Templates and records · ISO 9001 · Clause 6.1

ISO 9001 risks and opportunities register: template

The standard requires you to think about risks and act accordingly, but does not say how to put it in writing. A register is the most widespread way of showing that the analysis exists and has consequences.

In one sentence

The risks and opportunities register is not a record ISO 9001 requires in itself, but it is the usual way of demonstrating what clause 6.1 does require: identifying risks and opportunities from the context and interested parties, planning actions proportionate to their impact and evaluating whether those actions have been effective.

Content reviewed on 17 October 2026

Where the standard requires it: ISO 9001 · Clause 6.1 Clauses are cited using the numbering of the 2015 edition, the same one the Academy uses; certificates issued against it remain valid during the transition to the 2026 edition.
Type of information: Good practice Clause 6.1 (6.1.1 to 6.1.3 in the 2026 edition) requires the analysis and the actions, not a specific document
Who fills it in: Process owners Quality coordinates, and top management validates the main risks and opportunities
When: At planning and whenever there are changes It is revisited at management review and whenever recurring nonconformities appear
How long it is kept: Current version, with its history As a living document, it is useful to keep earlier versions to see how it has evolved

What the standard requires

What ISO 9001 demands and what it leaves to your judgement

When planning the system, you must consider the issues in the context (4.1) and the requirements of interested parties (4.2) and determine which risks and opportunities need to be addressed to assure results, enhance desirable effects, reduce undesired ones and achieve improvement.

You must then plan the actions, integrate them into the processes and evaluate their effectiveness. They must be proportionate to the potential impact on the conformity of products and services.

The standard does not require a formal risk management method or a specific record. In practice, the auditor asks to see the analysis and how it connects with the actions, and a register is the most direct way to show it.

In the 2026 edition, according to the Global ACI transition document, clause 6.1 is split into three: determining risks and opportunities (6.1.1), actions to address risks (6.1.2) and actions to address opportunities (6.1.3). This template cites the 2015 numbering; keeping risk rows and opportunity rows separate in the register, each with its own action, makes the mapping easier.

Read it in context: Planning, in the ISO 9001 Academy

Structure

Fields the template should include

Process affected
Risk or opportunity, and its source (context issue or interested party)
Likelihood and impact on a defined scale
Resulting level and the criterion for when action is required
Planned action, owner and deadline, separate for risks and for opportunities (6.1.2 and 6.1.3 in the 2026 edition)
Indicator or means of evaluating effectiveness
Result of the evaluation and new level
Date of the last review

Example

Example: two rows from the purchasing process register

Company, people and figures are fictitious: the example only shows what a properly completed record looks like.

Field	Content
Risk	Dependence on a single supplier of printed cardboard
Source	External context: supply pressures in the sector in 2025
Rating	Likelihood 3 · impact 4 · level 12 out of 16 (act from 9)
Action	Approve a second supplier · purchasing · 31 March 2026
Effectiveness	Second supplier approved in March; level revised to 6
Opportunity	The new pharmaceutical customer values batch traceability
Source	Interested party: customer requirements
Action	Extend batch traceability to the whole range · operations · 30 April

At the audit

Mistakes auditors commonly flag

A register drawn up once for certification and never reviewed.
Generic risks unrelated to the processes ("economic crisis").
High-level risks with no action and no justification for accepting them.
Risks only: opportunities do not appear.
No link to recurring nonconformities or to changes in context.

In Kimobox

How this record is kept in Kimobox

1Risks and opportunities are recorded by process, with an owner, likelihood, impact and associated action.
2Each action has a mitigation plan and follow-up, like any other task in the system.
3Recurring nonconformities automatically become an input to the risk map.
4The effectiveness of actions reaches management review without preparing a separate report.

Frequently asked questions

What people ask us before getting started

Is a risk register mandatory under ISO 9001?

Not as a document. Clause 6.1 requires you to determine risks and opportunities, plan actions and evaluate their effectiveness, and management review must analyse that effectiveness. A register is the most practical way to demonstrate it, but not the only one.

Does the register change with ISO 9001:2026?

Clause 6.1 is divided into three subclauses: determination, actions to address risks and actions to address opportunities. According to the Global ACI transition document it is a reorganisation; if your register already treats opportunities with their own actions, it is enough to review each row's clause reference against the text of the standard.

Do we have to follow ISO 31000?

No. ISO 9001 does not require any formal risk management method. A well-done SWOT, a likelihood and impact matrix or a process-by-process analysis are equally valid if they lead to actions.

What happened to preventive action?

Since the 2015 edition there has been no separate preventive action requirement: risk-based thinking replaces it, so prevention is planned in clause 6 rather than handled case by case.

Keep your ISO 9001 records without loose templates

We'll show you the module running with data similar to yours.

Request a demo

Keep exploring

Sources

Where each figure comes from

References to the official text in force. If a standard is revised, this page is updated and the review date says so.

ISO 9001:2015 — Quality management systems. Requirements ISO · 2015 ed., with Amd 1:2024
ISO 9001:2026 — Quality management systems. Requirements ISO · 2026 ed., published 16 September 2026
Global ACI-TECH-3-TR 2029-09-30 (M), transition requirements for ISO 9001:2026 Global ACI (successor to IAF and ILAC) · Version 1.0, 4 September 2026