Objectives, Risks and Opportunities: clause 6 from the project list – in two hours

17 modules · about 97 minutes · final test with 38 questions, 31 correct to pass · certificate of participation as PDF

What this course is about

Clause 6 of ISO 9001 – risks and opportunities, quality objectives, planning of changes – is the clause that small companies most often copy from the internet and that auditors see through most quickly. This course shows the way that has survived audits for years: the risk and opportunity analysis does not come from brainstorming but from the list of projects and investments the company plans or has implemented anyway.

No registration needed. We only ask for your name and e-mail address before the final test – just for your certificate. Your progress is saved in this browser. You can stop at any time and continue later.

Module 1 of 17

Clause 6: the steering clause — and why it does not work from the internet

Clause 6 is short — two pages in the standard — and decides whether a QMS steers the company or only describes it. It requires three things: determine risks and opportunities and plan actions for them (6.1), set quality objectives that are measurable and fit the policy (6.2), and carry out changes to the system in a planned way (6.3). All three hang on a chain that the auditor follows in stage 2:

Why the internet list fails: a copied risk analysis has twenty rows (“skills shortage”, “cyber attack”, “economy”), rating 2 × 2 everywhere, and no action that anyone in the company knows. The auditor takes one row and asks: “What did you last do about that?” — silence is a nonconformity against 6.1.2 (plan and implement actions). The opposite is a list with eight rows, behind each of which stands a project the boss is doing anyway: the new milling machine, the electric vehicles, the second supplier, the training of the site managers. That is risk-based thinking as the standard describes it in Annex A.4 — without a formal method, without a risk register under ISO 31000.

The method of this course in one sentence: the company's project and investment list is the source; every project is entered as an action, and the topic column answers the question which risk it prevents or which opportunity it uses. That way an analysis emerges in two hours that survives every audit day, because it describes the company — not the world.

Time needed per year: creation two hours, update before the management review one hour. More is not appropriate in a company of up to 50 employees — and the standard expressly requires proportionality (6.1.2: actions “proportionate to the potential impact”).

Module 2 of 17

The project and investment list as the source

Every company has it — as a note on the boss's desk, as an investment plan for the bank or only in the head: the list of what is running now and what comes next. This list is the risk and opportunity analysis before it is written. Because nobody invests without a reason: the new machine comes because the old one fails (risk) or because a customer wants to order more (opportunity). The training comes because a regulation requires it (risk) or because a new line of business beckons (opportunity).

The list in two parts — this later steers the status:

What belongs in it: machines and equipment · vehicles · software and IT · buildings and locations · people (hiring, succession, training) · organisation (new role, new service, outsourcing) · certifications and approvals · energy and environment (solar, LED, heating) · sales and market (new customer group, website, trade fair). Guide value: eight to fifteen entries. A company with three entries does not have too few risks — it has not written the list down completely.

What does not belong in it: day-to-day business (“deliver orders on time”), wishes without a decision (“digitalise some day”), requirements of the standard as a project (“create risk analysis”). And: take every project literally, as the boss calls it — do not translate it into the language of the standard. “New milling machine manufacturer X” stays “New milling machine manufacturer X”.

📄 Template project and investment list (Excel, two parts) (German – English version to follow)

For the update: every year before the management review the list is extended by the new projects; implemented ones move from “planned” to “implemented”. That is at the same time the evidence for 6.1.2 b (evaluate effectiveness) and 9.3.2 e (effectiveness of actions on risks and opportunities).

Module 3 of 17

The assignment rule: risk or opportunity — never both

The one rule almost everyone breaks the first time: a project appears exactly once in the analysis — as an action, in exactly one of the two tables. Not as risk and opportunity, not repeated in the topic column, not twice with different words. Otherwise a list emerges in which every second row is the same, and the auditor asks why the new software is supposed to be a risk.

The control question: What happens if we do not do the project?

The topic column is always the reason — one or two sentences, worded as a risk or an opportunity, with the roles, customers and regulations of the sector, without the project name. Wrong: “Risk: new software”. Right: “Duplicate data entry and scheduling errors due to route planning on paper; customers expect reliable service times.”

Examples — this is what the assignment looks like in practice:

Two similar projects (say two actions for employee retention) may be spread over both tables so that both are filled — then the reason must fit the respective table.

📄 Assignment rule with 30 example projects from four sectors (German – English version to follow)

The test: read out the topic column of a row without the action. Does a colleague recognise why the project is necessary? Then the row is right.

Module 4 of 17

Rating risks: probability × escalation level

The standard requires no numbers. But without numbers nobody can say which of the eight risks needs an action first — and that is exactly what the auditor asks. The scale that has proven itself in small companies is deliberately coarse: two factors, product, traffic light.

Probability (how often does the event occur without the action?):

Escalation level (what does an occurrence cause?):

Result = probability × escalation level (1 to 12). Traffic light: up to 3 green (observe), 4 to 5 amber (plan an action), from 6 red (action with deadline into the action plan).

Three plausibility rules that the auditor has in mind:

1. A commissioned project has a result of at least 4. Otherwise the boss would not have spent the money. Anyone who writes 1 × 2 behind an investment of 30,000 contradicts himself.
2. 1 × 1 practically does not exist when a project stands behind it; the standard row “no risk identified” gets no rating (the cells stay empty).
3. Regulatory and safety risks get escalation level 4 — missing qualification (first aiders, qualified electrician, driving licence), working time violations, hazardous substances, minimum wage, data protection. Not because the damage is always catastrophic, but because a violation cannot be remedied “a little”.

Rate before or after the action? Before the action — the analysis justifies why the action is necessary. That the action works is shown by the status column (“done”) and the effectiveness evaluation in the management review. Anyone who rates “after the action” has nothing but green rows and cannot explain why he invested.

📄 Rating scale for risks and opportunities — legend to print out (German – English version to follow)

Module 5 of 17

Rating opportunities: realisation × benefit

In the standard opportunities have equal rank with risks — in most analyses they nevertheless stand as an afterthought with two rows at the end. Yet opportunities are what the boss likes to talk about: the new customer, the third location, the website, the subsidy. The project list delivers them free of charge; the rating is simpler than for risks.

Realisation (how likely does the benefit occur if we do the project?): 1 low · 2 medium · 3 high.

Benefit (what does it bring?):

Result = realisation × benefit (1 to 12); from 6 the opportunity belongs in the action plan with a deadline, because otherwise it fizzles out. Benefit level 4 exists at most once per analysis; anyone who assigns it three times has no priorities.

Typical opportunities in small companies (from more than 1,000 analyses): new customer group or region · digitalisation of a process (time saving) · energy and cost saving (ESG) · qualification for a new service offering · certification as market access · employee retention (benefits, working time models) · public funding programmes · partnerships and cooperations.

Why underrated: opportunities have no deadline and no pain. Hence the rule: every opportunity with result ≥ 6 gets a deadline and a responsible person like a risk — otherwise it stands unchanged in the list next year, and the auditor asks what became of it (9.3.2 e).

Module 6 of 17

Filling the table: columns, areas, status, standard rows

Two tables, one legend sheet — the analysis is no more than that. The columns are chosen so that every row answers the auditor's questions: whom does it concern? What is the risk? How bad? What do we do? By when? Who? Is it in place already?

Risk analysis (10 columns):

Opportunity analysis (9 columns): area · opportunity · realisation · benefit · result · action · deadline · responsible · status — without corrective actions.

Pool of areas: employees · customers / end users · suppliers / partners · market · competitors · products · location · management · company / shareholders · authorities · banks · environment · surroundings / neighbourhood · associations · data protection · QM system · objectives · social · employees / occupational safety. The same pool as for the interested parties in the manual — that way 4.2 and 6.1 interlock.

Standard rows: for banks, suppliers / partners, surroundings / neighbourhood and associations one row each at the end of every table: “No risk identified.” or “No opportunity identified.”, rating empty, status done. That demonstrates that the party was considered — the standard requires determination, not invention. If one of these parties already has a project assigned (say a supplier), its standard row is dropped.

Gap rule: what cannot be substantiated (status unclear, deadline unknown) is not guessed but entered as “[please complete — reason]” and clarified before approval. Guessed deadlines are the most frequent nonconformity in updates: the auditor asks about the deadline that passed long ago.

📄 Template risk and opportunity analysis (Excel: legend, risks, opportunities, formulas and traffic light) (German – English version to follow)

Order of the rows: first the project rows in the order of the project list, then the standard rows. No sorting by result — the list should read along with the project list.

Module 7 of 17

Thinking ESG along: energy, environment, social and climate change in the context

Since the Amendment 2024 clause 4.1 contains the sentence that the organisation must determine whether climate change is a relevant issue — and 4.2 that interested parties can have requirements related to climate change. The 2026 edition takes up sustainability expressly. For a small company that does not mean environmental management; it means that the analysis shows that the question was asked.

Practical rule: every project that touches energy, environment, climate, occupational safety or social matters gets the prefix “ESG:” in the topic column (for social matters “ESG (social):”). The assignment risk/opportunity does not change as a result.

Climate change as a context issue — the minimum answer: one row in the context table of the manual (“External issues: climate change — hot days in the hall, energy prices, customer requirements on sustainability”) and, if a project exists for it, an ESG row in the analysis. If none exists, the management review contains one sentence: “Climate change considered; currently no need for action beyond the ESG actions.” That satisfies the standard.

Boundary: an environmental aspects assessment (ISO 14001) or energy review (ISO 50001) is something else — with its own scales and duties. Anyone certified only to ISO 9001 does not need them; anyone adding ISO 14001 keeps the ESG rows in the same table and adds the environmental aspects as a sheet of its own.

📄 ESG checklist: 19 projects that touch energy, environment and social matters — with assignment (German – English version to follow)

Module 8 of 17

Measurable quality objectives: the six columns and the six standard objectives

Clause 6.2 is precise: objectives must be consistent with the policy, measurable, monitored, communicated and updated (6.2.1) — and for every objective it must be determined what will be done, what resources, who, by when and how the result is evaluated (6.2.2). Those are exactly the six columns of the objectives table:

These are the six standard objectives with which almost every small company starts — because they are measurable without new counts having to be introduced: turnover is in the management accounts, quotations and complaints in the filing, grades in the customer and supplier evaluation. In addition come one to three company-specific objectives from the project list: opportunities with result ≥ 6 become an objective (“Third location opened by 30 Sep”), risks with level 4 likewise (“All site managers first aiders by 31 Mar”).

Three errors auditors see immediately: an objective without a number (“increase customer satisfaction”) · an objective without an action (then it is a hope) · an objective that does not fit the policy (the policy promises on-time delivery, no objective measures it).

📄 Template objectives and process KPIs (Excel) with the six standard objectives (German – English version to follow)

In a small company the MD is responsible — even if the foreman implements the action. The delegation is in the action column or in the action plan; responsibility for the objective stays at the top. That way the auditor asks the right person.

Module 9 of 17

Objectives from policy and process KPIs — and the deadline rule

The standard requires that objectives are “consistent with the quality policy” (6.2.1 a) and that the policy “provides a framework for setting quality objectives” (5.2.1 b). The simplest test: every promise in the policy must have an objective, every objective a sentence in the policy.

One KPI per process: one per process is enough (module “Process list” in the manual course). The KPIs of value creation (on-time delivery, complaints, quotation hit rate) almost always become objectives; the KPIs of management and support processes (audit coverage, calibration on-time rate) become objectives only if they were missed in the previous year.

The deadline rule — so that not every objective has a different deadline and the management review can evaluate all of them at once:

Example: objectives table with status October 2026 → all deadlines 31 Dec 2027, heading “Objectives 2027”. No other deadlines — not “12/2026”, not “ongoing”, not “Q2”. Exception: a project objective with a real deadline from the project list (“Location opened by 30 Sep”) may keep its deadline.

Monitor and communicate (6.2.1 e, f): actual values quarterly into the column “result” or on the KPI sheet, discussion with a line in the minutes. The auditor asks: “Where do you stand today?” — an objective whose actual value nobody knows is a nonconformity against 6.2.1 e, not against the objective itself.

Module 10 of 17

Two versions every year: review with result, outlook with deadline

Objectives “shall be updated as appropriate” (6.2.1 g), and the management review must consider “the extent to which quality objectives have been met” (9.3.2 c 2). Both together give an annual rhythm with two versions of the same table:

Filling in the review — rules: fill only empty result cells, never overwrite existing entries. Every result with the actual value, not just “achieved”. An unachieved objective is not a nonconformity — an unachieved objective without evaluation in the management review is one. There it says: cause, decision (carry over, adjust, delete the objective), action.

Creating the outlook — three decisions per objective:

Evaluation periods, so that objectives, supplier evaluation and customer satisfaction fit together: status of the documents January to June → evaluation period whole previous year; July to December → first half of the current year. The heading of the respective table states the period expressly.

Filing: both versions with the status in the file name (Objectives_2026_Review_2027-01-15.xlsx, Objectives_2027_2027-01-15.xlsx) in folder 05 Management. The review file is the record under 9.1.1, the outlook the documented information under 6.2.1.

Module 11 of 17

The link to the action plan: what happens from result 6

The analysis rates, the action plan tracks. Maintaining both documents without them contradicting each other works with one rule: every row of the analysis with result ≥ 6 and status “in progress” is at the same time a row in the action plan — with source “Risk R3” or “Opportunity O2”, responsible person (here delegation is allowed), deadline and effectiveness evaluation.

Follow the one-plan rule: one action plan for everything — audit, complaint, risk, opportunity, objective, management review — with a column “source”. Five lists in five places are the most frequent reason why actions stand out in the audit as “not tracked”.

Corrective actions (column G of the risk analysis) stay empty as long as the risk has not occurred. If it occurs (the machine fails, the supplier does not deliver), the reaction is entered there and treated as a nonconformity under 10.2: cause, action, effectiveness. The preventive action stays — it was evidently not sufficient, and that goes in the next management review.

Evaluating effectiveness (6.1.2 b): three months after “done” one line: what has changed measurably? No more failures, complaints from 5 to 2, fuel costs minus 18 %. Without this line the action is done but not evaluated — and 9.3.2 e requires exactly the evaluation.

The course “Management Review and Year End” shows the action plan in detail; here the rule ≥ 6 is enough.

Module 12 of 17

What the auditor asks about clause 6 — and which records he wants to see

Auditors do not check clause 6 on the document but along the chain: they take one row and follow it to the effect. Anyone who can substantiate the row has passed clause 6; anyone who only shows the document has not.

The clauses that are checked:

Typical questions (from real audits, anonymised):

• “Show me your list of risks and opportunities: which entry did you last adjust, why, and what became of it in day-to-day business?” → analysis with status, action plan row, evidence of implementation.
• “Let's take your last major investment: which risks and opportunities did you evaluate beforehand?” → the row of the analysis in which the project stands as an action.
• “Let's take your most important quality objective from the beginning of the year: where do you stand today, and what did you do when you noticed it was getting tight?” → actual value, line in the minutes, action.
• “Let's take your most critical component that comes from only one supplier: what happens in case of failure?” → risk row with action “second supplier” or a deliberate decision with reasoning.
• “How did you plan the introduction of the new software — purpose, consequences, responsibilities?” (6.3) → minutes.

The four most frequent nonconformities: risks without action (6.1.2 a) · actions without effectiveness evaluation (6.1.2 b) · objectives without actual value (6.2.1 e) · objectives without measure (6.2.1 b). All four are fixed in ten minutes if the tables are built according to this course.

📄 Twenty audit questions on clause 6 with record — for self-assessment (German – English version to follow)

Answer in five minutes: open the analysis, project list next to it, action plan with it, objectives table review and outlook. With these four files clause 6 is dealt with in five minutes in every audit — that is the yardstick.

Module 13 of 17

Planning of changes (6.3): the forgotten clause in one paragraph

Clause 6.3 is three lines long and is asked about in every second audit — usually with the sentence: “You changed your software last year. How did you plan that?” The standard wants four things: purpose and potential consequences, integrity of the system (does the rest keep running?), resources, responsibility.

Which changes are meant: changes to the QMS — new service or product group, new location, new software for orders or tickets, new role or removal of a role, outsourcing of a process, change of certification body, transition to a new edition of the standard. Not meant: changes to an individual order — that is 8.5.6 and is in the order file.

The four-question line — in the minutes of the team meeting; a small company needs no more:

Here too the project list supplies the candidates: every project that changes a process in the manual gets this line. After implementation the new status goes into the manual's change register — and with that 6.3 is demonstrated without a single new form.

The link to the 2026 transition: the transition to ISO 9001:2026 is itself a change under 6.3 — purpose (keep the certificate), consequences (new requirements on climate change, quality culture, ethics), resources (training, adaptation of the manual), responsibility (MD). The course “Transition to ISO 9001:2026” shows the way.

Module 14 of 17

The ten most frequent errors in risk analyses and objectives tables

Ten errors that together account for more than 90 % of the findings on clause 6 — with the sentence that prevents them.

The ten-minute check before the audit: take the analysis and strike out every row for which you have no answer to “What did we last do about that?”. What remains is your analysis. If fewer than five rows remain, you do not have too few risks but have not used the project list — back to module 2.

What is not an error: a short list. Six risks, four opportunities and four standard rows are appropriate for a company with 15 employees — and the standard requires appropriateness, not completeness.

Module 15 of 17

Case study: Klarblick Building Services — twelve projects, one analysis, eight objectives

Klarblick Building Services (fictitious) in Regensburg, Germany, offers with 38 employees routine cleaning, glass cleaning, caretaker services and site security for office and industrial customers. Two site managers, one night shift, three vehicles, status of the documents: October 2026. For the management review management has written down this project list:

Already implemented (2026): 1. Two electric vehicles bought for the site managers 2. Route planning software introduced 3. Site manager training “Complaint conversation” 4. Minimum wage documentation switched to a time recording app 5. First aid training for three employees of the night shift 6. Second supplier for cleaning agents added

Planned (2027): 7. Third location in the neighbouring district 8. Briefing app for new cleaning staff (multilingual) 9. Switch cleaning agents to concentrates 10. Second site manager for the night shift 11. Certification to ISO 9001 12. Bicycle leasing offer for all employees

Your task (60 minutes): assign every project exactly once (risk or opportunity), word the reason in the topic column with roles and customers of the sector, rate according to modules 4 and 5, set status and ESG prefixes, add the standard rows, and derive the objectives 2027 from it (status October → deadline 31 Dec 2027). Also create the review 2026 for the six standard objectives with these actual values: turnover +7 %, quotation hit rate 34 % (objective 40 %), complaints 9 (objective max. 6), customer satisfaction 3.8 (objective better than 4 — smaller number is better), supplier evaluation 2.9, certification not yet.

📄 Klarblick: project list, model solution of the analysis with reasoning per row (German – English version to follow)

📄 Klarblick: objectives 2026 review and objectives 2027 outlook — model solution (German – English version to follow)

The three places where most participants deviate: project 5 (first aiders) is a risk with level 4, even if it concerns “only” three people · project 7 (location) is an opportunity with benefit 3, not 4 — the 4 would be a one-off opportunity, a location is repeatable · project 12 (bicycle leasing) is an opportunity “ESG (social)”, not a risk “skills shortage” — the control question “What if not?” gives lost benefit, not damage.

Time balance: analysis 90 minutes with reasoning, objectives 30 minutes, transfer into the action plan (four rows ≥ 6) 15 minutes. In the practice company's stage 2 audit clause 6 was checked in eight minutes — without a finding.

Module 16 of 17

Records: what from clause 6 ends up in the management review

At the end there are five documents — and exactly these five management takes into the management review:

The annual calendar for clause 6 (company with management review in January):

Three hours a year plus the quarterly minutes — that is the entire effort for clause 6 in a company of up to 50 employees.

📄 KPI catalogue: one KPI per process for production, services, trade and facility services — with guide target values (German – English version to follow)

What you have now and what follows: clause 6 is the engine; the management review (separate course) is the steering wheel, the action plan the clutch. Anyone who runs the three together has what auditors call “a living system” — and what shows in surveillance audits as the shortest audit days.

Module 17 of 17

Procedure in our company

Your company completes this module. The general part of the training ends here; what follows, only your company knows:

Companies with a company account of the Academy receive this module with their own details; participants then see the names, dates and filing locations of their company. Without customisation: ask your management or your quality manager where these details are laid down in your company — usually in the quality manual.

Final test

38 questions, one correct answer each. You need 31 correct answers to pass (80 %). Scoring happens on the server — there is no answer key on this page.

Your result