News
ISO 9001:2026 Part 3: Risks and Opportunities Are Now Treated Separately
Clause 6.1 is being split: risks and opportunities each get their own subclause. Why this often reveals an imbalance in practice – and what companies should do now.
Clause 6.1 is being split: risks and opportunities each get their own subclause. Why this often reveals an imbalance in practice – and what companies should do now.
Part 1 of this series looked at top management's responsibility, part 2 at the context of the organization. According to ISO 9001, companies derive risks and opportunities from this context, and this is exactly where the 2026 revision makes one of its most fundamental changes: risks and opportunities will in future be treated as two separate topics instead of one.
At a glance
Since the 2015 revision, ISO 9001 has required companies to think ahead: What could go wrong, and what could be done beforehand to prevent it? What could turn out to be an advantage, and how can it be used deliberately? Until now, both questions were usually addressed in one breath, often using one and the same SWOT table.
The previously joint treatment of risks and opportunities in clause 6.1 is being split up: risks get their own subclause with 6.1.2, opportunities another with 6.1.3. The reasoning: opportunities are no longer meant to be considered merely as the flip side of risks, but identified and pursued in their own right.
The two topics pursue different goals. Risk management is meant to prevent negative deviations and safeguard stability and conformity. Opportunity management is meant to proactively identify growth potential and foster innovation and efficiency.
In practice, this means separate methods instead of one shared SWOT analysis, for example FMEA for the risk side and other analytical approaches for the opportunity side. Separate metrics to measure risk control and opportunity realization independently of each other. And a management review that assesses both areas in their own right, rather than ticking them off in a single shared line.
Not everyone sees this separation as a gain. Proponents argue that it finally gives opportunities the same standing as risks, instead of remaining in the shadow of risk considerations. Critics see it as additional documentation effort for something the definition of risk in ISO 9000 already covered anyway, namely the effect of uncertainty, whether positive or negative.
At many companies I work with, there is a risk-and-opportunity register, usually an Excel list with two columns. The risk column is well maintained, often fed directly from FMEAs or complaint data. The opportunity column, by contrast, often feels like a box-ticking exercise: a few keywords, added once a year, without anything really being followed up on.
This is exactly the imbalance the new structure is meant to make visible and fix.
This is exactly the imbalance the new structure is meant to make visible and fix.
Here, too, three steps are worth taking already now, shortly after publication.
With QualiTEx Global, I support companies in building risk and opportunity management so that both sides are genuinely put into practice, not just the risk side.
Let's discuss, without obligation, what this development means for your company.