Many quality managers struggle with the same issues: what Clause 6.1 actually demands, why two people rate the same risk differently, which risks to treat first, and what an auditor expects to see. Research backs up the confusion. A 2021 literature review found fragmented interpretations of risk-based thinking.
This article covers how risk-based thinking relates to a 5 by 5 matrix, how to build one for a QMS, and how to connect scores to actions and effectiveness reviews.
Key Takeaways
- ISO 9001:2015 requires you to address risks and opportunities, but prescribes no matrix, formula, or software.
- A 5 by 5 matrix crosses five probability levels with five impact levels.
- A score is a decision aid; every significant risk still needs a response, owner, timing, and effectiveness check.
- Keep documentation proportionate to your size, complexity, and risk profile.
What ISO 9001:2015 Risk-Based Thinking Requires
What Clause 6.1 means for a QMS
Clause 6.1.1 asks you to determine the risks and opportunities that need attention so you can:
- Give assurance that the QMS achieves its intended results
- Enhance desirable effects
- Prevent or reduce undesired effects
- Achieve improvement
Clause 6.1.2 then requires you to plan actions, plan how to integrate them into QMS processes, and plan how to evaluate their effectiveness. Actions must be proportionate to the potential effect on conformity of products and services.
Risk-based thinking belongs inside planning and daily process management. An annual workshop that produces a spreadsheet nobody opens misses the point.
Where risk-based thinking appears throughout the standard
Risk shows up well beyond Clause 6. Confirm the exact wording in ISO 9001:2015; the main links are:
- 4.1 and 4.2: context and interested-party needs feed risk planning
- 5.1: leadership promotes risk-based thinking
- 8.1 and 8.4: operational planning and external provider controls
- 9.1.3 and 9.3: analysis and management review assess action effectiveness
- 10.2: risks are updated after a nonconformity if necessary
What ISO 9001:2015 does not prescribe
Annex A.4 states that formal risk-management methods and a documented risk-management process are not required. The standard does not mandate:
- A 5 by 5 matrix
- A formal enterprise risk management system
- A universal risk register format
- A fixed set of risk procedures
The required outcome is that risks and opportunities are determined and addressed. The method is your choice. Pick one that fits your context and complexity.
What Is an ISO 9001:2015 5 by 5 Risk Matrix?
Definition and purpose
A 5 by 5 matrix is a grid combining five probability ratings with five impact ratings. ASQ's handbook describes both scales as typically rated 1 to 5, with each risk at the intersection. That gives 25 cells.
Many teams calculate rating = probability × impact, producing scores from 1 to 25. That is a common convention, not an ISO requirement.
How the two axes work
Probability is how likely a supplier failure, process error, complaint, or nonconforming output is. Impact is the effect on conformity, customer satisfaction, delivery, regulatory obligations, process performance, or QMS objectives.
Designing useful five-level scales
Labels like "low" and "high" invite argument. Define each level so employees apply it the same way. Example scale:
| Level | Probability | Impact |
|---|---|---|
| 1 | Rare: not expected in the next few years | Negligible: absorbed in normal work |
| 2 | Unlikely: has happened once, long ago | Minor: internal rework only |
| 3 | Possible: happens occasionally | Moderate: late delivery or a customer complaint |
| 4 | Likely: recurs several times a year | Major: lost customer confidence or a repeat nonconformity |
| 5 | Almost certain: happens routinely | Severe: regulatory breach or loss of a key customer |
Support ratings with historical nonconformities, complaints, audit findings, process data, and team knowledge. Don't invent statistics to make a score look rigorous.
Interpreting colors and risk bands
Link each band to an expected response:
- Low (green): monitor
- Medium (yellow): add or confirm controls
- High (orange): action plan and management attention
- Critical (red): escalate and act immediately
Colors and thresholds are organization-defined. Treat this heat map as an example, not a standard.
Inherent, controlled, and residual risk
Score the risk before controls, then rescore after planned or existing controls. Comparing the two shows whether exposure dropped. A lower score does not by itself prove effectiveness. ISO 9001:2015 does not use these labels; they are a practical convention.
Risk versus opportunity
The standard addresses both. Opportunities include improving a process, adopting a new method, reducing waste, or strengthening customer satisfaction. An opportunity is not simply the positive side of risk, as ISO/TC 176 guidance explains. A conventional negative-risk matrix may need extra fields, or a separate evaluation, to assess them properly.
How to Build a Risk Matrix for an ISO 9001 QMS
Define the QMS context and purpose
Start with your context, interested parties, products or services, QMS objectives, and key processes. A generic risk list misses process-specific issues. Tie every risk to a process, objective, requirement, or intended result.
Identify risks and opportunities
Gather input from:
- Process owners and personnel
- Internal and external audits
- Customer complaints and nonconformities
- Supplier performance and maintenance records
- Changes in technology, resources, or regulatory requirements
Cover strategic items (unclear responsibilities, outsourced processes) and operational ones (delivery failures, inspection errors).
Write clear risk statements
Show cause, uncertain event, and effect. ASQ offers this pattern: "As a result of [cause], [risk event] may occur, causing [outcome]."
"Supplier risk" tells nobody anything. Compare: "Because our sole heat-treat supplier has no backup capacity, a breakdown may delay shipments, causing missed delivery dates."
For each entry also record the process, affected requirement, existing controls, owner, and evidence.
Score probability and impact consistently
Apply the agreed definitions and record the rationale for each rating. Use cross-functional review when a risk spans processes or sites. Documented criteria narrow subjective gaps, though they won't remove them. Cox's research found that different users can rate the same risks oppositely.
Prioritize treatment decisions
Treatment options include:
- Avoiding the source
- Reducing probability or impact
- Sharing or transferring exposure
- Accepting the risk by informed decision, within defined authority
Prioritize by risk significance, customer and compliance implications, QMS objectives, resources, and feasibility.
Plan actions and assess residual risk
Each significant action needs an owner, due date, resources, method, and a measure of effectiveness. After implementation, rescore and document whether the remaining exposure is acceptable.
Hypothetical example: A critical supplier delays a component.
- Initial rating: probability 4, impact 4, score 16 (high)
- Actions: qualify a second supplier and set a safety stock level, owned by purchasing
- Effectiveness measure: on-time delivery trend and zero line stoppages over the review period
- Residual rating: probability 2, impact 4, score 8; the team judges it acceptable and schedules a review
How to Use, Review, and Audit the Matrix
Integrate risk actions into the QMS
Feed responses into procedures, process controls, supplier controls, training, objectives, contingency plans, inspections, and corrective action. The matrix should shape daily decisions. A spreadsheet maintained only for audit day defeats the purpose.
Evaluate effectiveness
Use evidence such as trends, customer feedback, audit results, nonconformity records, process measures, supplier results, and action completion. Finishing an action does not prove it worked. Define the effectiveness criterion in advance where practical.
Establish review triggers
Review the matrix after:
- Significant process or product changes
- New suppliers
- Complaints, nonconformities, or audit findings
- Legal or regulatory changes
- Major incidents or performance decline
- Shifts in organizational context
Set routine intervals by risk profile. ISO 9001 specifies no universal frequency; it requires management review at planned intervals.
Prepare evidence for internal and external audits
Auditors do not audit risk-based thinking as a standalone activity, according to ISO/TC 176 audit guidance. It is implicit throughout the QMS audit. Useful evidence includes:
- Method and rating criteria
- Risk and opportunity register with process links
- Scoring rationale
- Action plans, owners, and completion records
- Effectiveness evaluations and review history
Show the thread from identified risk to planning, control, and results without piling on paperwork.
Apply the method across multiple sites
Use common definitions and governance centrally, while each site identifies local process, supplier, customer, and regulatory risks. Document who owns the methodology, how site risks escalate, and how shared-process risks consolidate. For certification, IAF MD 1 expects centralized management review and all sites in the internal audit program.
Where outside help fits
Organizations that need help turning risk analysis into practical QMS documentation and training can look at Synergistic Systems. Its modular documentation, organizational, and training systems, plus a cloud-based QMS intranet that hosts the risk register, support implementation. Certification decisions remain with your registrar.
Common ISO 9001 Risk Matrix Mistakes to Avoid
- One-time exercise. A matrix disconnected from process controls, objectives, corrective action, and management review decays fast.
- False objectivity. Undefined scales, inconsistent scoring, and universal color thresholds look scientific but aren't. Identical ratings can mask very different risks, and a score of 20 is not twice a 10.
- Incomplete entries. Risks lack an owner, action, due date, acceptance rationale, effectiveness evidence, or review trigger.
- Negative-only thinking. The matrix covers only events you've already suffered and skips opportunities and changing conditions.
Frequently Asked Questions
What is a 5 by 5 risk matrix?
A grid with five probability levels and five impact levels used to assign relative priorities. ISO 9001:2015 does not require this format.
What are the 6 mandatory procedures for ISO 9001?
The six came from ISO 9001:2008 (document control, records, internal audit, nonconforming product, corrective action, preventive action). The 2015 version requires the documented information it specifies plus what you need for an effective QMS.
Does ISO 9001:2015 require a risk matrix?
No. It requires you to determine and address risks and opportunities, using a method you choose, such as a matrix, FMEA, or process analysis.
What should be included in an ISO 9001 risk register?
Risk or opportunity statement, process or objective, cause and effect, probability, impact, existing controls, response, owner, timing, residual risk, and effectiveness review.
How often should an ISO 9001 risk matrix be reviewed?
Set intervals by your context and risk profile. Add reviews after significant changes, complaints, nonconformities, audit findings, or supplier issues.
Can a small business use a simple ISO 9001 risk matrix?
Yes. Use clear criteria, assigned responsibility, documented decisions, and evidence that actions are monitored for effectiveness.
