ISO 9001 does not mandate a formal risk methodology, but management needs a consistent basis for deciding what receives attention and funding. Paul walks through the probability and impact matrix, which separates critical, significant and tolerable risks.

Opportunities now carry equal weight with risks in ISO 9001:2026, and organisations must show a clear process for addressing them. Paul sets out the route from assessment to action: plan the actions, resources and timescales, integrate them into the process that owns them, build the controls into the QMS, and measure effectiveness through management review and internal audit.

In this part

Ranking risk by probability and impact
Types of opportunity: new markets and products, customer relationships, process and equipment improvement, partnerships and technology
Management review and internal audit as the controls
Assessing risk and opportunity before any change to the QMS
What good looks like: clear ownership, resources, a closed loop and periodic review

Complete lesson Take the exam