Risk-Based Thinking in ISO 9001

ISO 9001:2015 replaced the formal preventive action requirement with risk-based thinking — a more flexible, proactive approach to identifying and addressing what could go wrong before it does.

Where risk-based thinking appears in ISO 9001

Clause	Risk-based thinking requirement
4.1	Identify internal and external issues that affect the QMS
4.2	Identify interested parties and their requirements (risks if not met)
6.1	Determine risks and opportunities; plan actions to address them
8.1	Plan processes with criteria including risk consideration
9.1	Monitor and evaluate risks as part of performance evaluation

Risk treatment options

Avoid: stop the activity that creates the risk
Mitigate (reduce): lower probability or severity through controls
Transfer: shift the risk (insurance, outsourcing)
Accept: tolerate the risk when treatment cost exceeds benefit

Risk vs opportunity

ISO 9001 requires addressing both risks (what could go wrong) and opportunities (what could go right). An opportunity might be a new technology, a supplier that could improve quality, or a process change that reduces defects.

CQE exam tips

ISO 9001:2015 does not require a formal risk register or risk matrix — just that risks and opportunities are determined and addressed.
"Risk-based thinking" replaced "preventive action" as Clause 8.5.3 in ISO 9001:2008.

Take the Free Quiz →

More: 5 Whys · 8D problem solving · AOQ & AOQL · APQP & PPAP · AQL sampling plans · Attribute agreement & kappa · Attribute control charts · Availability & maintainability · Benchmarking types · Binomial vs Poisson · Blocking & randomization · Calibration & traceability · Capability: non-normal · Chi-square test · Confidence intervals · Control chart selection · Control plan · CA effectiveness · Cost of quality · Cp vs Cpk vs Cpm · Cpk vs Ppk · CQE exam day tips · CQE study plan · CQE vs CQA vs CSSBB · Is the CQE worth it? · CUSUM & EWMA · Design reviews · Design V&V · Destructive testing · DFMEA vs PFMEA · Document control · Fault tree analysis · First article inspection · Fishbone diagram · FMEA: RPN vs AP · Full vs fractional factorial · Gage R&R · GD&T basics · Hazard vs risk vs harm · Hypothesis test selection · I-MR chart · Interaction plots · ISO 14971 · ISO 9001 clauses · Kaizen event planning · Kano model · Lean wastes (TIMWOODS) · Linear regression · Management review · MRB dispositions · MSA: bias, linearity & stability · NCR, CAPA & PA · Nonparametric tests · Normal distribution & z-table · One-way ANOVA · p-value explained · Pareto chart · PDCA vs DMAIC · Poka-yoke · QFD / House of Quality · Quality audits · Quality mgmt principles · Quality manual vs procedures · Quality plan vs control plan · Redundancy: parallel & standby · Reliability allocation · Bathtub curve & MTBF · Response surface methods · Risk-based thinking · Risk matrix vs FMEA · 7 mgmt & planning tools · Short-run SPC · Six Sigma certifications · Sigma level & DPMO · Six Sigma DMAIC · Supplier quality scorecards · Switching rules (sampling) · Taguchi loss function · Theory of constraints · Tolerance stackup · Traceability & lot control · Type I vs II error · Value stream mapping · Variables vs attributes · Weibull analysis · Western Electric rules · X-bar R vs X-bar S · CQE calculators · Study planner · Section quiz