ISO 9001 Clause 6: risk-based thinking and quality objectives

6.1 Risk-based thinking — what ISO 9001 actually requires (less than you think)

Risk-based thinking is not a new concept — quality professionals have always considered what could go wrong. What ISO 9001:2015 did was make it explicit and embedded, rather than isolated in a preventive action section.

The critical point most consultants miss: ISO 9001:2015 does not require a formal risk register, a risk assessment methodology, or a documented risk management framework. Annex A.4 of the standard explicitly states: "ISO 9001:2015 does not require a formal risk management approach or a documented risk management process." What the standard requires is that risks and opportunities identified from the context analysis (Clause 4.1) and interested parties (Clause 4.2) are considered, and that appropriate actions are planned to address them.

In practice, however, maintaining a documented risk register is strongly advisable — not because the standard mandates it, but because auditors need to see evidence of systematic risk thinking, and a register provides the clearest audit trail. A simple 5×5 likelihood/consequence matrix applied to your top risks is entirely sufficient.

Risk scoring: 1–5 Green (monitor), 6–12 Amber (action plan), 13–25 Red (immediate action required)

Opportunities are equally important but often overlooked. Clause 6.1 requires you to determine opportunities as well as risks. Opportunities arising from context analysis might include: emerging export markets, new technology that reduces defect rates, industry consolidation creating new customers, or digital certification processes reducing administrative burden.

6.2 SMART quality objectives — 10 examples from real manufacturers

Clause 6.2 requires quality objectives to: be consistent with the quality policy; be measurable; take into account applicable requirements; be relevant to conformity of products/services and customer satisfaction enhancement; be monitored; be communicated; and be updated as appropriate. The organisation must maintain documented information on the objectives and plan for how to achieve them (resource, responsibility, completion date, how results are evaluated).

The most common weakness is objectives that are not genuinely SMART — particularly "Measurable" and "Time-bound." "Improve customer satisfaction" is not a quality objective. "Achieve a Customer Satisfaction Score of ≥85 (out of 100) by Q4 2026, measured via the quarterly customer survey" is.

6.3 Planning changes to the QMS — the checklist

Clause 6.3 requires that when the organisation determines the need for changes to the QMS, those changes must be carried out in a planned manner. The clause lists four factors to consider when planning a change: the purpose and potential consequences; QMS integrity; resource availability; and responsibility and authority allocation.

In practice, this means significant changes to the QMS — restructuring processes, changing document control software, acquiring a new manufacturing site, introducing a new product line — require a change plan that addresses these four factors before implementation. A simple change record form covering these elements satisfies the requirement. The goal is to prevent reactive, undocumented changes that undermine QMS effectiveness.

Clause 6.3 change planning checklist:

• What is the purpose of this change and the desired outcome?
• What are the potential negative consequences if the change does not go as planned?
• Which QMS processes, documents, records, and competencies are affected?
• What resources (people, equipment, budget, time) are required?
• Who is responsible for implementing and verifying the change?
• What is the implementation timeline and what are the go/no-go criteria?
• How will we verify that the change has achieved its intended purpose and not degraded QMS performance elsewhere?

Frequently asked questions

Does ISO 9001:2015 require a formal risk register?

No. Annex A.4 of ISO 9001:2015 explicitly states that the standard does not require a formal risk management process or documented risk management framework. However, auditors need evidence of risk-based thinking, and a documented register provides the clearest audit trail. A simple register with risk description, likelihood/consequence scoring, risk owner, and planned actions is entirely sufficient — no need for ISO 31000 or a complex FMEA unless your sector requires it.

How many quality objectives should we have?

The standard does not specify a number. Enough to provide meaningful coverage of QMS performance dimensions (product quality, customer satisfaction, process efficiency, supplier performance, continual improvement) — typically five to ten for a mid-size manufacturer. Too few suggests insufficient attention; too many creates tracking burden. Focus on objectives that are genuinely linked to your quality policy commitments and strategic priorities.

Can quality objectives change during the year?

Yes. Clause 6.2 requires objectives to be updated "as appropriate." If business conditions change materially — a major customer is lost, a new product line launched, a significant quality incident occurs — objectives should be reviewed and revised through the change planning process (Clause 6.3). Document the reason for any revision. Changing objectives to avoid reporting poor performance is not acceptable and will be apparent to an auditor reviewing the trend over multiple periods.

What is the difference between risks to the QMS and operational risks?

Clause 6.1 risks are QMS-level risks — factors that could prevent the QMS from achieving its intended outcomes (delivering conforming products/services, customer satisfaction, continual improvement). Operational risks at the product/process level (FMEA, control plans) are addressed in Clause 8. Both are required, but they serve different purposes. The Clause 6.1 risk register should feed into Clause 8 process planning, not replace it.

Do quality objectives need to be communicated to all employees?

Yes — Clause 6.2.1(f) explicitly requires quality objectives to be communicated. What this means in practice: all employees should know the organisation's quality objectives (not necessarily every KPI number, but the direction and priorities). Departmental or function-level objectives that cascade from the QMS-level objectives are an effective way to make top-level objectives meaningful to individual roles. Communication evidence typically includes management review minutes, team briefing records, and intranet publication.

What triggers a Clause 6.3 "planned change" process?

Any change that could significantly affect QMS effectiveness or the organisation's ability to meet product/service requirements: new product lines, site changes, major equipment replacement, software changes to document control or ERP systems, significant changes to key processes, organisational restructuring, acquisition of a new business. Minor corrections to documents or small process tweaks do not need a formal change plan, but should still follow document control procedures (Clause 7.5.3).

Article reviewed by IgeraIndustria Quality Team, updated 2026-07-07. References: ISO 9001:2015 Clause 6 and Annex A.4; ISO/TC 176/SC 2 guidance on risk-based thinking; IgeraIndustria quality objectives benchmarking data 2025.