Risks and opportunities done properly: the register that auditors like and managers actually use.
ISO Cloud Consulting editorial teamA useful ISO 9001:2026 risk and opportunity register scores risks on written one-to-five scales with a control threshold, runs opportunities as a staged pipeline scored on benefit against effort, links both to quality objectives, and is reviewed on a set cadence. A quick health test shows whether the register is alive or decoration.
What makes a register managers actually use?
A risk and opportunity register should be a tool managers open because it helps them, not a spreadsheet the quality lead updates before an audit. Here is how to build one that auditors like and managers actually use.
How should you score risks?
Keep it plain. For risks, rate likelihood and impact from one to five, and multiply them for a score out of twenty-five. Define each level in your own words, with examples. An impact of five might mean a lost customer or a product recall. An impact of two might mean a few hours of rework. Without written definitions, two managers will score the same risk differently and the numbers mean nothing.
Why set a threshold?
Anything scoring twelve or more needs a documented control and an owner. Anything below that is monitored. It stops the register filling with actions nobody has time for.
How should opportunities be handled?
Opportunities need a different structure, because they are not the mirror image of risks. Treat them as a pipeline. Each opportunity has a description, the expected benefit, the effort, an owner, a stage, and a next action with a date. The stages can be simple: identified, assessed, approved, in progress, realized or dropped. A pipeline makes it obvious when something has sat at identified for a year.
Score opportunities on benefit against effort. High benefit and low effort goes first. High benefit and high effort becomes a candidate objective.
How do risks and opportunities link to objectives?
This is the link most registers are missing. Your quality objectives should be visibly connected to the register. A high risk with a weak control might become an objective to reduce it. A valuable opportunity might become an objective to realize it. Put a column in the register for the related objective, and a column in your objectives for the source risk or opportunity. An auditor who can follow that thread in both directions is satisfied very quickly.
How often should the register be reviewed?
Risk owners review their risks quarterly, and the whole register goes to management review. Opportunities are reviewed monthly, in an operations or leadership meeting that already happens, because a pipeline looked at once a year does not move. New rows are added as they arise, from audits, complaints, changes, supplier problems and customer conversations, not only at an annual workshop.
How can you test whether the register is alive?
At least one risk has been closed or rescored downward in the last year, because a control worked. At least one opportunity has been realized, and someone can tell you the benefit. And at least one row was added by someone outside the quality team. If all three are true, the register is alive. If none are, it is decoration.
The Risk and Opportunity Register has the scoring definitions, the opportunity pipeline and the objective links already set up. See also our risk register template guide and the full ISO 9001:2026 templates collection.
Which videos should you watch next?
Climate decisions often add rows to the register, so watch climate change in ISO 9001 without an EMS. To build the register as part of a project, watch week five of Twelve weeks to ISO 9001:2026. All ten episodes are in the ISO 9001:2026 deep dives series.
