Risk management and risk analysis in ISO 9001
Risk management in ISO 9001 means thinking about what could go wrong in your organisation and taking measures in advance. The standard calls this risk-based thinking and sets it out in clause 6 of the requirements. You do not need to build a complicated risk matrix, but you must be able to show that you take risks seriously. The official standard has required this since ISO 9001:2015 , published by NEN (Netherlands Standardization Institute) .
Since 2015, risk-based thinking has replaced the separate requirement for “preventive actions”. The idea: preventing problems is better than correcting them afterwards.
What is risk-based thinking in ISO 9001?
Risk-based thinking is not a separate project. It is an attitude that runs through your whole system. With every decision, you ask: what could go wrong here, and what will we do about it? A risk is something that could have a negative effect. An opportunity is the opposite: something that could make your work better.
For example, an installation company notices that one supplier delivers 80% of its parts. That is a risk: if that supplier falls away, work stops. The measure is to qualify a second supplier. It can be that simple.
How do you make a risk analysis for ISO 9001?
A risk analysis does not need to be more than a clear table. What matters is that you keep it up to date and actually do something with it.
Collect risks and opportunities
Go through your most important processes. What could go wrong at each step? Involve your employees, because they see the practice best.
Estimate likelihood and impact
For each risk, state how likely it is (likelihood) and how serious the consequences would be (impact). A simple scale of low, medium and high is enough.
Decide on measures
For each risk, decide what you will do to limit it. For high likelihood and high impact, you deal with it first.
Evaluate and adjust
Discuss the risks in your management review and update the analysis when something changes.
Example ISO 9001 risk analysis (installation company)
Below is a worked example for an installation company with eight employees. This is exactly the kind of overview an auditor wants to see: concrete, with measures you actually carry out.
| Risk or opportunity | Likelihood | Impact | Measure |
|---|---|---|---|
| Main supplier falls away | Low | High | Qualify a second supplier and review it every year |
| Shortage of technical staff | High | High | In-house training programme and cooperation with a ROC (regional vocational education centre) |
| Fitter makes an installation error | Medium | High | Handover checklist and spot checks |
| Outdated planning software | Medium | Medium | Migration plan with budget and deadline |
| New market: heat pumps | Medium | High (opportunity) | Certify two fitters and start a pilot project |
Do not make a list of fifty risks that you never look at again. Ten risks that you really manage are better than a thick document that ends up in a drawer.
Difference between ISO 9001 and ISO 31000
People sometimes confuse risk-based thinking with formal risk management. These are two different things.
| ISO 9001 | ISO 31000 | |
|---|---|---|
| What is it? | Quality standard with risk-based thinking as part of it | Separate guideline that covers risk management in full |
| Certifiable? | Yes | No, it is a guideline |
| Depth of risk work | Practical, suited to your organisation | Extensive, cyclical framework |
You do not need to use ISO 31000 for ISO 9001. If you want to approach risk management more professionally, ISO 31000 can be a useful reference. It is not required.
Common mistakes in the risk analysis
- Too theoretical. An auditor will spot a risk analysis that does not relate to your real work straight away.
- Filled in once. Risks change. Update the analysis at least once a year.
- No measures. Naming a risk without an action does not help.
- Too much detail. Keep it manageable, or nobody will use it.
Next step
See how risks come back in the requirements of ISO 9001, or how the auditor assesses your risk analysis. A blank template is available in the resources. Still unsure about something? Read the frequently asked questions.