In short
Clause 6.1 of the harmonized structure asks you to plan actions on risks and opportunities, integrate them into processes and evaluate their effectiveness.
The common text does not prescribe a matrix or software: what counts is a consistent, repeatable method.
ISO 31000 is not certifiable, but it is a solid reference for structuring your risk analysis.
Every action needs an owner, a deadline and an indicator to check whether it worked.
The analysis is updated when the context changes, at the management review and after significant nonconformities.
You do not need complex software to analyse risk: you need a consistent, up-to-date method. Many SMEs arrive at the audit with a spreadsheet of a hundred rows, filled in once and never opened again, or with a generic table copied from a template that says nothing about their company. In both cases the auditor notices the same thing: risks and opportunities have been listed, but they do not drive any decision.
In this guide we look at what ISO management system standards actually require, starting from the text shared by ISO 9001, ISO 14001, ISO 27001, ISO 45001 and the other standards built on the harmonized structure. Then we build a five-step method together, applied to a typical company: from choosing the criteria to the risk matrix, through to actions with an owner and an effectiveness check. You will also find the mistakes most often seen in audits and a checklist to tell whether your analysis is alive or just filed away. If you need a refresher on how certification works, start with our guide on what ISO certifications are.
What does the standard require on risks and opportunities?
The standard asks you to plan actions on risks and opportunities, not to fill in a register. This is clause 6.1 of the harmonized structure, the common text ISO uses for all management system standards.
In the version published by ISO, the clause starts from two inputs: the external and internal issues identified in 4.1 and the requirements of interested parties in 4.2. From there the organization determines the risks and opportunities that need to be addressed for three purposes: to give assurance that the system can achieve its intended results, to prevent or reduce undesired effects, and to achieve continual improvement. It must then plan three things: the actions, how to integrate them into the system's processes and how to evaluate their effectiveness.
Note what is missing from the common text: there is no obligation to use a matrix, a formula or software. In clause 6.1, the harmonized structure text does not even require specific documented information. Individual standards can, however, add their own requirements: ISO 27001, for example, requires a formal information security risk assessment and treatment process. The numbering of sub-clauses varies from standard to standard and between editions, but the underlying logic remains the same.
Risk and opportunity: the definitions that matter
In the harmonized structure, risk is defined as the effect of uncertainty. The notes specify that an effect is a deviation from the expected, positive or negative, and that risk is often expressed as a combination of the consequences of an event and the likelihood of it occurring.
This changes the way you work. A risk is not "a problem": it is a possible event that, if it happens, takes you away from the results you have set yourself. That is why the analysis always starts from your objectives and your processes, not from a generic list of misfortunes.
The term "opportunity", on the other hand, is not defined in the harmonized structure. The official guidance accompanying the text notes that the ordinary meaning of the word applies: a set of circumstances that makes it possible to do something. In practice, an opportunity is a favourable situation you can choose to exploit: a customer asking for a new service, an incentive for energy efficiency, a more reliable supplier available locally.
Where to start: context and interested parties
Risk analysis is the direct consequence of context. If clause 4.1 says that you depend on two customers for 60% of turnover, that fact must appear among the risks. If clause 4.2 says that customers expect on-time delivery and traceability, those requirements become criteria for assessing impact.
This is the link auditors check first: a context analysis and a risk table that do not talk to each other are a sign of a system written in silos. If you want to set this part up properly, we have a dedicated guide on context and interested parties.
Do you need ISO 31000 to get certified?
No: ISO 31000 is not certifiable, but it is the most solid reference for building a method. ISO says so itself: the standard provides guidelines, not requirements, and is therefore not intended for certification.
ISO 31000 offers principles, a framework and a process: establishing the context, identifying, analysing and evaluating risks, treating them, monitoring them and communicating them. It can be applied by any organization, of any size and sector. ISO presents it as a tool to integrate risk management into decisions, not as a separate compliance task.
For an SME seeking ISO 9001 or ISO 14001 certification, the message is reassuring. You do not have to "adopt ISO 31000" or demonstrate conformity with it. You can, however, take its logical structure (identify, analyse, evaluate, treat, monitor) as the backbone of your method. The guidance to the harmonized structure itself cites ISO 31000 and IEC 31010, which covers risk assessment techniques, as useful references.
The golden rule is proportion. A 20-person business does not need statistical simulations: it needs clear, repeatable criteria that two different people would apply and reach similar assessments.
A five-step method for your SME
An effective method for an SME fits into five steps and a single file. The tool matters less than consistency: a well-kept spreadsheet is worth more than complex software used badly.
Step 1: list risks and opportunities by process
Start from the process map, not from free brainstorming. For each process (sales, design, purchasing, production, delivery, human resources) ask yourself what could stop you achieving the expected result and what could help you exceed it.
Each entry should be written as cause, event and consequence. "Suppliers" is not a risk. "Our single sheet-metal supplier delivers late, production stops and we miss the dates promised to the customer" is. This wording forces you to be specific and makes the possible actions obvious.
Involve the people who work in the processes: the workshop supervisor knows the bottlenecks better than anyone. For an SME, an initial list of 15–25 entries is usually more than enough. If you go beyond fifty rows, you are probably listing operational details that belong in procedures, not in the analysis.
Step 2: choose simple criteria and write them down
The heart of the method is a shared scale. For an SME, a scale from 1 to 3 for both likelihood and impact works well, with concrete descriptions for each level.
For likelihood, for example: 1 = it has not happened in recent years; 2 = it has happened at least once; 3 = it happens several times a year. For impact: 1 = internal inconvenience that can be resolved within the day; 2 = a delay or cost the customer notices; 3 = loss of a customer, a penalty or a prolonged stoppage. The risk level is the product of the two values, from 1 to 9.
Then set an acceptance threshold: for example, from 6 upwards planned actions are needed; between 3 and 4 you monitor; below 3 you accept. Write these criteria on one page. It is the document that lets you explain to the auditor why you decided as you did, and it is what makes assessments comparable over time.
Step 3: decide on the actions
For each risk above the threshold, choose a strategy: reduce the likelihood, reduce the impact, transfer it (insurance, a contract), avoid the activity, or accept it with a stated reason. For each opportunity, decide whether and how to take it.
Every action needs four elements: what is done, who does it, by when, and how you will know whether it worked. "Improve supplier management" is not an action. "Qualify a second sheet-metal supplier by March, owner: purchasing" is.
Step 4: integrate the actions into your processes
The standard asks you to integrate actions into the system's processes, and clause 8.1 of the harmonized structure requires you to implement the actions determined during planning. In plain terms: the action does not live in the table, it lives in the process.
If the solution is a second supplier, its qualification goes into the purchasing procedure and the approved supplier list. If it is training, it goes into the training plan. If it is an extra check, it goes into the inspection plan. When the auditor follows a process and finds the action already built in, they have the best evidence that the analysis really drives the system.
Step 5: check effectiveness
The last step is the one most often skipped. For each action, define in advance the indicator that will tell you whether it worked: fewer delays, fewer complaints, a stoppage avoided.
After a reasonable period, reassess the risk using the same criteria. If the level has fallen, the action was effective. If nothing has changed, another action is needed. This documented reassessment is the difference between a table and a method.
A complete example: the matrix of a machining workshop
Let us see the method applied to a typical company: a precision machining workshop with 35 employees, working to order for three large automotive customers and seeking ISO 9001 certification.
The context analysis brings out a few facts: a single supplier of special sheet metal, only one experienced CNC programmer, growing customer demand for batch traceability, and a regional incentive for upgrading machinery. Here is part of the resulting matrix, using the 1–3 scale described above.
Entry | Type | L | I | Level | Action | Owner | Check |
|---|---|---|---|---|---|---|---|
Single sheet-metal supplier late, production stoppage | Risk | 2 | 3 | 6 | Qualify a second supplier | Purchasing | Days of stoppage due to lack of material |
Only CNC programmer absent for a long period | Risk | 2 | 3 | 6 | Shadowing and written instructions for the main programs | Production | Second person independent on key programs |
Untraced batches, complaint cannot be reconstructed | Risk | 2 | 2 | 4 | Monitor customer complaints and requests | Quality | Complaints with no identified cause |
Measurement error on a critical dimension | Risk | 1 | 3 | 3 | Monitor through existing inspections | Quality | Inspection results |
Incentive to upgrade machinery | Opportunity | 3 | 2 | 6 | Assess the application and submit it | Management | Application submitted and outcome |
Let us read it as an auditor would. The two risks at level 6 have concrete, measurable actions, with an owner. The traceability risk, at level 4, is monitored: this is consistent with the chosen threshold, and if customers raised their demands it would move up a level. The measurement risk has a high impact but low likelihood, and existing inspections are enough: accepting it with a stated reason is a legitimate choice.
Six months later, the workshop reassesses. The second supplier is qualified and there have been no stoppages for lack of material during the half-year: likelihood drops from 2 to 1, and the level from 6 to 3. The programmer now has a colleague able to handle the main programs: here too the level falls. Every reassessment carries a date and a reference to the evidence. This is the kind of trail over time an auditor expects to see.
Why L and I are not enough on their own
A word of caution about the example: the numbers help you rank priorities, not replace judgement. A risk at level 3 but with impact 3 (a serious accident, a penalty) may still deserve an action, even if the formula leaves it below the threshold.
That is why many SMEs add a simple rule: every impact of 3 is discussed by management, whatever the likelihood. It is a correction that does not complicate the method and stops rare but serious events from "slipping through". This rule should also go on the criteria page, so that whoever reassesses in a year's time applies it in the same way.
How to handle opportunities without leaving them at the bottom of the table
Opportunities deserve the same seriousness as risks: action, owner, check. Many companies note them at the bottom of the table and then forget them, and this is one of the most common findings.
The sources of opportunities are often the same as those of risks, seen from the other side. A customer request for traceability is a risk if you are not ready, but an opportunity if you become the most reliable supplier in the sector on that point. ISO's guidance to the harmonized structure lists typical sources such as analysis of deviations, review of the context and of interested parties' needs. In practice, every change in context deserves the question: is there a risk, an opportunity, or both?
To assess an opportunity you can use a mirror scale: the likelihood of being able to take it and the expected benefit. There is no need to complicate things. What matters is that there is an explicit decision at the end, even a decision not to proceed, with its reason. An opportunity assessed and set aside for good reasons is a sign of a mature system; an opportunity written down and never discussed is not.
When should you update the risk analysis?
The analysis should be updated when something relevant changes, and in any case reviewed at planned intervals. The common text sets no fixed frequency, but there are moments when an update is unavoidable.
The moments that trigger an update
The first is change. The harmonized structure requires changes to the system to be planned (clause 6.3) and, in operations, the consequences of unintended changes to be reviewed. A major new customer, a new process, a supplier leaving the market, an acquisition: these are all events that change the risk profile.
The second is the management review. Among the elements the harmonized structure requires you to consider are changes in external and internal issues and in the needs of interested parties: exactly the inputs the analysis is built on. It is the natural moment to reread the matrix and decide the year's priorities. We cover this in detail in the guide to the management review.
The third is nonconformities and complaints. A problem that has occurred is proof that a risk was underestimated or had not been seen. When you analyse the causes, always ask whether the matrix needs updating: it is the bridge between corrective action and root cause analysis and planning.
A sustainable rhythm for an SME
A two-tier rhythm works well for an SME. A full review once a year, linked to the management review. Targeted updates whenever one of the events described above occurs.
What matters is leaving a trail: date of the reassessment, what changed, who decided. A matrix with every assessment frozen at the date of first certification tells the auditor that the system is not watching reality, even if the processes work well.
The mistakes an auditor spots straight away
Mistakes in risk analysis are almost always about method, not content. Here are the ones that come up most often during audits.
The first is the generic table. Risks such as "economic crisis" or "pandemic", identical in companies from different sectors, do not show that you have looked at your processes. The second is the matrix without actions: levels calculated carefully and no practical consequence. The third is the action without a check: something was done, but nobody verified whether it worked.
Then there is the disconnect from context, which we discussed above: external and internal issues listed in 4.1 that appear nowhere in the matrix. And there is the opposite problem, excess: a two-hundred-row analysis that nobody can maintain and that becomes out of date after three months.
Finally, the analysis written by one person alone. If the Quality Manager fills in the matrix single-handed, the information held by department heads is lost and management does not recognise itself in the decisions. During the audit, the auditor often asks a department head what the main risks of their process are: if the answer does not resemble the matrix, genuine involvement is missing. To see how these topics fit into a complete quality system, read our guide to the ISO 9001 quality management system.
How Complaion helps you keep your risk analysis alive
With Complaion, risk analysis does not remain an isolated file: it becomes part of the system you use every day. The work rests on two elements: a dedicated Lead Auditor who follows your company and a platform that collects evidence, manages documents and keeps the compliance calendar.
The Lead Auditor sets up criteria with you that are proportionate to your business, helps you link the matrix to context and interested parties, and flags where an action has no check. On the platform every action has an owner and a deadline, effectiveness evidence is stored in the same place and reassessments are scheduled in the calendar, alongside the management review and internal audits. When the audit comes round, the documentation is already ready and in order.
Complaion proposes the route best suited to your company's needs and has already supported more than 1,000 clients towards certification and its maintenance. If you want to understand how to set up risk analysis in your system, contact us for an initial conversation and a tailored quote.
Frequently asked questions on risks and opportunities in ISO standards
Is a risk matrix mandatory for ISO certification?
No, the common text of ISO management system standards does not prescribe a specific tool. It requires you to determine risks and opportunities, plan actions, integrate them into processes and evaluate their effectiveness. A likelihood-by-impact matrix is, however, the simplest way to make the method repeatable and explainable. Some standards, such as ISO 27001, add more formal requirements on risk assessment.
What is the difference between risk and opportunity?
In the harmonized structure, risk is the effect of uncertainty, that is, a deviation from the expected, positive or negative. Opportunity has no definition of its own and keeps its ordinary meaning: a favourable circumstance you can choose to exploit. In practice, risk threatens your results and opportunity can improve them. Both require a decision and, if you choose to act, an action with an owner.
Do I need to follow ISO 31000 to get certified?
No. ISO 31000 provides guidelines, not requirements, and ISO itself states that it is not intended for certification. It can nonetheless be an excellent reference for building your method: its process of identification, analysis, evaluation, treatment and monitoring suits a small business well too.
How often should the risk analysis be updated?
The common text does not set a frequency. For an SME, a full review once a year, linked to the management review, works well, plus updates whenever something relevant changes: a major new customer, a new process, a significant nonconformity, a change of critical supplier. What matters is keeping a record of dates, changes and decisions.
How many risks should an SME's analysis contain?
There is no right number. For an SME, a list of 15–25 well-worded entries is often enough to cover the main processes. A much longer analysis tends to mix strategic risks with operational details and becomes hard to maintain. A few entries linked to context and with real actions are better than dozens of rows nobody rereads.
Who should take part in the risk analysis?
The analysis works when it involves management and process owners. Management brings the view on objectives, customers and the market; department heads know the concrete problems. The Quality Manager coordinates and ensures the criteria are applied consistently. A matrix written by one person risks not reflecting the reality of the company.
What does the auditor check in the risk analysis?
The auditor checks that the analysis is linked to context and interested parties, that the criteria are clear and consistently applied, and that the main risks have concrete actions. They then follow the actions into the processes and look for evidence of effectiveness. They often also ask department heads what the risks of their process are, to see whether the analysis is shared.
