ISO 9001 Risk and Opportunity Management Procedure Template

A complete, editable ISO 9001:2026 risk and opportunity procedure covering Clauses 6.1.1, 6.1.2 and 6.1.3 — written as a finished working document with the judgment calls already made and annotated, not as an outline.

The 2026 edition asks for considerably more than the 2015 edition did, and the change is easy to read past. Clause 6.1.2 now requires the organization to determine, analyse and evaluate risks. Those middle two words are new. In 2015 the clause asked only that you plan. An assessment that produces a rating nobody can reproduce no longer satisfies the words on the page.

Risk and opportunity are now separate obligations

The 2026 edition splits them at determination and action (6.1.2 and 6.1.3), again at analysis (9.1.3 e) and f)), and again at management review (9.3.2 g) and h)). A register that carries opportunity as a column beside risk cannot satisfy six separate requirements from one entry.

The part that catches people is that each now carries its own test, and they are not the same question.

You do not need a second procedure

This is the question the revision has produced most often, and the answer is no. Clauses 6.1.2 and 6.1.3 are separate obligations. Neither says separate procedure, separate register or separate owner, and the published Annex states that risks and opportunities can be determined and addressed through separate processes — can, not must. A good deal of commentary is still quoting the draft, which put that more strongly than the published text does.

The separation the standard asks for is at the entry and at the test, not at the document. An opportunity recorded as a column beside a risk has one owner, one rating and one line, and cannot carry six separate requirements. An opportunity recorded as an entry in its own right can.

So this is one procedure and one register. Section 7.7 gives opportunity two routes in — arising from the treatment of a risk, and standing alone through the question asked at Section 7.4 — and both are recorded as entries in Appendix A rather than as an attachment to something that went wrong. The two then converge on one assessment and treatment spine. You keep the system you have and change how entries arrive and how they are judged.

The renumbering that quietly breaks checklists

The four ends at Clause 6.1.1 were reordered. In 2015, b) read "enhance desirable effects." In 2026, b) reads "prevent, or reduce, undesired effects," and the opportunity end moved to d). Anyone citing 6.1.1 b) for opportunity from memory is now citing the risk item. Section 15.0 maps every clause this procedure touches to the section that satisfies it, so the citations in your document are right whether or not you re-read the standard.

Two editions, because you are mid-transition

One purchase includes both.

• The clean edition — 44 pages, written to ISO 9001:2026 as though the 2015 edition never existed. This is the one you adopt.
• The transition edition — 48 pages, the same procedure with every change marked inline and a front block setting out what moved from 2015, clause by clause. This is the one you take to your registrar, your internal auditors and your management review to show the change was deliberate rather than accidental.

What is in it

• Seventeen numbered sections and five appendices, in the architecture used across every MSI procedure, so adopting one teaches your people how to read the next
• More than two hundred bracketed decisions — every one a choice the standard leaves to you, with the question stated rather than a blank to fill
• Fourteen MSI notes recording the pattern observed in practice at the point it matters, not the requirement restated
• Section 5.0 — setting risk criteria and defining significance, with severity and likelihood anchors written as described outcomes rather than adjectives, and the period over which likelihood is judged stated explicitly
• Section 7.0 — twelve procedure steps from trigger through to the release gate, including the opportunity route and the point at which effectiveness is judged
• Section 7.3 — climate change as a determined issue, carrying the Clause 4.1 question through to a recorded answer either way, because a nil determination is still a determination
• Section 10.0 — a process interaction map showing what feeds this procedure and what consumes from it, so the interfaces are visible rather than assumed
• Section 14.0 — a maturity ladder, ten elements with four levels each, described as observable behavior, including an explicit statement that Level 2 is a legitimate place to stop
• Section 15.0 — a clause cross-reference mapping each obligation to the section that satisfies it, built for the 2026 numbering
• Appendix A — the risk and opportunity register, built to work as the release gate rather than as a report about the work
• Appendix B — the treatment plan and effectiveness record
• Appendix C — a desk-level work instruction with worked examples, including a low-value case carrying high exposure
• Appendix E — a method selection and criteria-setting worksheet for the decisions you make once, before anyone scores anything
• Appendix F — quality culture and the ISO 9001 transition. Forward-looking MSI guidance on what culture looks like inside a risk process, stated plainly as guidance rather than as a conformity requirement

Specification

Who it is for

Quality managers and ISO consultants transitioning a certified system from ISO 9001:2015 to the 2026 edition, and organizations building a risk process for the first time. Particularly useful where the register was produced by one person, where opportunity exists as an empty column, and where the criteria behind the ratings live in somebody's head rather than in a controlled document.

Other options in this family

If this is not the right combination

Every variant covers one certification combination, so you buy the one document that matches your certificates rather than assembling it from singles.

• Device — ISO 9001 and ISO 13485 together — quality system risk and device product risk in one procedure, with the two registers kept apart and the divergences decided
• Q/EMS — ISO 9001 and ISO 14001:2026 — where quality risk and environmental aspects run through one assessment spine, and where the two standards no longer treat opportunity the same way
• IMS — ISO 9001, ISO 14001 and ISO 45001 — risk, aspects and hazards in one procedure, with worker participation built into the assessment rather than bolted on
• ISO 13485 only — device risk on ISO 14971, where there is no opportunity concept at all

The full documentation package

This procedure is one document in a wider system. If you are building or rebuilding the whole documentation set rather than filling a single gap, the packages below collect the procedures and guides, and work out considerably cheaper than buying them individually.

• ISO 9001 procedure templates and guides — the complete quality system documentation set — the direct match for this procedure
• ISO 9001 and ISO 13485 package — the combined set, for organizations certified to both
• ISO 9001, ISO 14001 and ISO 45001 package — the integrated management system set