be redone.
What it is
A route through the
Q/EMS Risk Management procedure — not a replacement for it. Every decision carries the section of the procedure where it is explained, so you read the reasoning before you decide rather than guessing and correcting later.It also carries two things that stand on their own:
- What “risk” means in a standard, against what it means in a boardroom. A side-by-side comparison — what risk is, how it is judged, where opportunity sits, what done looks like, who owns it and when it is looked at — because the gap between the two is where most findings in this area come from.
- What changed in the 2026 editions. Both standards are now current editions: ISO 9001:2026 published 16 September 2026 and ISO 14001:2026 on 15 April 2026. ISO 9001 splits Clause 6.1 into three subclauses with risks and opportunities each analyzed and evaluated. ISO 14001 makes environmental conditions, including climate change, an issue at 4.1, makes risks and opportunities a separate output at 6.1.4, and requires options to be considered at 6.1.5. The two treat climate change differently — the procedure takes the stricter ISO 14001 treatment for both.
The five stages
01 · Name the owners and the boundaries
Nothing is rated until someone owns it and both scopes are reconciled. The two exclusions are set by different tests and rarely land in the same place.
02 · Set the criteria
This is the stage that decides whether the procedure works: anchors written as outcomes, a stated horizon, and a threshold that obliges action. Clauses 6.1.2 and 6.1.3 of ISO 9001:2026 now ask you to analyze and evaluate against exactly these.
03 · Set the routes in
How entries reach the register, and how opportunities reach it separately. A register only knows what its routes bring it.
04 · Set the response
What happens to an entry once it is rated. The test is not whether an action was recorded. It is whether a process changed.
05 · Set the rhythm and the records
When the register is looked at again, what triggers it, and what exists afterward. The 2026 edition asks for records to be available, not merely retained.
Questions
Is this the procedure?
No. It is six pages that route you through a sixty-six-page procedure. It lists the decisions and points at the section where each is explained; it does not contain the explanation, the worked examples, the MSI notes or the registers. Adopting a risk process from this sheet alone would leave obligations unmet.
Then why buy it separately?
Most people should not. It is included free with the
Q/EMS Risk Management procedure, and that is the better purchase. This standalone exists for the narrower case: you already have a risk procedure of your own and want the decision order, or you are scoping the work before committing budget.
Does it apply to the 2015 edition?
The stages and the decision order do. The clause references and section numbers are ISO 9001:2026 and ISO 14001:2026. If you are still certified to ISO 9001:2015, the procedure purchase includes a Transition edition marking every change, which is the more useful document for that situation.
What format is it?
Editable Microsoft Word (.docx).
Can you help us implement it?
Yes. Call MSI at
760-434-9141 to schedule a planning session.
