Risk-based thinking has been the quiet engine of ISO 9001 since 2015. The 2026 edition keeps it and sharpens it, by separating risk from opportunity in the structure of clause 6.1.
What is changing
Clause 6.1 (actions to address risks and opportunities) is reorganised into three sub-clauses — 6.1.1 determining risks and opportunities, 6.1.2 actions to address risks, 6.1.3 actions to address opportunities — so that the standard treats two different jobs distinctly: identifying and controlling risks, and identifying and pursuing opportunities. Each half is determined, analysed and evaluated, then planned with its own integration and effectiveness check; actions on risks are to be proportionate to their potential impact, actions on opportunities appropriate to your context. The published text frames this as "opportunity-based thinking" sitting alongside the established risk-based thinking — and the leadership commitments in 5.1.1 now name both.
The important point: your underlying approach does not have to change. This is largely about how the two are documented and demonstrated, not about adopting a new methodology.
Why the split is sensible
In practice, most organisations have quietly let opportunity wither. A single combined "risks and opportunities" register usually fills up with risks, and the opportunity column becomes an afterthought. By giving opportunity its own home, the standard nudges you to actually do something with the upside — process improvements, new markets, efficiency gains, capability you could build — rather than only defending against the downside.
What an auditor will look for
If your current register mixes the two in one table, expect that to be the conversation. Auditors will want to see that opportunities are genuinely identified, evaluated and actioned — not just listed to satisfy the clause.
Expect the auditor to ask to see how risks are determined and treated, and — separately — how opportunities are captured and pursued, with evidence that at least some have been acted on. They will likely trace the thread back to your clause 4.1 context: the issues you identified there should be visibly feeding your risks and opportunities.
What to do now
- Review how you currently document risks and opportunities. If they share one table, plan to separate them into distinct sections aligned to the new subclause structure.
- Give opportunities real content: a few concrete, evaluated improvement or growth opportunities with owners and outcomes.
- Check the link from context (4.1) through to risk and opportunity, so the logic is traceable end to end.
- Do it now — the separation is quick, and it tidies a part of most systems that has gone stale.
This one is low-effort and genuinely useful. A clean risk/opportunity split is often the most valuable hour of transition preparation — the ISO 9001:2026 Transition Toolkit turns changes like this one into a working gap checklist.
Checked against the published text of ISO 9001:2026 (SANS 9001:2026 Ed. 6, the identical South African adoption) on 27 September 2026. The 6.1.1–6.1.3 structure is as described.