ISO 9001 / AS9100 Clause 6, Planning: Where Risk-Based Thinking Earns Its Keep

Clause 5 asked whether leadership owns the system. Clause 6 asks what leadership plans to do with it.

This is the clause where the standard stops describing structure and starts demanding foresight. It has three parts: actions to address risks and opportunities (6.1), quality objectives and planning to achieve them (6.2), and planning of changes (6.3). It's also the clause the 2026 revision restructures most visibly — so we'll cover what's expected today and what's changing in a few weeks.

What's Changing in 2026

In ISO 9001:2015, risks and opportunities live together in a single subclause, treated as two sides of the same coin. The 2026 revision splits Clause 6.1 into three subclauses, separating the two:

• 6.1.1:  the general requirement to determine risks and opportunities, drawing on the context work from 4.1 and 4.2

• 6.1.2:  Actions to address risks, with actions required to be proportionate to the potential impact of the risk on the intended results of the QMS

• 6.1.3:  Actions to address opportunities, with actions required to be appropriate to the organization's context and to support achievement of desired results

The change is reinforced downstream: management review inputs (9.3.2) will call out the effectiveness of actions taken to address risks and the effectiveness of actions taken to address opportunities as separate items.

Why the structural change? When risk and opportunity share a clause, opportunity loses every time. Ask most certified companies to show you their risk register and you'll get one. Ask them to show you their opportunity register and you'll get a pause, then a version of "well, it's the same document." Look at that document and it’s threats, all the way down. It's what happens when two very different activities compete for one line item on an agenda, and one of them is on fire. 

Also bear in mind that for much of the ‘10s, corporate jargon often referred to problems as opportunities.  This was supposed to be a “glass half full” way of speaking, turning issues into opportunities for improvement.  However in this mindset, “risks and opportunities” would read as “risks and problems,” or in other words, issues and potential issues.  No wonder there was confusion.

6.1.3 now drives this clarification.  Risk-based thinking was never only about defense; the 2015 language explicitly covered effects that are positive as well as negative. Splitting the clause makes the omission visible.

Why This Change Is Worth Taking Seriously

Several years ago I led a quality team that made exactly this shift, from being buried in CARs, using risk-based thinking almost entirely defensively to running a deliberate, proactive program for identifying and implementing opportunities. The results were tangible in ways that showed up well outside the quality department. There was noticeably less chaos. My team was actually able to protect around 15% of their time for continuous improvement work, which is the sort of thing that gets promised in a lot of shops and delivered in very few; you only get there once you've stopped spending that time on the same recurring fires.

The moment that stuck with me came in a directors' meeting. A recommendation came up to nominate one of our largest suppliers for supplier of the year, a supplier that had been notorious for years for their approach to quality. That nomination genuinely surprised most of the room. Then one of the directors said something I wrote down immediately, because I knew I'd want it later:

"Adam's team's progress is tangible, and we are changing the narrative from 'we've had this problem for years' to 'we've solved the problem and here are the results.'"

That's what Clause 6.1.3 is reaching for. Whether it achieves it in practice depends entirely on whether companies treat it as a new column in a spreadsheet or as a mandate to do the work.

---

6.1:  Actions to Address Risks and Opportunities

What's expected:  When planning the QMS, you must consider the internal and external issues from 4.1 and the interested-party requirements from 4.2, and determine the risks and opportunities that need to be addressed in order to give the QMS assurance it can achieve its intended results, enhance desirable effects, prevent or reduce undesired effects, and achieve improvement. You must then plan actions to address them, integrate those actions into your QMS processes, and evaluate the effectiveness of those actions.

Worth knowing:  ISO 9001 does not require a formal, documented risk management process or any particular methodology. It requires that you do the thinking and that the thinking connects to something. AS9100D goes somewhat further, adding operational risk management requirements in Clause 8.1.1 covering things like risk assignment of responsibility, defined risk criteria, and acceptance of residual risk.

What conformance actually looks like:  The failure mode here is so common it's almost the default: a risk register built during initial certification, filed, and never opened again except three weeks before an audit. An auditor's test isn't whether the register exists; it's traceability. Show me a risk you identified, then show me where it changed something. If a risk about single-source material shows up in your register, an auditor should be able to find it again in your supplier evaluation criteria, or a quality objective, or an operational control. If the register connects to nothing, it is nothing.

Why it matters to the customer:  Everything the customer experiences as reliability is upstream risk work they never see. The material shortage you covered with a second qualified source, the operator turnover you covered with cross-training, the machine you replaced before it failed:  none of those show up on the customer's radar, which is exactly the point. The suppliers customers trust most are the ones whose problems the customer never learned about.

Where the operational payoff is:  Risk work converts unplanned expense into planned expense, and planned expense is always cheaper. Expedited freight, overtime to recover a schedule, requalifying a source under duress — these are the premium prices you pay for surprise. And on the opportunity side, as above: it's how you stop paying for the same problem repeatedly and start banking the savings.

---

6.2 — Quality Objectives and Planning to Achieve Them

What's expected:  Establish quality objectives at relevant functions, levels, and processes. They must be consistent with the quality policy, measurable, take applicable requirements into account, be relevant to conformity of products and services and to enhancing customer satisfaction, be monitored, communicated, updated as appropriate, and maintained as documented information. Then, separately, you must plan how to achieve them: what will be done, what resources are required, who is responsible, when it will be completed, and how results will be evaluated.

What conformance actually looks like:  Two failure modes dominate.  The first is objectives that aren't measurable in any useful sense. "Improve customer satisfaction" isn't an objective; it's a sentiment. "Reduce customer-reported escapes from 14 to fewer than 6 by year end" is an objective, because at the end of the year there is exactly one right answer about whether you hit it.

The second, and more common in my experience, is objectives that are measurable but have no plan attached. The standard is explicit that determining the objective and planning to achieve it are two separate requirements. A number on a board with no owner, no resources, and no date is a wish. This is the part of Clause 6.2 people skip, and it's the part that determines whether the objective is real.

Note also the phrase at relevant functions, levels, and processes.  Objectives that exist only at the company level don't reach anyone. If the shop-level objective is scrap reduction, the cell that generates the most scrap should be able to tell you what their piece of it is.

Why it matters to the customer:  Your quality objectives are, in effect, your written promise about what will be better a year from now. Customers who conduct supplier audits ask about objectives specifically because objectives reveal priorities more honestly than a policy statement does. And when your objectives happen to align with what your customer is already scoring you on, conformity and on-time delivery, you get the useful situation of improving your scorecard and your internal metrics with the same effort.

Where the operational payoff is:  Good objectives are a focusing mechanism, and focus is scarce. Most shops have more improvement ideas than capacity to execute them; the constraint isn't ideas, it's attention. A small set of well-chosen, resourced objectives is how you make sure the improvement capacity you have gets spent on the things that matter most instead of scattered across whatever was most annoying that week.

---

6.3:  Planning of Changes

What's expected:  When you determine a need to change the QMS, the change must be carried out in a planned manner. You must consider the purpose of the change and its potential consequences, the integrity of the QMS, the availability of resources, and the allocation or reallocation of responsibilities and authorities. (The 2026 revision strengthens this area, adding expectations around communicating, monitoring, evaluating, and reviewing planned changes.)

What conformance actually looks like:  This clause covers changes to the system:  reorganizations, new ERP implementations, new facilities, process ownership moving between departments, a new certification scope. It's distinct from product or process change control in Clause 8, though the two obviously interact.

Conformance means there's evidence the change was thought through before it happened, not reconstructed afterward. A short change plan naming what's changing, why, what could go wrong, who owns what afterward, and what documentation needs to be updated is generally sufficient. What auditors find instead, frequently, is an org chart that changed six months ago and a set of procedures still naming people who've moved on, which is a finding under this clause and also, per the last post, a small instance of documentation not matching reality.

An ERP migration is the classic case. It's usually run as an IT project, and the quality system consequences: where records live, who approves what, whether traceability survives the cutover, get discovered rather than planned. Changing the plumbing while the water's running is doable, but only if you've thought about where the water goes.

Why it matters to the customer:  Customers experience your internal changes as inconsistency. The supplier who was excellent for two years and then had a rough quarter usually had a change in there:  a new system, a reorganization, a key person leaving. Planning changes is how you keep your customer from being the one who discovers what you broke.

Where the operational payoff is:  Unplanned change is the most expensive kind, and the cost is almost entirely rework:  redoing a configuration, retraining people on a process that got changed twice, reconstructing records that didn't survive a migration. A change plan is a few hours of thinking that routinely saves weeks.

---

ISO 9001 / AS9100 Clause 6: Pulling It Together

ISO 9001 / AS9100 Clause 6 is the bridge between knowing your business (Clause 4), leading it (Clause 5), and running it (Clause 8). It asks three questions: what could affect us, what are we going to achieve, and how will we handle it when things change?

The 2026 revision's split of risk and opportunity is a small structural change with a large practical implication. It closes the escape hatch that let opportunity work fall off the agenda whenever the risk list got long — which is to say, always. Companies that treat 6.1.3 as a compliance exercise will add a column to a spreadsheet. Companies that treat it as permission to build a real opportunity program will find, as I did, that it changes what the rest of the business thinks quality is for.

What's Next

Next up: Clause 7, Support:  people, competence, infrastructure, the work environment, monitoring and measuring resources, organizational knowledge, and documented information. It covers a wide variety of topics, and it’s also the one where "we know that, but it's all in Dave's head" finally becomes a finding.