Objectives, Risks and Opportunities
risk and opportunity analysis and quality objectives from what the company plans anyway – with rating scale, templates, ESG and a practice company
- 80–115 min
- 17 modules
- Free certificate
- No account needed
- Updated November 2026
👥 Target group: Quality managers and managing directors of small companies who create clause 6 themselves or update it annually, Companies whose risk analysis was criticised in the last audit as “not company-specific”
Which legal duty or standard requirement does this training cover?
About this training
Clause 6 of ISO 9001 – risks and opportunities, quality objectives, planning of changes – is the clause that small companies most often copy from the internet and that auditors see through most quickly. This course shows the way that has survived audits for years: the risk and opportunity analysis does not come from brainstorming but from the list of projects and investments the company plans or has implemented anyway. Every project is an action; behind it stands either a risk (what happens if we do not do it?) or an opportunity (what benefit does it bring?). Rating uses a four-level scale; the results steer the action plan. The quality objectives come from the policy and the process KPIs and are kept in two versions every year: review with result, outlook with deadline.
You will learn the assignment rule risk or opportunity, the rating scales with plausibility rules, the columns of the analysis, the standard rows for parties without risk, ESG aspects (energy, environment, social, climate change), the six standard objectives of small companies, the deadline rule, the link to the action plan and the management review – and what the auditor asks about clause 6. At the practice company Klarblick Building Services (38 employees, fictitious) you assign twelve projects, rate them and write the objectives. 17 modules, final test, certificate of participation with a verifiable number.
What this course covers — and what it does not: The course covers clause 6 of ISO 9001:2015 (6.1 risks and opportunities, 6.2 quality objectives, 6.3 planning of changes) for companies with 1 to 50 employees. It is not a course on risk management under ISO 31000, nor on occupational risk assessment under occupational safety law, nor on environmental or energy management under ISO 14001/50001; ESG aspects are covered only as far as they belong in the risk and opportunity analysis of a QMS. The manual, the management review and the action plan have courses of their own. The practice company is fictitious; rating scales are empirical values from more than 1,000 documentations, not a requirement of the standard. This is a translation of the German course for readers worldwide — in case of doubt the German edition applies.
Contents at a glance
- Clause 6: the steering clause — and why it does not work from the internetWhat clauses 6.1, 6.2 and 6.3 require; the chain context → risks and opportunities → actions → objectives → KPIs → management review; why copied risk lists stand out in the audit; risk-based thinking without a formal method (Annex A.4)
- The project and investment list as the sourceWhy projects and investments are the most honest source of risks and opportunities; the list in two parts (implemented, planned); what belongs in it (machines, vehicles, software, people, training, buildings, organisation); template
- The assignment rule: risk or opportunity — never bothEvery project exactly once, in exactly one table; the control question “What happens if we do not do it?”; damage → risk, lost benefit → opportunity; the topic column is the reason, not the project; 30 example projects assigned
- Rating risks: probability × escalation levelThe scale: probability 1–3 (frequency per year), escalation level 1–4 (up to about 500 in local currency up to irreparable); result as product; plausibility rules (commissioned project ≥ 4, no 1×1, regulatory and safety risks level 4); traffic light from 6
- Rating opportunities: realisation × benefitThe scale: realisation 1–3, benefit 1–4 (4 only for the one-off opportunity); result and traffic light; why opportunities are usually underrated in small companies; examples
- Filling the table: columns, areas, status, standard rowsColumns of the risk and the opportunity analysis; pool of interested parties and areas; status only “done” or “in progress”; responsible person MD; deadline only if named; standard rows for parties without risk; gap rule; Excel template with formulas
- Thinking ESG along: energy, environment, social and climate change in the contextWhich projects touch ESG aspects (vehicles, solar, LED, heat pump, waste, hazardous substances, home office, benefits); prefix “ESG:” in the topic column; climate change as a context issue (Amendment 2024, ISO 9001:2026); boundary to ISO 14001 and 50001
- Measurable quality objectives: the six columns and the six standard objectivesObjectives table with area/process · objective · measure · actions/resources · responsible/deadline · result; the six standard objectives of small companies (turnover, quotation hit rate, complaints, customer satisfaction, supplier evaluation, certification); what 6.2.2 requires
- Objectives from policy and process KPIs — and the deadline ruleEvery sentence of the policy needs an objective; every process a KPI; which KPI fits which objective; the deadline rule (document date January–September: 31 December of the current year, October–December: 31 December of the following year); no deadlines “ongoing”
- Two versions every year: review with result, outlook with deadlineThe annual cycle of objectives: review (column result filled: achieved / not achieved with value) and outlook (result empty, new deadlines); unachieved objectives as input to the management review; carry over, adjust, delete objectives; evaluation periods
- The link to the action plan: what happens from result 6Rows with result ≥ 6 and status “in progress” move with deadline and responsible person into the action plan; source “risk” or “opportunity”; effectiveness after three months; corrective actions only after occurrence; one-plan rule
- What the auditor asks about clause 6 — and which records he wants to seeTwenty audit questions on risks, opportunities, objectives and changes with the respective record; the four most frequent nonconformities on clause 6; clauses 6.1.1, 6.1.2, 6.2.1, 6.2.2, 6.3; how a small company answers in five minutes
- Planning of changes (6.3): the forgotten clause in one paragraphWhat 6.3 requires (purpose and consequences, integrity, resources, responsibility); which changes are meant (new service, location, software, role, outsourcing); the four-question line in the meeting minutes; boundary to 8.5.6 (changes in production)
- The ten most frequent errors in risk analyses and objectives tablesInternet risks without company reference; everything 2 × 2; project in the topic column; risk and opportunity twice; guessed deadlines; responsibility delegated; objectives without number; objectives without action; review without actual value; analysis without status and change
- Case study: Klarblick Building Services — twelve projects, one analysis, eight objectivesPractice company Klarblick Building Services (38 employees, cleaning, security, services, fictitious): assign and rate a project list with twelve entries, standard rows, ESG; objectives review 2026 and outlook 2027; model solution with reasoning per row
- Records: what from clause 6 ends up in the management reviewThe five documents from this course (project list, analysis, action plan rows, objectives review, objectives outlook) and their clauses; the annual calendar for clause 6; handover to the management review (9.3.2 c 2 and e); checklist
- Procedure in our companyProcedure in our company: contact person for quality questions, location of the manual, templates and records, approvals, fixed dates and next steps in the company
Frequently asked questions
Does ISO 9001 require a risk analysis with rating numbers?
No. Clause 6.1 requires risks and opportunities to be determined and actions to be planned; a formal method is not prescribed (Annex A.4). Rating with numbers helps, however, to separate the important from the unimportant and to steer the action plan – and auditors ask about it.
Where do I take the risks from without inventing them?
From the list of projects and investments the company has implemented or plans. Every project is an action; behind it stands a risk or an opportunity. What is not in the project list is included only if context or complaints substantiate it.
How many risks and opportunities does a small company need?
Typically six to ten risks and four to eight opportunities; plus one standard row each for parties without risk (banks, suppliers, surroundings, associations). Twenty and more rows are a sign that something was copied from the internet.
How many quality objectives?
Usually six to nine, each with measure, action, responsible person and deadline – the six standard objectives plus one to three company-specific objectives from the project list. The six standard objectives of small companies (turnover, quotation hit rate, complaints, customer satisfaction, supplier evaluation, certification) are a good start.
What about environment, energy and climate change?
Since the Amendment 2024 ISO 9001 requires climate change to be considered in the context; from the 2026 edition expressly. In the analysis of a QMS it is enough to name ESG aspects at the projects that touch them (vehicles, solar, LED, waste, social). That is not an environmental management system under ISO 14001.
Is the course free?
Yes, like all courses of the QM-Guru Academy. No registration; the e-mail address is used only to deliver the certificate.
Which edition is this?
The English-language edition of our German course "Ziele, Risiken und Chancen", written for readers worldwide. The downloadable templates are currently in German; English versions will follow. In case of doubt the German edition applies.