Risks and opportunities under ISO 9001:2026 (6.1.2, 6.1.3): rebuilding the register

Written from the ISO 9001:2026 standard (sixth edition, published 16 September 2026). Reviewed by Kaushal Sutaria, Lead Auditor, Sterling International Consulting.

A risk register built for ISO 9001:2015 will usually not show what an ISO 9001:2026 auditor now looks for. The sixth edition splits 6.1 into three parts: 6.1.1 determines risks and opportunities; 6.1.2 requires risks to be analysed and evaluated, with actions proportionate to their potential impact on the intended results of the QMS; the new 6.1.3 requires opportunities to be analysed and evaluated in their own right, with actions appropriate to context. Effectiveness is then evaluated separately under 9.1.3 e) and f) and reviewed under 9.3.2 g) and h). Rebuilding the register means adding those steps, not adding rows.

What changed in 6.1 from ISO 9001:2015 to ISO 9001:2026

The 2015 edition asked you to determine risks and opportunities and plan actions. The 2026 edition adds analysis, evaluation, proportionality and a separate track for opportunities, with separate checks on effectiveness in performance evaluation and management review. Top management must promote opportunity-based as well as risk-based thinking (5.1.1 k)), and 5.3 e) makes reporting on opportunities for improvement a responsibility assigned in its own right.

Topic	ISO 9001:2015	ISO 9001:2026
Structure	6.1.1 and 6.1.2	6.1.1 determining; 6.1.2 actions to address risks; 6.1.3 actions to address opportunities
Risks	Determined; actions planned	Determined, analysed and evaluated; actions proportionate to the potential impact on the intended results of the QMS; disruption named in NOTE 1
Opportunities	Handled with risks	Own sub-clause: determined, analysed and evaluated; actions appropriate to context
Effectiveness	One evaluation, one review input	Actions on risks (9.1.3 e), 9.3.2 g)) and on opportunities (9.1.3 f), 9.3.2 h)) evaluated and reviewed separately

Clause-by-clause reference: ISO 9001:2026 risks and opportunities.

What “determined, analysed and evaluated” must look like in the register

Analysis means you have examined the causes of a risk and its potential effect on the intended results of your QMS; evaluation means you have judged it against criteria set beforehand and decided whether to act. A register with a mitigation column shows determination and action but neither analysis nor evaluation; the auditor needs the reasoning in between.

Column	What it holds	Evidences
Risk, source and result at stake	The event or condition, its origin (4.1 context, 4.2 interested parties, a process, a site) and the QMS result it threatens	6.1.1; the reference for proportionality
Analysis and evaluation	Causes, likelihood and consequence on your scale; rating against your criteria; act or accept	6.1.2
Action, proportionality note, owner, date	What you will do, why that much and no more, who, by when	6.1.2
Effectiveness measure and review reference	How you will know it worked, the result, the review that considered it	9.1.3 e), 9.3.2 g)

The standard does not name a risk register and adds no mandatory documents or records (Annex A.2 e) explains the documented-information wording); the register is simply the shortest route to showing that each step happened.

Why opportunities need their own register under 6.1.3

An opportunity is not the mirror image of a risk. Under 6.1.3 opportunities are determined, analysed and evaluated separately, and actions to pursue them must be appropriate to the organisation’s context. The opportunity register asks different questions: the benefit expected, the fit with the strategic direction the quality policy must now support (5.2.1 e)), the cost, who reports on it (5.3 e)) and how you will know it paid off (9.1.3 f)).

Merging the two produced most of the weak 2015 registers we audit: an “opportunity” that was really the absence of a risk, or a mitigation relabelled. Keep two sections with different headings; 10.1 now says improvement covers processes and future needs and expectations, which is the opportunity register’s job.

Five worked Philippine examples

These are the entries our local Filipino lead auditors most often find done badly, rebuilt in the 2026 form: three risks, one opportunity, and one opportunity with a risk attached. Figures are illustrative; the last row of each table is the 9.1.3 e) or f) effectiveness measure and the 9.3.2 g) or h) review.

1. Typhoon and flood disruption (risk, 6.1.2)

PAGASA records about 20 tropical cyclones a year in the Philippine Area of Responsibility, eight or nine crossing the country: for a Laguna plant or a Cebu warehouse, a seasonal certainty. Disruption is named in NOTE 1 to 6.1.2; the 4.1 determination that climate change is relevant is recorded here, and no carbon accounting is required.

Step	Entry
Determined	Access road floods; inbound and outbound movements stop for two to five days
Analysed and evaluated	River overflow after sustained rain, several times a season; late delivery to two key accounts and one contractual penalty. High against on-time delivery
Action (proportionate)	Raised finished-goods storage; dispatch trigger when PAGASA raises a wind signal over the province; alternate carrier; customer notification under 8.2.1 e)
Effectiveness and review	Days from all-clear to full dispatch against a two-day target; November review

2. Single-supplier exposure (risk, 6.1.2)

Step	Entry
Determined	One imported resin grade from one supplier; no qualified alternative
Analysed and evaluated	Six-week lead time, port congestion, supplier outages; line stoppage nine days after a missed shipment. High against conforming output and delivery
Action (proportionate)	Qualify a second source under 8.4; four weeks of safety stock for this grade only, with a note on why packaging, with three local suppliers, needs none
Effectiveness and review	Stock-outs and lead-time variance per quarter; every review until the second source ships

3. Power interruption (risk, 6.1.2)

Step	Entry
Determined	An unplanned outage scraps a batch in process; in a contact centre it drops live calls
Analysed and evaluated	Grid alerts in the hot months (NGCP put Luzon and Visayas on red and yellow alert in May 2026; red means supply cannot meet demand) and local faults; scrapped batches, missed service levels. High for batch processes and the contact centre
Action (proportionate)	Generator sized for critical processes only; UPS on servers and telephony; no at-risk batch started during a red alert
Effectiveness and review	Hours lost and batches scrapped per quarter; quarterly review

4. New export market (opportunity, 6.1.3)

Step	Entry
Determined	A Davao food processor receives an enquiry from a Japanese importer
Analysed and evaluated	Benefit: 15 per cent volume growth. Requirements: importer’s specifications, destination regulations, labelling, peak capacity. Fits the policy’s strategic direction (5.2.1 e)); capacity available off-season
Action (appropriate to context)	A pilot order from the existing line, not a new line; requirements captured under 8.2, operational planning updated under 8.1
Effectiveness and review	Pilot accepted without complaint, repeat order within six months; reported by the person assigned under 5.3 e) at the next review

5. Government tender eligibility (opportunity with an attached risk)

Republic Act No. 12009, the New Government Procurement Act, makes PhilGEPS the single electronic procurement portal (Section 20), requires a bidder’s valid and updated PhilGEPS Certificate of Registration and Membership (Section 52) and does not mention ISO certification. DPWH Department Order No. 110, series of 2024, does: it phases ISO 9001:2015 certification in for civil works contractors by PCAB category, Large “A” first (1 January 2025), then Medium “B” (1 July 2025), then Medium “A” (1 January 2026); Large “B” was already covered. ISO 9001:2015 certificates remain valid until 30 September 2029 at the latest and none may be newly issued after 31 March 2028 (Global ACI transition requirements); no DPWH issuance naming the 2026 edition has been verified, so a bid needs a valid accredited certificate.

Step	Entry
Determined	Opportunity: bid for DPWH projects in the Medium “A” category. Risk: loss of eligibility if the certificate lapses or is reissued late during the transition
Analysed and evaluated	Benefit: a tender pipeline. Risk cause: the certificate expires in 2028; its replacement must run past 30 September 2029, and only an ISO 9001:2026 certificate does. Opportunity fits the strategic direction; risk high against eligible bids
Action	Transition audit booked into the 2027 surveillance; PhilGEPS registration kept current; Sterling pre-assessment first
Effectiveness and review	Eligibility and a certificate in date at every bid; both inputs on the review agenda, separately

Proportionate actions: how much is enough

Proportionate means the effort matches the potential impact on the intended results of your QMS. The auditor looks not for a large spend but for the reasoning that connects the evaluation to the action. Over-treating trivial risks and under-treating the ones that stop production are both written up; the second ends in a nonconformity.

When the action is itself a change to the system, a new supplier, line or site, 6.3 applies as well, including 6.3 c) on resources and information and the new items e), f) and g) on communication, monitoring and review of results; see the planning of changes worked example.

Closing the loop: 9.1.3 e) and f), 9.3.2 g) and h)

The 2026 edition asks you to evaluate the effectiveness of actions on risks and of actions on opportunities separately, and to bring each to management review as its own input. In the register that is one column and one agenda line, and it is where most 2015 registers fail: actions marked done and never measured. Set the measure when the action is planned.

Re-evaluate entries when 9.3.2 c) is triggered by a change in what interested parties need, including climate-related requirements, which the 4.2 NOTE recognises; typhoon season, grid alerts and tender calendars are the recurring Philippine triggers. The transition audit reviews the changed requirements, so expect the auditor to trace two or three entries end to end.

Start with the free gap check

Take the free ISO 9001:2026 gap check: twenty questions, about ten minutes, and a readiness score on screen and by email. A local Filipino lead auditor then talks you through the result, Mark Santos for Metro Manila, Zia Bautista for Cebu or Ann Reyes for Davao, and, if you want it, Sterling Revise™ produces the written gap report with the number of register entries to rebuild before any commitment.

Frequently asked questions

Does ISO 9001:2026 require a documented risk register? No document by that name is required, and the 2026 edition adds no mandatory documents or records. The auditor needs evidence that risks were determined, analysed and evaluated, that actions were proportionate, and that effectiveness was evaluated and reviewed; a register shows all of that in one place.

Can risks and opportunities stay in one spreadsheet? Yes, if they sit in separate sections with different column headings and feed separate lines in 9.1.3 and 9.3.2. A single mixed list with one action column is what the 2026 edition moved away from; two sheets in one workbook, or two modules in Effivity, meet the requirement.

Do we need a risk matrix, FMEA or ISO 31000? The standard sets what the register must show, not the technique. A three-by-three matrix that your managers use honestly beats a five-by-five that only the quality manager understands. ISO 31000 is useful guidance, not a requirement of ISO 9001:2026, and an auditor will not ask for it.

Is climate change a mandatory entry? Clause 4.1 requires you to determine whether climate change is relevant to your context, and the 4.2 NOTE says interested parties can have climate-related requirements. Where it is relevant, as for most Philippine sites, the resulting risks belong in the register; no carbon accounting is required.

How often should the register be reviewed? The standard sets no frequency. In practice, at each management review, because 9.3.2 g) and h) make the effectiveness of actions an input, and whenever 9.3.2 c) is triggered by a change in what interested parties need; typhoon season and grid alerts justify a quarterly check.

What does “disruption” in NOTE 1 to 6.1.2 mean for a Philippine company? The NOTE is informative and adds no requirement, but it signals that interruptions to your ability to provide products and services, from weather, power, transport, suppliers or systems, belong in your analysis of risks. It pairs with 8.2.1 e) on customer information about contingency actions for disruptions.

Read next

Continue with the clause-level reference for risks and opportunities under ISO 9001:2026, climate change in ISO 9001:2026 and management review inputs under ISO 9001:2026; then the planning of changes worked example, the twelve-step ISO 9001:2026 migration plan and the Sterling Revise™ transition service.

Sources

• ISO 9001:2026, sixth edition, published 16 September 2026: clauses 4.1, 4.2 NOTE, 5.1.1 k), 5.2.1 e), 5.3 e), 6.1, 6.3, 8.1, 8.2, 8.2.1 e), 8.4, 9.1.3, 9.3.2, 10.1, Annex A.2 e). https://www.iso.org/standard/9001
• Global ACI-TECH-3-TR 2029-09-30 (M), Transition Requirements for ISO 9001:2026, version 1.0, issued 4 September 2026, published 16 September 2026.
• DOST-PAGASA, Tropical Cyclone Information. https://www.pagasa.dost.gov.ph/climate/tropical-cyclone-information (verified 19 September 2026)
• Philstar, 14 May 2026, NGCP red and yellow alert definitions. https://www.philstar.com/headlines/2026/05/14/2527937/brownouts-return-luzon-visayas-grids-hit-red-alert-heres-what-terms-mean (verified 19 September 2026)
• Republic Act No. 12009, New Government Procurement Act, approved 20 July 2024, Sections 20 and 52. https://lawphil.net/statutes/repacts/ra2024/ra_12009_2024.html (verified 19 September 2026)
• DPWH Department Order No. 110, series of 2024, reported by Pinoy Builders, 8 July 2024. https://pinoybuilders.ph/dpwh-announces-deadline-for-contractors-iso-certification-requirement/ (verified 19 September 2026; DPWH and PIA pages unreachable)