ISO 9001 planning, risks, opportunities and quality objectives

ISO 9001:2015 6.1 asks you to determine the risks and opportunities that could affect what you deliver and plan proportionate actions on them. Clause 6.2 asks for measurable quality objectives with a plan to reach each, and 6.3 for changes to the quality management system made in a planned way. The 2026 edition splits 6.1 into three sub-clauses.

The requirement in plain English

Risks and opportunities (ISO 9001:2015 6.1.1). Starting from your issues and interested parties’ requirements (ISO 9001:2015 4.1 and 4.2), you decide which risks and opportunities need action so that the system delivers what it should, good outcomes grow, bad ones shrink and the system improves.

Actions (ISO 9001:2015 6.1.2). You plan the actions, build them into your processes and decide how you will check they worked. Actions are proportionate to the possible effect on the conformity of your products and services. The standard asks for no formal risk method and no named record; the depth is yours to choose.

What the 2026 edition changes. Certification bodies, consultancies and the Chartered Quality Institute report three sub-clauses: determining risks and opportunities (ISO 9001:2026 6.1.1), actions on risks (ISO 9001:2026 6.1.2) and a new clause for actions on opportunities (ISO 9001:2026 6.1.3). Opportunities therefore need their own decisions, not a line at the bottom of the risk register.

Quality objectives (ISO 9001:2015 6.2). You set objectives for the relevant functions, levels and processes (6.2.1). Each fits the quality policy, can be measured, reflects the requirements that apply, matters to conformity or customer satisfaction, and is monitored, communicated and updated. They are kept as documented information. For each you plan what will be done, with what resources, by whom, by when, and how results will be judged (6.2.2).

Planning of changes (ISO 9001:2015 6.3). When the system needs to change, you plan it: why and with what consequences, how the system stays intact, whether resources are there, and who takes on which responsibility. The 2026 edition is reported to add communicating the change and checking afterwards whether it worked (ISO 9001:2026 6.3).

This is guidance to help you understand the requirement, not legal advice.

What good looks like

A 40-person firm that prints and finishes packaging for cosmetics brands keeps one risk register of about 20 rows. Each risk is scored for likelihood and effect on delivery or conformity on a three-point scale, with an owner and an action. The top risks are concrete: one press doing 60% of the work, colour-match complaints on a key brand, and a single board supplier.

Opportunities sit in their own list with their own decisions: a digital press for short runs, approval to bid for a pharmaceutical customer. Each has an owner, a business case and a review date, and the decision is recorded even when it is “not now”.

Four quality objectives run for the year: on-time-in-full delivery at 97%, colour-match complaints under three a quarter, first-proof approval at 95%, and every critical supplier re-evaluated by September. Each has an owner, a monthly figure and a short plan. The objectives and the register are reviewed at every management review (ISO 9001:2015 9.3.2).

When the firm replaces its job-planning system, it raises a change record before the switch: the reason, the risks to live orders, the data migration owner, staff training, a fallback plan and a date to check whether the change worked.

Evidence an auditor expects

Quality objectives and their plans (required documented information, 6.2.1): measurable targets, owners, dates and the latest figures.
Risks and opportunities with their actions: no named record, but the auditor asks how you determined them and samples a few to trace each action into a process.
Evidence actions worked: the auditor follows an action to its result and to the review that judged it.
Change records: usual evidence for 6.3, showing a significant change to the system was planned before it happened.
Interviews with process owners: the auditor asks what risks affect their process and what they do about them.

Common mistakes

A borrowed risk method

A company copies its ISO 27001 risk register, with confidentiality, integrity and availability scores, into its quality system. Quality risks are about conformity and customers. Score the effect on what you deliver.

Risks with no follow-through

Actions are listed but never checked. Clause 6.1.2 asks you to plan how you will evaluate them, and management review asks whether they worked. Give each action a review date and record the outcome.

Opportunities as an afterthought

The register has 30 risks and one opportunity, “grow the business”. The 2026 edition makes opportunities their own requirement. Name real ones and record a decision for each.

Objectives that cannot be measured

“Improve customer service” has no number, no date and no owner. Write the target, the measure and the deadline, and report the figure monthly.

Changes made on the fly

A reorganisation leaves two processes without owners until the next audit finds them. Plan changes to roles, processes and systems before they happen.

How Sted helps

For ISO 9001 clause 6 Sted’s knowledge base carries the Risk Management Procedure (PRC-RMP) with its Operating Risk Assessment Record (REC-ORAR) and Operating Opportunity Assessment Record (REC-OORA), and for planned changes the Change Management Policy (POL-CHG) and the Quality Policy (POL-QMP), with the Change Record (REC-CR).
Records are part of the Full Management System plan.
Management-system registers (scope, interested parties, obligations, issues, objectives, risks and opportunities, processes) are edited by administrators; the first three are drafted from your onboarding answers and the rest start empty.
Risk levels are computed from likelihood and impact.
The Risks and opportunities register holds each risk’s likelihood and impact before and after controls, the controls in place, whether it is above your risk appetite, its treatment plan, an owner and a last-reviewed date, and lists its inherent and residual levels.

Sted holds the registers and records and computes risk levels. It does not decide which risks matter or set your objectives; top management and process owners do.

Risk assessment guide: setting criteria, scoring risks and choosing actions, with an ISO 9001 example.
Context and leadership: the issues and interested parties planning starts from.
Support: the resources and competence the plans depend on.
Management-system registers: where risks, opportunities and objectives live in Sted.
ISO 9001: how planning fits the loop.

Frequently asked questions

Does ISO 9001 require a risk register?

No. ISO 9001:2015 asks you to determine risks and opportunities and plan proportionate actions, but it requires no formal method and no named record. A short register is still the easiest way to show the auditor what you decided, what you did and whether it worked.

How many quality objectives should we have?

The standard sets no number. Three to six that each tie to product conformity or customer satisfaction, with an owner, a target and a date, are easier to run and to evidence than twenty, and auditors look for monitoring and progress rather than volume.