Risk and Quality Management in ISO 9001

In short: Risk management and quality management are two sides of the same coin. Risk management finds and controls the things that could go wrong, while quality management makes sure products and services consistently meet customer requirements. ISO 9001 links the two through risk-based thinking, so managing risk well is one of the most direct ways to protect quality.

We want to remind you of how risk impacts quality management and the effect on your business. The connection between risk and quality management is important for businesses as it directly affects your success. Risk management involves identifying and assessing potential risks that may negatively impact the business, while quality management involves ensuring that products or services meet the desired quality standards.

Effective risk management is necessary to identify potential threats and take steps to mitigate them. This involves implementing strategies to prevent risks from occurring, as well as having contingency plans in place in case risks do occur. Quality management ensures that products or services meet or exceed customer expectations, which can increase customer satisfaction and loyalty.

If a business does not effectively manage risk, it may suffer financial losses, damage to reputation, and legal consequences. Similarly, if a business does not prioritise quality management, it may result in dissatisfied customers, loss of reputation, and decreased sales.

In contrast, effective risk and quality management can help a business to achieve its objectives, minimise costs, increase productivity, and maintain a positive reputation. By implementing effective risk and quality management strategies, businesses can reduce the likelihood of negative consequences and increase their chances of success.

What is risk and quality management?

Risk management is the process of identifying, assessing, and prioritising potential risks that could have a negative impact on a project, organisation, or business. This involves developing strategies and plans to mitigate or minimise these risks, as well as monitoring and controlling them throughout the project or business lifecycle. For more on the kinds of risk a business can face, see our guide to types of risk businesses face.

Quality management, on the other hand, is the process of ensuring that products, services, or processes meet or exceed customer expectations and requirements. This involves implementing quality control measures, such as inspections and testing, as well as quality assurance processes, such as establishing standards and procedures to ensure consistent and reliable outcomes.

Risk management focuses on identifying and managing potential negative impacts, while quality management focuses on ensuring that positive outcomes are consistently achieved. Both are important aspects of effective project, organisational, and business management.

What risk management contributes to the quality management system

Risk management contributes to the quality management system by identifying potential risks that could impact the quality of products, services, or processes, and creating preventative strategies to minimise those risks. By proactively identifying and managing risks, businesses can reduce the likelihood of quality issues and ensure that products and services meet or exceed customer expectations. This can help to enhance customer satisfaction and loyalty, as well as protect your company’s reputation.

In addition, effective risk management can help you identify opportunities for improvement in your quality management system. By analysing the root causes of risks and implementing corrective actions, you are able to continually improve your processes and systems, resulting in higher levels of quality and efficiency.

Overall, risk management is an integral part of the quality management system, assisting you to identify and manage potential risks to quality, while also driving continuous improvement and increasing customer satisfaction.

Risk-based thinking in ISO 9001:2026

The process of risk management typically begins with risk-based thinking, which involves considering potential risks and their potential impact on the project, organisation, or business. This approach requires a proactive and systematic analysis of potential risks, rather than simply reacting to issues as they arise. This may involve developing contingency plans, implementing risk mitigation measures, or transferring risks to third parties through insurance or other risk transfer mechanisms.

Risk-based thinking is built into ISO 9001 itself. The current edition, ISO 9001:2026 (published in September 2026, replacing ISO 9001:2015), keeps the requirement to plan actions that address risks and opportunities, and to consider the organisation’s context and the needs of interested parties when doing so. Since the 2024 amendment, organisations must also consider whether climate change is a relevant issue for their management system. Our ISO 9001:2026 guide explains what the new edition means for certified organisations in South Africa.

By adopting a risk-based thinking approach, you can better anticipate and manage potential risks, leading to more effective risk management and improved outcomes. It can also help companies to identify opportunities for innovation and improvement, as they seek to manage risks more effectively and efficiently.

The benefits of risk management include

Reduced likelihood and impact of negative events: By identifying potential risks and implementing measures to mitigate or manage them, businesses can reduce the likelihood and impact of negative events such as accidents, project delays, and financial losses.
Improved decision-making: Effective risk management provides decision-makers with valuable information about potential risks and their potential impact, helping them to make informed decisions about resource allocation, project planning, and other key business activities.
Enhanced stakeholder confidence: By demonstrating a commitment to risk management, companies can enhance stakeholder confidence and trust, which can lead to increased investment, improved customer loyalty, and stronger partnerships.
Increased efficiency and productivity: Effective risk management can help companies to identify inefficiencies and areas for improvement, leading to increased efficiency and productivity and reduced costs.
Compliance with regulatory requirements: Many industries and jurisdictions require companies to have effective risk management processes in place to comply with legal and regulatory requirements. By implementing effective risk management practices, you can ensure compliance and avoid costly fines and penalties.
Improved innovation: By adopting a risk-based approach to decision-making, you can identify opportunities for innovation and growth, leading to new products, services, and business models.

Overall, effective risk management can help your business to achieve its strategic objectives, manage uncertainty and change, and ensure long-term sustainability and success.

At Newfil, we specialise in integrated risk assessment and risk profiling, disaster risk management plans and quality management systems. You can read more in our guide to integrated risk assessment and risk profiling.

Frequently asked questions

What is risk-based thinking in ISO 9001?

Risk-based thinking means considering what could go wrong (and what opportunities exist) before it happens, and planning actions to deal with it. ISO 9001 requires organisations to determine their risks and opportunities and plan proportionate actions to address them.

Does ISO 9001 require a formal risk register?

ISO 9001 does not prescribe a specific method such as a risk register. Organisations must show that risks and opportunities have been determined and addressed, and a simple register is often the easiest way to do that.

How is risk management different from quality management?

Risk management focuses on preventing or reducing negative events, while quality management focuses on consistently meeting customer requirements. In practice they overlap, because many quality failures start as unmanaged risks.

Did ISO 9001:2026 remove risk-based thinking?

No. Addressing risks and opportunities remains a core requirement in ISO 9001:2026, and it continues to link to the organisation’s context, interested parties and quality objectives.