Twelve weeks to ISO 9001:2026, week five: risks and opportunities, handled separately.

Why two lists from the start?

This is week five of twelve weeks to ISO 9001:2026. Last week we recorded the context. This week we turn it into action, with risks, opportunities and quality objectives. The 2026 edition treats risks and opportunities more distinctly than before, so we will build them as two lists from the start.

Where do risks come from?

Risks come from three places. The context and interested parties registers from last week. The processes on your map, where you ask what could go wrong at each handover. And your own history: the complaints, returns and scrap of the last two years. For our small manufacturer, a typical first list might include a single supplier for a critical material, one welder qualified for a key process, drawing revisions reaching the floor late, and a major customer's tightening requirements.

How should risks be scored?

Score each risk simply. Likelihood and consequence, each on a scale of one to three or one to five. Do not spend an hour debating whether something is a three or a four. The score only exists to rank the list, so you put your effort where it matters.

What does a risk action look like?

For each significant risk, write an action and an owner. Qualify a second welder by the end of the quarter. Approve an alternative supplier. Add a revision check at job release. Some risks you will accept, and that is fine, as long as the decision is recorded with a reason. Then set a review date. Risks that are never reviewed are decoration.

How do you run the opportunity list?

Now the opportunities, on a separate list. An opportunity is something that could improve your ability to satisfy customers or achieve your objectives. A new market, a process improvement, a technology, a supplier partnership. Treat this list like a sales pipeline. Each opportunity has an owner, a next step and a date. Review it monthly. Many companies have never written an opportunity down, and the 2026 edition makes that much harder to defend.

How do you set quality objectives?

Then set quality objectives. Three to five, measurable, linked to what the business is trying to achieve, with an owner and a target date. Use the process measures from week three as your starting point. On time delivery above an agreed level. Customer complaints below a set number per thousand orders. Rework hours down by a quarter. Write down what will be done to achieve each one, by whom, and how you will know.

What should you have by the end of week five?

By the end of week five you should have a risk list with scores, actions and review dates, a separate opportunity list with owners, and three to five quality objectives with plans. Present them to your sponsor, and get them signed.

The Risk and Opportunity Register is built with separate risk and opportunity sheets for exactly this reason. For the fuller method, see risks and opportunities done properly, and find the register with the rest of the ISO 9001:2026 templates collection. Next week: documents and the master document list.