ISO 9001 clause 6: turn risks, opportunities and objectives into action
ISO 9001:2026 clause 6 turns the organisation's context into plans for dependable quality outcomes. It covers risks and opportunities, measurable quality objectives and controlled QMS change. A completed planning worksheet is useful only when the decisions affect processes and the organisation checks whether the actions worked.
What clause 6 requires in practice
Clause 6 turns context into plans and has three parts. Clause 6.1 covers risks and opportunities. Under 6.1.1 the organisation looks at the issues and requirements from clause 4 and decides which risks and opportunities need attention to give assurance of results, prevent or reduce undesired effects, achieve improvement and enhance desired effects. Under 6.1.2 it analyses and evaluates risks to conformity and satisfaction, plans proportionate action, builds it into the system's processes and evaluates whether it worked. Under 6.1.3 it does the same for opportunities, with actions appropriate to its context.
Clause 6.2 requires measurable quality objectives, consistent with the policy and monitored, communicated, updated and available as documented information, with a plan stating what, with which resources, by whom, by when and how results are judged. Clause 6.3 requires changes to the system to be made in a planned way, considering purpose, integrity, resources, responsibilities, communication and review.
6.1.1: identify what needs attention in this QMS
Begin with the relevant issues and interested-party requirements established under clause 4. Ask what could affect consistent conformity, customer satisfaction and the intended results of the system. The discussion should identify both unwanted effects to prevent or reduce and beneficial results worth pursuing.
For a hypothetical distributor, a supplier's unstable lead times can threaten delivery commitments. The same review might reveal an opportunity to improve demand visibility with a major customer. These are related business circumstances, but the proposed decisions are different. Naming both makes it easier to decide what each action should achieve.
6.1.2: analyse risks and integrate proportionate action
The organisation determines, analyses and evaluates risks that could adversely affect its ability to provide conforming products and services consistently and improve customer satisfaction. It plans action, incorporates that action into QMS processes and evaluates effectiveness. The response needs to be proportionate to the potential impact.
A numerical matrix can support the discussion, but it should not replace judgement about the consequence or the reliability of existing controls. A low historical frequency may not be reassuring when a single failure would undermine a critical customer commitment. Equally, a minor and well-controlled uncertainty does not automatically justify an elaborate project.
In the distributor example, the team could review alternative sourcing and change the order-acceptance check for affected items. The action becomes part of purchasing and customer communication, with named responsibility. Its effectiveness might be evaluated using agreed delivery evidence and review of exceptions. Recording “monitor supplier” without defining the activity leaves the decision incomplete.
6.1.3: evaluate opportunities as real proposals
Opportunities require their own analysis, evaluation and planned action. The question is how a proposed change could improve consistent conformity or customer satisfaction, whether it fits the organisation's context and how its effect will be assessed. It is not necessary to treat every attractive idea as a commitment.
The distributor might pilot a shared demand forecast with one customer. Before proceeding, it considers data reliability, the customer's willingness to participate, staff capacity and the process changes required. A review can then compare the intended benefit with what actually happened. The opportunity is pursued through a controlled decision, rather than entered into a register and forgotten.
6.2: make objectives measurable and achievable
Quality objectives belong at relevant functions, levels and processes. They must fit the policy, take account of applicable requirements and matter to conformity or customer satisfaction. The standard also requires them to be monitored, communicated, updated appropriately and available as documented information.
Define what will be done, who is responsible, what resources are needed, when it will be completed and how results will be evaluated. “Improve delivery” is too vague to guide a team. A useful objective explains the relevant delivery outcome and measurement basis, while its plan explains the work required. Avoid choosing a target that rewards quick dispatch at the expense of complete or conforming orders.
6.3: plan the consequences of QMS changes
The 2026 change provisions address purpose and consequences, system integrity, resources and information, responsibilities, communication, monitoring, evaluation and review of results. This is broader than recording permission to change a document. Consider what must remain dependable while the change is introduced.
For illustration, moving order review into a new platform can affect approval authority, access to specifications and the handling of exceptions. A proportionate change plan identifies those dependencies, prepares users and checks operation after the move. The team should also decide how it will recognise a problem and obtain an authorised response rather than discovering the gap during a customer failure.
Why planning for risks and objectives matters
Without planning, a business reacts to problems one at a time and misses chances to improve. Considering risks and opportunities deliberately focuses effort where a failure would hurt customers most and where a change could create real advantage. Measurable objectives give teams something to aim at and give leaders evidence of progress. Planned change protects delivery when the organisation adopts new systems, reorganises or enters new markets, because effects on other processes are examined first. The commercial result is fewer surprises and a clearer link between management attention and customer results. Weak planning tends to show as objectives nobody tracks or changes that quietly break an existing control.
How to implement clause 6
Use the outputs of clause 4 as the starting point and keep the planning tied to real processes. Planning sheets are optional, so the standard measures you by the quality of decisions and follow-through. Revisit the plan whenever results or circumstances change.
- Take the recorded issues and interested-party requirements and ask what could affect conformity and satisfaction, and what could improve them.
- Separate risks from opportunities, because the actions they call for are different.
- Judge risks by consequence as well as likelihood, and choose actions proportionate to the potential impact.
- Build each action into a process with an owner, then decide how its effectiveness will be judged.
- Set objectives that follow from the policy, are measurable and sit at the functions and processes where results are produced.
- For each objective, agree the actions, resources, responsibilities, timing and method of evaluation.
- Before changing the system, consider purpose, consequences, resources, roles and communication, and review the outcome afterwards.
Evidence and common planning mistakes
The quality objectives are explicitly documented. The clause does not prescribe a universal risk-register format or scoring formula. Useful evidence may include evaluated proposals, process changes, responsibility records and reviews of action effectiveness. An auditor can follow a selected risk or opportunity into the operating process and ask what the action changed.
Common weaknesses include treating every opportunity as a reversed risk score, confusing action completion with effectiveness, and setting objectives without resources. Another is changing the measurement definition midway through an objective without making the effect visible. Preserve enough context for a reviewer to distinguish better performance from a different method of counting it.
Explore each numbered part
6.1 · plan for both quality risks and opportunities
ISO 9001:2026 gives risk actions and opportunity actions separate attention. This guide explains the relationship between determining what matters, addressing undesired effects and pursuing beneficial results. IT and manufacturing examples show how planning enters operational processes, how teams judge effectiveness and why an opportunity should not be recorded merely as a positive-looking risk score.
6.2 · turn quality objectives into managed work
Quality objectives connect policy with results the organisation can pursue and evaluate. This guide brings together objective setting and delivery planning under clause 6.2. IT and construction examples show how to choose a useful measure, avoid conflicting incentives and define the actions, resources and review needed before a target becomes more than a dashboard entry.
6.3 · plan QMS changes without losing control
Changes to a quality system can disrupt the controls they are meant to improve. This guide explains clause 6.3, including purpose, consequences, system integrity, resources, authority, communication and review. BPO and manufacturing examples show how to protect important interfaces during transition and evaluate whether the changed arrangement delivers the intended result.
Illustrative example: planning in an automotive parts maker
A hypothetical automotive parts maker in Japan supplies brackets to vehicle assemblers. Its review of issues shows dependence on one coating provider whose lead times vary. The team treats that as a risk to delivery, evaluates the consequence of a late batch as high, and adds a second approved source and a changed order-acceptance check for affected parts. The same discussion reveals an opportunity: a customer would welcome earlier sight of forecast volumes, so the company agrees to share a rolling forecast and measures whether schedule changes fall. A quality objective on on-time delivery is set for the dispatch process, with a named owner and a monthly review. When the company plans a new scheduling system, it checks which controls rely on the old one before going live. The example shows the sequence of the clause, not a required method.
Frequently asked questions
Must every risk be eliminated?
No. Responses are proportionate and can differ. The organisation needs an informed decision, suitable action where needed and evaluation of the result, not a claim that uncertainty has disappeared.
Is every improvement idea an objective?
No. Some actions belong within routine process management. Use formal objectives where they help direct relevant effort and evaluate progress, while maintaining control of other agreed actions.
How should a QMS change be reviewed after introduction?
Compare its actual effects with the intended result, including consequences for process interfaces, information and responsibilities. Use that review to adjust the arrangement where needed.
Make the plan operational
Sterling can coordinate planning across sites so shared risks receive an accountable response and local circumstances remain visible. Agreed Effivity ISO & GRC automation software and employee learning can support implementation. The independent certification body makes its own certification decision.
Sterling can help connect QMS planning with process ownership and evidence. Enrol in Risk Management or KPIs, Objectives & Management Review for related practical learning. Dedicated ISO 9001 QMS courses are coming soon; enquire about the planned learning levels.
Go back to clause 5 leadership, use the QMS requirements overview, or continue to clause 7 support.
For a closer implementation discussion, read risk actions under the 2026 edition.