Risk-based thinking has been the quiet engine of ISO 9001 since 2015. The 2026 edition keeps it and sharpens it, by separating risk from opportunity in the structure of clause 6.1.
What is changing
Clause 6.1 (actions to address risks and opportunities) is being reorganised into subclauses so that the standard treats two different jobs distinctly: identifying and controlling risks, and identifying and pursuing opportunities. The draft frames this as "opportunity-based thinking" sitting alongside the established risk-based thinking.
The important point: your underlying approach does not have to change. This is largely about how the two are documented and demonstrated, not about adopting a new methodology.
Why the split is sensible
In practice, most organisations have quietly let opportunity wither. A single combined "risks and opportunities" register usually fills up with risks, and the opportunity column becomes an afterthought. By giving opportunity its own home, the standard nudges you to actually do something with the upside — process improvements, new markets, efficiency gains, capability you could build — rather than only defending against the downside.
What an auditor will look for
If your current register mixes the two in one table, expect that to be the conversation. Auditors will want to see that opportunities are genuinely identified, evaluated and actioned — not just listed to satisfy the clause.
Expect the auditor to ask to see how risks are determined and treated, and — separately — how opportunities are captured and pursued, with evidence that at least some have been acted on. They will likely trace the thread back to your clause 4.1 context: the issues you identified there should be visibly feeding your risks and opportunities.
What to do now
- Review how you currently document risks and opportunities. If they share one table, plan to separate them into distinct sections aligned to the new subclause structure.
- Give opportunities real content: a few concrete, evaluated improvement or growth opportunities with owners and outcomes.
- Check the link from context (4.1) through to risk and opportunity, so the logic is traceable end to end.
- Hold the change until the standard publishes if you prefer — but the separation is easy to do early, and it tidies a part of most systems that has gone stale.
This one is low-effort and genuinely useful. A clean risk/opportunity split is often the most valuable hour of a transition gap assessment. Talk to us if you would like yours reviewed.
Based on the 2026 final draft; subclause numbering may be confirmed differently at publication.