ISO 9001 clause 6.1: plan for both quality risks and opportunities

What clause 6.1 requires in practice

Clause 6.1 asks the organisation to plan the QMS with its eyes open. When planning, it looks back at the issues found under clause 4.1 and the needs and expectations found under clause 4.2, then decides which risks and opportunities deserve attention. Four purposes sit behind that decision: giving confidence that the QMS can reach its intended results, preventing or reducing unwanted effects, achieving improvement, and strengthening desired effects.

The clause then splits into three connected parts. Subclause 6.1.1 is the determination step. Subclause 6.1.2 covers risks: they are determined, analysed and evaluated, and actions are planned in proportion to their possible impact. Subclause 6.1.3 covers opportunities in the same way, with actions that suit the organisation's context. For both, the plan must say how each action will be built into QMS processes and how its effectiveness will be judged.

The practical outputs are a justified set of planning topics, chosen actions that live inside everyday processes, and a way to see whether those actions worked. The clause does not require a formal risk methodology or a particular register.

Start with relevant issues and requirements

Planning should reflect the business, not a generic catalogue of every imaginable problem. Use the issues identified under 4.1 and requirements considered under 4.2 to understand what could affect consistent conformity and customer satisfaction. Consider changing conditions as well as current weaknesses.

An issue such as dependence on a specialist may give rise to a risk of delayed delivery. A new capability or partnership may create an opportunity to meet a customer need more effectively. The same development can involve both, but the organisation should understand each decision rather than treating the two labels as interchangeable.

Separate the action logic

Risk actions should be proportionate to their potential effect on the QMS's intended results. Evaluate the situation, decide a suitable response and integrate that response into the relevant process. A score can help compare concerns, but it is not itself an action or evidence that a control works.

Opportunity actions should fit the organisation's context and support desired results. Determine, analyse and evaluate the opportunity before committing resources. A fashionable technology or a supplier's sales claim does not become a sound opportunity simply because it appears innovative. Consider what would improve for the customer or the quality system and how that improvement could be tested.

Why risk and opportunity planning matters to the business

Most quality failures that reach a customer were visible earlier, as a dependency on one person, a weak supplier, a rushed change or an unexamined customer demand. Clause 6.1 turns that early sight into decisions made before money, reputation or a contract is lost. It also keeps improvement accurate: an opportunity is weighed against the same context and resources as any other commitment, so effort goes where customers will notice. For leaders, the clause gives a defensible answer to a simple question, namely why the organisation is spending effort on these matters and not others. For auditors, it shows that planning connects to real process results and is not a document written once and left alone.

How to implement clause 6.1

Keep the approach light enough that process owners will use it, and tie every output to a process or objective. One way Sterling's teams do this is a short planning conversation with each process owner during the annual planning round, repeated whenever the business changes direction. That keeps ownership with the people who run the work and stops the exercise becoming a paper task for the quality manager. Whatever route you choose, the clause requires the result, not a particular tool, so keep the method as simple as the organisation allows.

1. Collect the issues from clause 4.1 and the requirements from clause 4.2 as the starting input.
2. Ask each process owner which of those could upset the process result or open a better way of working.
3. Describe each matter specifically: the process, the uncertainty and the consequence for the product, service or customer.
4. Separate risks from opportunities so each follows its own route under 6.1.2 or 6.1.3.
5. Choose a response in proportion to the possible effect, and place it inside an existing process, procedure or objective.
6. Decide in advance how you will tell whether the response worked, and who will look.
7. Revisit the picture when context, customers or processes change, and bring the results to management review.

Evidence an auditor expects for clause 6.1

An auditor wants to see that the thinking happened and affected real work. Typical evidence includes: In a sample of processes, the auditor will often follow one planning matter from its origin in the context review through to the action and its later review, asking the owner to explain each step in their own words. Records support that conversation; they do not replace it, and no particular register is expected.

• records showing how issues and interested-party needs fed the planning decisions
• descriptions of risks and opportunities that name a process and a consequence
• actions visible inside process controls, objectives or project plans
• results of checking whether actions worked, and any follow-up taken
• interviews with process owners who can explain why their priorities were chosen

Common nonconformities with clause 6.1

Findings usually arise where planning exists on paper but not in the work. Auditors raise these findings when they cannot connect the planning to the daily operation of a process, or when the same recurring problem appears in complaints but was never recognised as a planning matter. The clause does not demand perfection, but it does expect visible, reasoned planning that the organisation can explain.

• Opportunities are never considered, or are simply labelled as positive risks.
• Risks are described in broad words such as supplier risk, so no owner can act on them.
• Actions are listed but cannot be found in any process or plan.
• Nobody checked whether earlier actions had any effect.
• The planning was done once and ignored changes in customers, technology or the organisation.

Illustrative IT example: continuity and a better service model

Illustrative manufacturing example: improving inspection flow

A hypothetical manufacturer experiences a queue before final inspection. It analyses the risk that rushed decisions or delayed dispatch could follow. Its immediate actions clarify scheduling and protect required acceptance checks, with review of incomplete inspections and delivery performance.

Separately, the team evaluates an opportunity to move a suitable check earlier in the process. It examines whether earlier detection would reduce rework and whether the changed method remains technically appropriate. Competent review, a controlled trial and comparison of relevant results support the decision. The example does not assume that earlier inspection is always better or that the new method can replace all final checks.

Integrate actions and evaluate effectiveness

For both risks and opportunities, the organisation must plan how actions enter QMS processes and how their effectiveness will be evaluated. Assigning an owner and a deadline may help, but also identify the process that changes and the result expected. The team needs a basis for recognising success, failure or an unintended effect.

Evaluation should be proportionate. A small workflow adjustment may need observation and a targeted sample; a significant change may require a more extensive assessment. Do not invent a universal scoring method, software platform or review interval as an ISO requirement. The organisation remains responsible for choosing arrangements that meet the actual need.

Keep planning alive as circumstances change

Useful evidence may include the reasoning, action decisions, changed operating arrangements and evaluation results. Clause 6.1 does not prescribe a named risk register or opportunity register. Other documented-information requirements and the organisation's need for reliable evidence still matter.

Common failures include assigning every risk the same action, labelling normal activities as opportunities without an intended benefit and closing actions when a document is issued. Another is allowing planning to remain separate from operational owners. Follow one significant action into the process and ask whether the expected result is visible.

Explore each numbered part