hello@sterling-grc.com +1 201 263 4443 New York ISO & GRC consulting in 60+ countries
SterlingInternational Consulting Talk to a consultantTalk to us
Clause 6.1.1ISO 9001:2026 · Plan for both quality risks and opportunities

ISO 9001 clause 6.1.1: determine what quality planning must address

ISO 9001:2026 clause 6.1.1 requires the organisation to determine risks and opportunities that need to be addressed when planning the QMS. It draws on the issues identified under clause 4.1 and the requirements considered under clause 4.2. The determination should support intended results, reduce undesired effects, enable improvement and enhance desired effects.

What clause 6.1.1 requires in practice

Clause 6.1.1 is the first step of planning for risks and opportunities. While planning the QMS, the organisation takes the issues from clause 4.1 and the requirements from clause 4.2 and decides which risks and opportunities need to be addressed. The decision is made for stated reasons, and four are given: to provide assurance that the QMS can reach its intended results, to prevent or lessen undesired effects, to achieve improvement, and to enhance effects the organisation wants.

Notice what the clause leaves out. It does not ask for every conceivable uncertainty to be listed, and it does not describe how to analyse or treat them; those parts follow in 6.1.2 and 6.1.3. The expected output is a reasoned selection of matters that need attention, each connected to an issue or requirement and to a result the QMS is meant to deliver. A selection that nobody can explain is weak, however long the list is.

Translate context into a specific planning question

A context review may identify labour-market pressure, a changing customer platform or a new service direction. Ask how that issue could influence conforming delivery or customer satisfaction. Avoid copying the issue into a register without explaining the effect. “Staffing” is not enough to distinguish a recruitment constraint from a loss of specialist knowledge.

Relevant interested-party requirements also provide a starting point. A new customer approval condition may expose a weak handover. A changed reporting expectation may create an opportunity to make information more useful. Determine which matters need to be addressed through the QMS, rather than treating every business aspiration as a quality-planning item.

ISO 9001 consulting & certification support

Get clause 6.1.1 right the first time — with a global leader in ISO 9001 implementation

A Sterling consultant works the requirement through with your team, links it to the rest of the system and carries it to certification readiness. Expert and experienced consultants, 8,100+ client engagements in 60+ countries.

Distinguish existing facts from uncertainty

An actual nonconformity needs an appropriate response. Its causes and wider implications may also reveal a future risk, but the two should not be confused. For example, a missed service commitment is an event already observed; the possibility that a similar dependency will cause further missed commitments is a planning concern.

Opportunities deserve an equally specific description. “Improve quality” states an aim but does not identify a practical possibility. Explain what could change, why the change may have a desired effect and which process or customer need is involved. Later evaluation can then examine whether the opportunity is worth pursuing.

Why choosing the right planning topics matters to the business

If the wrong things are chosen, everything after is wasted effort or misplaced comfort. A team that spends its energy on remote possibilities while a key customer's changing approval conditions go unnoticed will be surprised, and customers feel that surprise as late delivery or rework. A sharp determination step focuses scarce management time, makes later analysis cheaper because the subject is clear, and gives leaders a reason to say no to low-value ideas. It also gives an auditor early confidence that planning is rooted in the business and not borrowed from a generic list.

How to implement clause 6.1.1

Treat this as a short, repeatable conversation with each process owner, not a workshop that produces a catalogue. One way Sterling's teams run this is a half-hour review per process owner, with the context and interested-party outputs on the table, ending in a handful of agreed statements. The clause itself asks only that the determination is made and is reasoned. A register, a matrix or a software screen can hold the results, but none of them is required, and a shorter record that people actually use is better than an elaborate one.

  1. Gather the current outputs of the context review and the interested-party review.
  2. For each issue, ask how it could affect conforming delivery or customer satisfaction.
  3. Write the answer as a plain statement of cause, uncertainty and effect.
  4. Check whether the matter is an event already observed, which needs a normal correction, or a future possibility, which belongs in planning.
  5. Mark each matter as a risk, an opportunity or both, and note which intended result it touches.
  6. Drop items that do not need handling through the QMS, and record why in a short note.
  7. Pass the selected matters to the owners of 6.1.2 and 6.1.3 work.

Evidence an auditor expects for clause 6.1.1

The auditor is looking for a visible line from context to the chosen matters. Useful evidence includes: Because the determination is a decision, the strongest evidence is the reasoning behind it rather than the list itself. Expect the auditor to pick one matter and ask how it reached the planning stage, who proposed it and what changed as a result, so owners should be ready to talk it through.

  • records of planning discussions that cite the issues and requirements considered
  • statements of risks and opportunities that name the result they could affect
  • a trail showing how a changed customer condition or external trend led to a planning topic
  • interviews in which process owners explain why certain matters were included or set aside

Common nonconformities with clause 6.1.1

Typical findings concern a determination that is generic, detached or stale. Auditors raise these findings when the determination reads as copied, outdated or disconnected from how processes behave. They tend to test it by comparing the chosen matters against complaints, incidents and recent changes, and asking why anything obvious is missing.

  • The matters listed could belong to any organisation and are not tied to the context review.
  • Entries state an issue, such as staffing, with no effect on any result.
  • Past incidents are recorded as risks, so future possibilities are missed.
  • Interested-party requirements changed but the planning did not.
  • No one can say why items were selected or excluded.

Illustrative BPO example: a new customer population

Illustrative example 1

A hypothetical BPO provider wins a contract serving customers whose enquiries are more complex than those in its existing service. Context review identifies growth, but the planning discussion goes further: current routing rules may send difficult cases to agents without the required support.

Illustrative example 2

The team determines a risk concerning incomplete or inaccurate resolutions and an opportunity to introduce more effective specialist routing. It identifies the affected service outcomes and gathers information about expected case types. It has not yet proved the proposed routing method will work. That distinction allows the following risk and opportunity action reviews to test the relevant assumptions instead of approving a solution prematurely.

Automate™ on Effivity · included in every Sterling engagement

Keep clause 6.1.1 alive in Effivity

Record what you decided under clause 6.1.1, link it to the records and controls it affects, and let the review date trigger the next look. Effivity is the ISO & GRC software used in 50+ countries — and part of every Sterling ISO 9001 programme.

Illustrative construction example: repeated project interfaces

A hypothetical contractor reviews several projects and notices that late customer decisions about finishes repeatedly affect purchasing and installation sequencing. The issue is not simply “customers change their minds”; it concerns how decision deadlines, approvals and procurement lead times interact.

The contractor determines a risk of using incorrect information or making unsupported delivery commitments. It also identifies an opportunity to improve how customer decisions are scheduled and communicated. The planning record links both matters to the affected processes and intended results. Actual contractual rights and technical requirements still need project-specific review; the example does not assume the contractor can impose one timetable on every customer.

Use appropriate perspectives

People close to the work often understand dependencies that management summaries omit. Include suitable operational, commercial and technical knowledge when determining what needs attention. In a multi-site organisation, common issues may coexist with local customer or infrastructure conditions that deserve separate consideration.

The standard does not prescribe a workshop, a risk matrix or a fixed number of planning entries. Those methods can help, but their value depends on the quality of the information and reasoning. A concise, well-framed concern can be more useful than a long list that assigns every item the same vague consequence.

Make the determination usable for the next decision

At this stage, useful supporting information can identify the affected process, relevant requirement, expected result and known uncertainty. These are suggested ways to improve clarity, not mandatory register fields. The organisation should be able to explain the basis for its determination and how significant matters reach the people planning actions.

Common errors include treating the exercise as an annual brainstorming event, ignoring opportunities and recording only issues that already have easy solutions. Another is dismissing a concern because its likelihood cannot be calculated precisely. Recognise uncertainty accurately and seek the information necessary for a proportionate decision under risk actions or opportunity actions.

Frequently asked questions

Does clause 6.1.1 require a formal risk-management standard?

It does not prescribe one. The organisation needs an effective way to determine relevant risks and opportunities and fulfil the following action requirements.

Can a complaint reveal both a problem and an opportunity?

Yes. Address the actual issue appropriately, then consider wider risks and possibilities for improvement. Keep the purposes of those decisions clear.

Must every context issue become a risk entry?

No automatic one-to-one mapping is required. Determine what needs to be addressed based on its relevance to the QMS's intended results.

Frame the right questions before choosing controls

Sterling can facilitate a focused QMS planning review that connects context, requirements and process knowledge across sites. Employee learning and scoped Effivity ISO & GRC automation software can support the agreed approach; independent bodies decide certification.

Develop the team's analysis skills through Risk Management, and read the parent risk and opportunity guide for the complete planning sequence.

Source basis and reading note. This is original practical guidance for ISO 9001:2026. Use an authorised copy for definitive requirements. Illustrative examples describe hypothetical situations, not client results. Implementation methods are distinguished from requirements; independent bodies decide certification outcomes. Issuer standard record: iso.org.
Disclaimer. This guide is provided for general information only. It is not the text of the standard, not legal or professional advice, and not a representation of how any certification body will assess your organisation. Sterling International Consulting accepts no liability for any loss arising from reliance on it. Requirements are applied to each organisation's own context through an engagement; contact us to implement ISO 9001 in your organisation.