ISO 9001:2026 Clause 6.1.2: Turn Quality Risks into Action

What clause 6.1.2 requires in practice

Clause 6.1.2 deals with risks that could have an undesired effect on the organisation's ability to provide conforming products and services consistently and to enhance customer satisfaction. The organisation determines, analyses and evaluates those risks, then plans two things: the actions it will take, and how it will fold those actions into QMS processes and judge whether they worked.

Proportion is the governing idea. Actions should match the potential impact on the intended results, so a minor irritation does not need the machinery that a threat to a critical service does. A first note in the clause adds that risks can include the ability to keep supplying during and after a disruption. A second note lists the responses open to the organisation: avoid the risk, accept it to pursue an opportunity, remove its source, change its likelihood or consequences, share it, or retain it by informed decision.

The outputs are evaluated risks, selected responses with owners, and a method for reviewing effectiveness. No scoring formula is required.

Describe the risk before selecting a score

Begin with the process, the uncertainty and the possible consequence for products, services or customer satisfaction. “Supplier risk” is too broad to guide a response. “An unconfirmed component substitution could fail the agreed performance requirement” tells the owner what needs examination and connects the issue to a control decision.

Analysis and evaluation should be suitable for the organisation's context. Consider the reliability of available information and the effectiveness of existing controls. A scoring method may help prioritise, but the standard does not prescribe one universal formula. A superficially precise number can conceal weak assumptions, especially when people assign scores without understanding the process.

Why managing quality risk matters to the business

Risk actions are the point at which planning protects revenue. A client who receives a wrong product, a late service or a data error rarely separates the cause from the supplier's name, so each failure costs trust as well as rework. Proportionate action avoids two expensive mistakes: ignoring a threat until it becomes an incident, and burying teams in controls for matters that hardly matter. Attention to continuity after a disruption also lets the organisation keep promises when conditions turn difficult. Finally, actions embedded in normal processes survive staff changes, which is what persuades auditors and customers that results are not accidental.

How to implement clause 6.1.2

Aim for decisions that process owners can carry out, rather than a scoring exercise held apart from the work. One way Sterling's teams do this is to give each process owner a short prompt sheet covering the questions above and to review the answers together, so that analysis reflects real operating knowledge. The clause requires the thinking and the planned actions; the format is the organisation's choice, and a score, a heat map or a plain narrative can all be acceptable if the response is sound and proportionate.

1. Take the risks selected under 6.1.1 and describe each one as process, uncertainty and consequence.
2. Analyse using the information you reliably have, including how well current controls already work.
3. Evaluate in a way suited to your context; any scale you use should be understood by the people applying it.
4. Pick a response from the options the standard lists, such as removing the source, reducing the consequence or accepting by informed decision.
5. Match the effort to the possible impact, and name an owner and a place in the process.
6. Include continuity in the analysis for processes that must keep running through disruption.
7. Define what you will observe to judge effectiveness, then review it and adjust.

Illustrative manufacturing example: a substitute component

Choose an action that fits the unwanted effect

Actions can differ with the risk and the organisation's circumstances. The important connection is between the expected effect, the chosen response and the process that will carry it out. Identify the responsible owner, resources and relevant interfaces. Where the decision accepts a remaining risk, make the reasoning understandable to people who will later review it.

Do not assume more inspection is always the best answer. Clarifying a requirement before acceptance, improving information quality or changing an unreliable handover may address the cause earlier. Equally, removing a check because it is inconvenient needs a reasoned review of the effect. The response should be proportionate to the potential impact on conformity.

Illustrative BPO example: an ambiguous escalation rule

A hypothetical BPO team processes customer cases under several service agreements. Agents use a common escalation rule, although one agreement requires a different approval. The risk analysis identifies the conditions in which a case could be resolved without the required authority, rather than blaming staff for not memorising every variation.

The team revises the decision aid, checks how agents select the relevant agreement and uses supervised practice on ambiguous cases. It then samples actual decisions over a suitable period. Useful evidence includes the approved rule, competence follow-up and whether the sampled cases reached the correct authority. A signed training attendance sheet alone would not establish that the risk action worked.

Evaluate effectiveness using the decision's purpose

Define the intended result when planning the action. If the problem is uncertain requirements at handover, assess the completeness and correct interpretation of those requirements. A reduction in recorded complaints may be relevant, but could also reflect a shorter observation period or a change in reporting. Use evidence that can distinguish the improvement from these alternative explanations.

Actions should be integrated into QMS processes and evaluated for effectiveness. A separate register can help coordination, but process owners must know which controls they actually operate. Review when assumptions change, new information emerges or the action fails to produce the intended result. Recurring failure may also require the corrective-action process.

Evidence and mistakes to avoid

Consider delivery during and after disruption

Relevant risks can include the ability to provide conforming products and services during a disruption and after normal work resumes. For example, an IT provider relying on a temporary external service should consider whether the substitute can meet the accepted requirements and whether restored work is checked before it is treated as normal. Consider the disruption scenarios that matter to the organisation and integrate proportionate actions into its processes. This is not a universal requirement for a separate business-continuity plan or a promise of uninterrupted service.