When ISO 9001 was revised in 2015, one of the most discussed changes was the introduction of risk-based thinking. It replaced the standalone "preventive action" requirement from the 2008 version, but it is far more pervasive — woven throughout the entire standard rather than confined to a single clause. For many organisations, understanding what this means in practice (and what it does not mean) is the key to building a QMS that adds genuine value.
What Risk-Based Thinking Replaced
In ISO 9001:2008, preventive action was a separate requirement (Clause 8.5.3). Organisations had to identify potential nonconformities and take action to prevent them. In practice, this often became a bureaucratic exercise — a register of theoretical problems with theoretical solutions, disconnected from daily operations.
The 2015 revision took a different approach. Instead of treating risk as a standalone activity, it embedded the concept throughout Clauses 4 to 10. The word "preventive" was deliberately removed from the standard. The logic: if you think about risk at every stage of planning and operation, prevention becomes automatic rather than retrospective.
This was not a relaxation of requirements. It was an elevation. Risk is no longer something you address in one procedure — it is something you consider in every significant decision.
How Risk-Based Thinking Appears Across the Standard
Risk-based thinking is not confined to a single clause. Here is how it manifests throughout ISO 9001:2015:
Clause 4: Context of the Organisation
When you analyse your internal and external context and the needs of interested parties, you are identifying potential sources of risk and opportunity. A change in regulation, a new competitor, a key staff departure — these are all contextual factors that create risk. Your QMS scope should reflect where risk needs to be managed.
Clause 5: Leadership
Top management must ensure the QMS addresses risks and opportunities (5.1.1) and that the quality policy is appropriate to the context of the organisation. Leadership accountability for risk is explicit — it cannot be delegated to a quality manager alone.
Clause 6: Planning
This is where risk-based thinking is most directly addressed. Clause 6.1 requires organisations to determine the risks and opportunities that need to be addressed to give assurance the QMS can achieve its intended results, enhance desirable effects, prevent or reduce undesired effects, and achieve improvement. You must plan actions to address these risks and evaluate their effectiveness.
Clause 7: Support
Resource allocation, competence requirements, and communication plans should all be informed by risk. If a process is high-risk, it may need more skilled personnel, better equipment, or more rigorous monitoring.
Clause 8: Operation
Operational planning and control, design and development, and management of external providers all involve risk consideration. For example, risk determines the level of control you apply to outsourced processes and the rigour of your design reviews.
Clause 9: Performance Evaluation
What you monitor, measure, and audit should be driven by risk. High-risk processes need more frequent evaluation. Your internal audit programme should be risk-based — not every process needs equal audit attention every year.
Clause 10: Improvement
When nonconformities occur, the corrective action process should consider the risk of recurrence. Root cause analysis and the extent of corrective action should be proportionate to the significance of the risk.
Practical Implementation: What to Do
Here is a pragmatic approach to implementing risk-based thinking without overcomplicating your QMS:
- Start with your context analysis. List the internal and external factors that could affect your ability to deliver quality. These are your risk sources.
- Identify risks and opportunities for each key process. You do not need a formal risk register unless your organisation is large or complex enough to warrant one. A simple table listing the process, the risk, the current controls, and any additional actions needed is sufficient.
- Prioritise proportionately. Not every risk needs a detailed mitigation plan. Focus your energy on risks with the highest combination of likelihood and impact. Low-probability, low-impact risks can be accepted and monitored.
- Embed it in existing processes. Risk-based thinking should inform decisions you are already making — which suppliers to approve, which design features to test more rigorously, how often to calibrate equipment, which staff need additional training.
- Review during management review. Include risk as a standing agenda item. Discuss whether the risks identified are still relevant, whether new risks have emerged, and whether the actions taken have been effective.
- Adjust your internal audit programme. Audit high-risk areas more frequently and in greater depth. Low-risk, stable processes can be audited less often.
Risk Register vs Risk-Based Thinking: Don't Over-Engineer
A common misconception is that ISO 9001:2015 requires a formal risk register with likelihood-times-impact scores, heat maps, and quarterly reviews. It does not. The standard deliberately does not prescribe a risk management methodology. Clause 6.1 requires you to "determine" risks and "plan actions" to address them, but the method is up to you.
For a 20-person consultancy, risk-based thinking might mean a simple list in a spreadsheet discussed at quarterly management meetings. For a 500-person manufacturer with complex supply chains, a more structured risk assessment framework may be appropriate. The key is proportionality.
What the standard does not want is a beautifully formatted risk register that nobody reads, maintained by a quality manager in isolation from the people who actually manage the processes. Risk-based thinking must be practical, embedded, and owned by process owners.
Examples for Service Companies
If your organisation provides professional services, here are concrete examples of risk-based thinking in action:
- Key person dependency: If one senior consultant holds all the knowledge for a major client, that is a risk to service continuity. Mitigation: cross-training, documented procedures, succession planning.
- Scope creep: If projects regularly exceed their original scope without corresponding adjustments to timelines and resources, quality suffers. Mitigation: formal change control process, clear scope definitions in contracts.
- Supplier failure: If you rely on a single subcontractor for a critical service, their failure becomes your failure. Mitigation: approved supplier list with backup options, regular supplier evaluation.
- Regulatory change: If new legislation affects how you deliver services, failing to adapt is a risk. Mitigation: monitoring of regulatory developments, impact assessment process.
- Client dissatisfaction detection: If you only discover problems when a client complains, you are reacting rather than preventing. Mitigation: proactive satisfaction surveys, regular check-ins, monitoring of service metrics.
How Auditors Assess Risk-Based Thinking
During a certification or surveillance audit, auditors will not ask to see a risk register and tick a box. Instead, they will look for evidence that risk-based thinking is embedded in how the organisation operates. Typical audit approaches include:
- Asking process owners: "What could go wrong with this process, and what have you done about it?"
- Reviewing management review minutes for discussion of risks and opportunities
- Checking whether the internal audit programme is risk-based
- Examining whether resource allocation reflects risk priorities
- Looking at corrective actions to see whether root cause analysis considers broader risk implications
- Assessing whether objectives and planning decisions reference risk considerations
The auditor is not looking for a perfect system. They are looking for evidence that your organisation thinks about risk as part of its normal operations and uses that thinking to make better decisions.
If you are preparing for certification to ISO 9001:2015, visit our application page to start the process, or explore our certification process to understand what to expect at each stage.