Our own servers in Europe · GDPR · Support in your language
English
Let's talk

Module 3 of 6 · ISO 9001:2026 · Block 3

Planning: risks, opportunities and changes

Clause 6.1 separates identifying risks and opportunities from the actions that address them, and 6.3 asks you to plan how the effectiveness of each change will be measured.

Content reviewed on

Risks and opportunities, separately

Clause 6.1 is reorganised into three: determining risks and opportunities (6.1.1), actions to address risks (6.1.2) and actions to address opportunities (6.1.3). The split makes visible something many systems neglected: an opportunity is not a risk with the sign reversed, and it deserves its own action.

The transition document describes the reorganisation but does not say that any particular methodology is required. A matrix is still good practice rather than a requirement, unless the standard says otherwise.

Changes that are planned and checked

Clause 6.3 stresses that changes must be implemented effectively to achieve their intended results, and adds three elements to planning: how the effectiveness of the change will be monitored and evaluated, how it will be communicated, and how its results will be reviewed.

Switching a critical supplier, opening a new line or reorganising a process is no longer just a decision in the minutes: it needs an indicator, communication and a follow-up review with a date.

What an auditor usually asks for

  • Risks and opportunities recorded separately, each with its own action
  • Most recent significant change to the system with a plan for monitoring its effectiveness
  • Change communicated to the people affected, with evidence
  • Follow-up review of the results of the change, with a date and conclusion

How to cover this block in Kimobox

  1. 1Record risks and opportunities in each process's matrix, with an owner, a rating and an action for each.
  2. 2When you plan a change, document the reason, the impact, the resources and the indicator you will use to judge whether it worked.
  3. 3Communicate the change to each user according to their role and schedule the results review with an automatic reminder.

A change with its indicator and review date already planned is the evidence clause 6.3 asks for.

See the risks and opportunities register template

Where each figure comes from

References to the official text in force. If a standard is revised, this page is updated and the review date says so.

  1. ISO 9001:2026 — Quality management systems. Requirements ISO · 2026 ed., published 16 September 2026
  2. ISO press release on the publication of ISO 9001:2026 ISO · 16 September 2026
  3. ISO/TC 176/SC 2: ISO 9001:2026 has been released ISO/TC 176/SC 2 · 28 September 2026
  4. Global ACI-TECH-3-TR 2029-09-30 (M), transition requirements for ISO 9001:2026 Global ACI (successor to IAF and ILAC) · Version 1.0, 4 September 2026
  5. IAF notice of cessation and transfer of its documents to Global ACI IAF · 1 January 2026
  6. ISO 9001:2015 — Quality management systems. Requirements (withdrawn) ISO · 2015 ed., with Amd 1:2024; withdrawn 16 September 2026
  7. ISO 9000:2015 — Fundamentals and vocabulary ISO · 2015 ed.
← Previous Leadership, quality culture and ethics Next → Support, operation and documented information