Turn Clause 6.1 into a working process — not a register nobody reads
Most risk registers fail the same way: the method lives in someone’s head, so three people score three comparable exposures three different ways. ISO 9001:2026 now asks you to analyze and evaluate risks, and separately opportunities, against criteria. This QuickStart lists the decisions that make that possible, in the order that lets each one build on the last.
Six pages, twenty-eight decisions, five stages.
Name the owners and the boundaries. Set the criteria. Set the routes in. Set the response. Set the rhythm and the records. Each stage depends on the one before it, and skipping ahead is the usual reason a half-finished system has to be redone.
What it is
A route through the
ISO 9001 Risk and Opportunity Management procedure — not a replacement for it. Every decision carries the section of the procedure where it is explained, so you read the reasoning before you decide rather than guessing and correcting later.It also carries two things that stand on their own:
- What “risk” means in a standard, against what it means in a boardroom. A side-by-side comparison — what risk is, how it is judged, where opportunity sits, what done looks like, who owns it and when it is looked at — because the gap between the two is where most findings in this area come from.
- What changed in the 2026 edition. ISO 9001:2026, published 16 September 2026, splits Clause 6.1 into three subclauses and requires risks, and separately opportunities, to be determined, analyzed and evaluated. The criteria-and-methods requirement is now 4.4.1 d), and risk and opportunity separate again at 9.1.3 and 9.3.2. Moving from a 2015 process is re-citing and separating, not rebuilding.
The five stages
01 · Name the owners and the boundaries
Nothing is rated until someone owns it and everyone agrees what it covers. The document owner, the process owners who carry each exposure, and the scope the register serves.
02 · Set the criteria
This is the stage that decides whether the procedure works: anchors written as outcomes, a stated horizon, and a threshold that obliges action. Clauses 6.1.2 and 6.1.3 of ISO 9001:2026 now ask you to analyze and evaluate against exactly these.
03 · Set the routes in
How entries reach the register, and how opportunities reach it separately. A register only knows what its routes bring it.
04 · Set the response
What happens to an entry once it is rated. The test is not whether an action was recorded. It is whether a process changed.
05 · Set the rhythm and the records
When the register is looked at again, what triggers it, and what exists afterward. The 2026 edition asks for records to be available, not merely retained.
Questions
Is this the procedure?
No. It is six pages that route you through a forty-four-page procedure. It lists the decisions and points at the section where each is explained; it does not contain the explanation, the worked examples, the MSI notes or the registers. Adopting a risk process from this sheet alone would leave obligations unmet.
Then why buy it separately?
Most people should not. It is included free with the
ISO 9001 Risk and Opportunity Management procedure, and that is the better purchase. This standalone exists for the narrower case: you already have a risk procedure of your own and want the decision order, or you are scoping the work before committing budget.
Does it apply to the 2015 edition?
The stages and the decision order do. The clause references and section numbers are ISO 9001:2026. If you are still certified to ISO 9001:2015, the procedure purchase includes a Transition edition marking every change, which is the more useful document for that situation.
What format is it?
Editable Microsoft Word (.docx).
Can you help us implement it?
Yes. Call MSI at
760-434-9141 to schedule a planning session.
