Most ISO 9001 risk assessment files look the same at audit time. Someone filled in a spreadsheet during implementation, scored a few risks, and never opened it again. The auditor asks how a recent customer complaint affected your risk picture, and nobody has an answer. A risk register only earns its place when it connects to the rest of your quality management system. This guide shows you how to build one that scores risk consistently and feeds your corrective actions, complaints, nonconformities and management reviews.

What ISO 9001 Requires for Risk Assessment

ISO 9001:2015 builds risk into the whole standard through a concept called risk-based thinking (Introduction, 0.3.3). The core requirement sits in clause 6.1, Actions to address risks and opportunities. It asks you to do four things:

• Determine the risks and opportunities that come from your internal and external issues (4.1) and your interested parties (4.2).
• Plan actions to address them, in proportion to their potential impact on product and service conformity.
• Integrate those actions into your QMS processes (see also 4.4.1 f).
• Evaluate whether the actions were effective.

Here is the part many people miss. ISO 9001 does not require a formal risk management method or a documented risk register. Annex A.4 of the standard says this directly. However, you still need to show an auditor how you determined risks and evaluated your actions. A simple scored register is the clearest way to provide that evidence. It also gives your team one shared method instead of individual opinions.

How to Build an ISO 9001 Risk Assessment in Six Steps

1. Identify risks from your context. Start with your context analysis (4.1), interested parties (4.2) and process map (4.4). Ask what could stop each process from delivering conforming output. Typical sources include key personnel, suppliers, equipment, records, IT systems and customer requirements.
2. Score probability on a defined scale. Use plain frequency language so everyone scores the same way. Our template uses five levels, from Not Likely (1) to Occurs Often (5).
3. Score impact across separate categories. One impact number hides too much. Score company image, financial cost and compliance separately, then combine them into a single impact score from 1 to 5.
4. Calculate a total and set an action threshold. Add probability and impact for a total from 2 to 10. Define the score that requires documented action. In our template, any total of 7 or higher turns red.
5. Assign an action and an owner. Every red risk needs a planned action, a responsible person and a date. Lower risks can be accepted and monitored, but record why.
6. Review and update on defined triggers. Update the register when a nonconformity, complaint, corrective action or process change occurs. Review the full register at least at each management review.

A Practical Scoring Method for Probability and Impact

The tables below show the ISO 9001 risk assessment scoring logic used in the Precision ISO Risk and Opportunities Register. You can adjust labels and points to fit your organization. The key is to define the method once and apply it the same way every time.

Worked example. A small calibration company has only one technician qualified to perform a key service. If that person is out, work stops. The team scores probability as Occurs Quarterly (3). Company image is Low Impact (1 point). Financial risk is Low Cost (1 point). Missed customer deadlines create a Non-Compliance Risk (2 points). Impact is 1 + 4 = 5. The total score is 3 + 5 = 8, so the risk is flagged red. The planned action is to cross-train a second technician within 90 days. The quality manager owns it.

How the Risk Register Connects to the Rest of Your QMS

Your ISO 9001 risk assessment is a prediction. Your nonconformities, corrective actions and complaints show what actually happened. When you compare the two, you learn whether your scores and controls are realistic. That feedback loop is what auditors look for when they evaluate risk-based thinking.

Nonconformities: Test Whether Your Risk Controls Work

Each nonconformity, whether a nonconforming output (8.7) or a system nonconformity found in an audit, is evidence. Ask two questions when you log it. First, was this risk already on the register? If it was, the control did not work as planned, so raise the probability score and review the action. If it was not, you have found a gap in your risk identification. Add the risk and score it.

Record the Risk ID on the nonconformity report. This single field creates traceability between the event and your risk assessment.

Corrective Actions: Feed Root Causes Back Into the Register

Clause 10.2.1 e) requires you to update the risks and opportunities determined during planning, if necessary, when you take corrective action. In practice, the root cause analysis is the most valuable input your register will receive. A root cause often reveals a weakness that affects more than one process.

Build three checks into your corrective action form:

• Does the root cause match an existing risk? If yes, link the Risk ID.
• Does the root cause reveal a new risk? If yes, add it to the register.
• After the effectiveness check (10.2.1 d), should the risk be rescored? Lower the score only when you have evidence the action worked.

Customer Complaints: Your Most Honest Risk Data

ISO 9001 requires you to obtain customer feedback, including complaints (8.2.1 c), and to monitor customer satisfaction (9.1.2). A complaint means a risk reached your customer. That makes complaints the strongest signal you have about company image impact.

When a complaint arrives, link it to a Risk ID just as you would a nonconformity. Then trend complaints by risk during your analysis and evaluation of data (9.1.3). If one risk keeps generating complaints, its probability score is too low. It also likely needs a stronger action than the one on file.

Management Review: Where ISO 9001 Risk Becomes a Decision

Clause 9.3.2 e) lists the effectiveness of actions taken to address risks and opportunities as a required management review input. Many organizations satisfy this with one line in the minutes. A stronger approach presents the register itself. Show top management:

• Every risk currently flagged red, with action status and owner
• Risks whose scores changed since the last review, and why
• Nonconformities, corrective actions and complaints linked to each risk
• New risks from changes in internal and external issues (9.3.2 b)

The review outputs (9.3.3) should then include decisions on resources, accepted risks and changes to the register. This turns management review into the moment where leadership owns the risk picture.

Do Not Forget the Opportunities Half of Clause 6.1

Clause 6.1 covers opportunities as well as risks. Opportunities might include new technology, a new market, process automation or a better supplier. Track them on a separate tab with an owner, a planned action and a review date. Management review should discuss them alongside risks (9.3.2 f).

Common ISO 9001 Risk Assessment Mistakes Auditors Find

• The register is never updated. The last-updated dates match the implementation date.
• Scoring is inconsistent. Two people score the same risk differently because the scale is undefined.
• No link to quality events. Nonconformities and complaints carry no Risk ID, so traceability is lost.
• High risks with no action. Red scores sit without an owner, date or documented decision to accept.
• Scores drop without evidence. A risk is rescored lower before an effectiveness check confirms the action worked.

Frequently Asked Questions About ISO 9001 Risk Assessment

Does ISO 9001 require a risk register?

No. ISO 9001:2015 clause 6.1 requires organizations to determine risks and opportunities, plan actions and evaluate their effectiveness. It does not require a formal risk management method or a documented risk register, as Annex A.4 explains. Most organizations still keep a register because it is the clearest evidence of risk-based thinking during an audit.

Which ISO 9001 clauses cover risk?

The main requirement is clause 6.1, Actions to address risks and opportunities. Risk also appears in clauses 4.4.1 f (processes), 9.1.3 e (analysis of risk action effectiveness), 9.3.2 e (management review input) and 10.2.1 e (updating risks after corrective action). The concept of risk-based thinking is described in Introduction 0.3.3.

How often should an ISO 9001 risk register be reviewed?

ISO 9001 does not set a fixed frequency. A practical approach is a full review at every management review, plus updates triggered by nonconformities, corrective actions, customer complaints, audit findings and changes to processes, suppliers or customers.

What risk score should require action?

Your organization defines the threshold. In the Precision ISO Risk and Opportunities Register, probability (1 to 5) is added to impact (1 to 5). Any total of 7 or higher is flagged red and requires a documented action, an owner and a target date. Lower risks can be accepted and monitored with a recorded rationale.

Should every nonconformity create a new risk?

No. First check whether the nonconformity matches an existing risk. If it does, link the Risk ID and review the score and control. Add a new risk only when the root cause reveals something the register did not already cover.

Do I need ISO 31000 to meet ISO 9001 risk requirements?

No. ISO 31000 provides general guidance on risk management, and some organizations use it to strengthen their method. ISO 9001 does not require it. A simple, consistent scoring method connected to your QMS processes is enough for most small and mid-sized organizations.

Your Next Step

Pull your current risk register and your last three nonconformities. Check whether each one links to a Risk ID. If none do, you have found the first improvement for your ISO 9001 risk assessment. Add a Risk ID field to your nonconformity, corrective action and complaint forms this week. Then bring the updated register to your next management review.

Disclaimer: This article and the downloadable template are general guidance based on ISO 9001:2015. Clause references are paraphrased, not reproduced from the standard. Confirm requirements against your purchased copy of the standard and your certification body's expectations. Using this template does not guarantee certification.