Risk Is Not Opportunity. ISO 9001:2026 Split Clause 6.1. Now Build a Pipeline With Owners.

The Problem: Opportunities that only exist as a column

Last issue we covered the culture clauses in ISO 9001:2026. The change that will catch more systems in a routine audit is quieter: Clause 6.1 no longer lets opportunities ride along inside the same action plan as risks.

ISO's own summary of the revision calls out a clearer distinction between managing risks and pursuing opportunities. DNV describes it the same way: a clearer separation of risks and opportunities in Clause 6.1, with new subclauses 6.1.1 to 6.1.3 and expanded Annex A guidance. Transition still runs three years — ISO 9001:2015 certificates stop being valid after 30 September 2029 — but the finding does not wait for 2029. It waits for the first auditor who asks one question.

That question is: name an opportunity you acted on in the last year, the process it changed, and the measure that says whether it worked. If the answer starts with "we added a column," you are not ready.

Naming the failure: The Empty Opportunity Column

We call this The Empty Opportunity Column. It happens when an organization keeps one risk-and-opportunity register, fills dozens of risk rows with severity and likelihood, and leaves two opportunity rows that were typed in because a 2015 auditor asked. No analysis. No owner. No date. No effectiveness check.

Under ISO 9001:2015 that register often passed, because actions for risks and opportunities lived in the same planning clause. Under ISO 9001:2026 they do not. Opportunities get their own actions subclause, and the effectiveness of those actions shows up as its own input in performance evaluation and management review. A column headed "Opportunity" next to each risk is not a population of opportunities. It is a formatting trick.

Risks protect what you already promised. Opportunities change what you are able to deliver. Treating them as the same worksheet teaches the organization that improvement is optional paperwork, while risk is the real work. That is how Kaizen gets starved of owners and dates.

What Clause 6.1 looks like now

Before you rewrite procedures, get the structure straight. Based on ISO's public summary, DNV's transition notes, and NQA's transition materials, the practical shape of Clause 6.1 in 2026 is:

Subclause	Focus	What "done" looks like on the floor
6.1.1	Determine risks and opportunities from context (4.1) and interested parties (4.2).	Two clear populations, each with a named source.
6.1.2	Actions to address risks — analyze, evaluate, integrate into processes, check effectiveness. Notes now call out disruption and continuity.	Risk actions live in SOPs, supplier rules, or contingency plans — not only in a spreadsheet.
6.1.3	Actions to address opportunities — same discipline, sized to your context. Notes point to new practices, products/services, partnerships, and emerging technology.	Each opportunity has an owner, a date, a process it changes, and a measure.

ISO also stresses that Annex A is informative guidance, not new requirements. Use it to understand intent. Do not invent a 200-row register because a consultant sold you one. Proportionality still matters: actions should match the effect on the results your QMS is meant to achieve, not just product conformity in isolation.

The real cost of burying opportunity inside risk

If you leave opportunities as afterthoughts, you pay in three places. First, audit time: separate effectiveness checks in Clauses 9.1.3 and 9.3.2 mean a single "risks and opportunities reviewed, no change" line in management-review minutes is a soft target. Second, leadership credibility: Clause 5.1.1 now asks top management to promote opportunity-based thinking alongside risk-based thinking. A plant manager who only ever asks "what could go wrong?" is not modeling the new requirement. Third, and most expensive, you leave improvement capacity unused while your Kaizen system competes with firefighting for attention.

The plants that already run a good A3 or suggestion system are closer than they think. The gap is usually governance, not ideas: no threshold for which opportunities get action, no owner, no link back into a process, and no effectiveness number that reaches management review.

Operationalizing the shift: 4 ways to build an opportunity pipeline

Lean already gives you the mechanics. Treat opportunities like a controlled pipeline, not a wish list:

Split the register into two populations: Move every opportunity out of the risk list into its own tab or board. If you have fewer than a handful, hold a 30-minute session using Annex A's sources — context, interested-party needs, capability and capacity, and monitoring results — and capture what people already know.
Score benefit and feasibility, not likelihood and severity: Opportunities are not risks with the sign flipped. Write one sentence for the opportunity threshold: which ratings get action this quarter, which get watched, which get declined by an informed decision. That sentence is your proportionality evidence.
Put every accepted opportunity into a process: An action that exists only in the register has not been integrated. Tie each one to a work instruction, inspection step, supplier approval rule, training plan, or standard work change — the same way you close a Kaizen.
Feed two management-review inputs: Effectiveness of risk actions and effectiveness of opportunity actions should appear as separate lines, with data. Your Kaizen log, A3 closures, and suggestion results are natural evidence for Clause 10.1 continual improvement when they are tagged to an opportunity row.

Practical takeaways for this week's Gemba walk

You do not need a consultant kickoff to start. On your next walk, try these three things:

Run the one-question test: Ask three leaders, including one from outside quality, to name an opportunity acted on in the last year, the process that changed, and the measure of success. Write the answers down. Silence is your gap.
Count the opportunity rows: Open the live risk register. Count risk rows versus opportunity rows with an owner and a due date. If opportunity rows with owners are near zero, that is the transition project, not a poster rewrite.
Split one management-review agenda line: Change the next review pack so "risks and opportunities" becomes two inputs. Bring one real opportunity with a measure, even if the pipeline is still thin. Practice beats a future finding.

The next challenge is management of change

Once opportunities have owners, the next weak link is how you plan changes to the QMS itself. Clause 6.3 was reinforced in the 2026 edition so changes still achieve intended results. In our next discussion, we will look at how to connect opportunity actions, temporary deviations, and permanent standard-work updates into one management-of-change trail an auditor can follow without a scavenger hunt.

Next Issue Preview

Next up: Clause 6.3 and the change trail. ISO 9001:2026 strengthens planning of changes to the QMS, and we look at how to keep opportunity actions, deviations, and standard-work updates from becoming orphan decisions. Stay tuned.

Call to Action

Can your team pass the one-question opportunity test today? Tell me how you separate risk actions from opportunity actions, and what measure reaches management review. P.S. Share this with the owner of your risk register before the next internal audit.

Newsletter replies and questions: [email protected]
Follow updates on X.com: @kaizen_6sigma