ISO 9001 asks an organisation to think about risk as part of running a quality system. ISO 31000 describes how to manage risk across the whole organisation. They share a definition of risk but ask for different amounts of formality, and an auditor who confuses them will either demand too much or accept too little.
Last reviewed: 17 October 2026. Facts checked. We opened web search results comparing the two: articles from Accendo Reliability, CERM Academy and Quality Magazine (secondary). They state that ISO 9001:2015 adopted a risk definition similar to ISO 31000's, that ISO 9001 does not require a formal risk process or a risk register, and that ISO 31000 is guidance that users need not follow as a system. We did not open either standard. Edition note: ISO 9001:2026 was published on 16 September 2026; we could not verify whether its risk wording changed, so confirm against the edition you audit. See our ISO 31000 explainer for the guideline itself.
The common ground
Both treat risk as the effect of uncertainty on objectives, which can be negative or positive. That is wider than "chance of loss", and it is why ISO 9001 speaks of risks and opportunities together. Both want risk considered when planning and revisited when things change.
Where they differ
| Aspect | ISO 9001 (risk-based thinking) | ISO 31000 |
|---|---|---|
| Nature | Requirements in a certifiable quality standard | Guidelines, not certifiable |
| Scope | Risk to the quality management system and customer outcomes | Any objective, any organisation |
| Formality | No requirement for a formal process or register, per the sources | Describes principles, a framework and a process |
| Who must follow | Certified organisations, for the points the standard requires | Nobody is obliged to |
| Audit outcome | Nonconformity if a requirement is unmet | No nonconformity against guidance |
What ISO 9001 asks in practice
In broad terms, the quality standard expects the organisation to determine risks and opportunities that need addressing so the system can achieve its intended results, prevent or reduce undesired effects and improve. It expects actions to be planned in proportion to the effect on conformity of products and services, and to be integrated into processes and evaluated for effectiveness. Check the exact text in your edition. We have not quoted it.
The important phrase for an auditor is "proportionate". A small bakery and a medical device maker will both think about risk, but you should expect very different depth.
What auditors should test under ISO 9001
- Is risk thinking visible? Look for it where decisions are made: process design, supplier choice, change, new product launch, management review. A register is one way, not the only way.
- Are risks tied to the system's objectives? A generic list copied from a template that does not mention the organisation's own processes suggests the exercise was cosmetic.
- Were actions taken, and did they work? An action in the plan with no owner, date or follow-up is a gap.
- Is it kept current? Compare with what has changed: a new site, a lost customer, a supplier failure, a recall.
- Does top management know? Ask leaders for the risks they worry about and compare with the record. See auditing leadership and commitment.
Do not write a nonconformity for lack of a risk register unless the organisation's own system promises one. The sources we opened say the quality standard does not require it.
When an organisation uses ISO 31000 as well
Many larger organisations run enterprise risk management using ISO 31000 or a similar framework, and their quality system risks feed from it. In that case:
- Check that the quality risks are consistent with the enterprise register, rather than a separate list.
- Check that the same scoring method is used, or that differences are explained.
- Do not audit the enterprise framework against ISO 9001 or the other way round. Each is judged against what the organisation has committed to.
For scoring methods, see how to score likelihood and impact, and for registers, how to build a risk register.
A common error: demanding the heavier thing
Auditors familiar with enterprise risk management often expect likelihood and impact scores, heat maps and risk appetite statements in every quality system. A small organisation that identifies risks through a monthly review and records actions in minutes can meet the standard's intent without any of that. Equally, a large organisation that says "risk is in our heads" has not demonstrated anything. Test the outcome: does the organisation anticipate and act?
An invented example
A contract machining shop's audit finds no risk register. The auditor asks how risk is considered. The owner shows monthly meeting notes: a key tool supplier delayed deliveries, so a second supplier was qualified; a new customer needed a tighter tolerance, so an inspection step was added and checked after three months. These are risks, actions and follow-up, proportionate to the business. No finding. At another firm, a thick register lists thirty risks with no dates, owners or changes since two years ago. That is a finding, though the paperwork looks impressive.
The takeaway
Know which document you are auditing against. ISO 9001 wants risk thinking that fits the organisation and leads to action; ISO 31000 offers a fuller framework that nobody has to adopt. Judge the thinking and the follow-through, not the format.
Last reviewed: 17 October 2026. Facts checked. Opened: web search summaries from Accendo Reliability, CERM Academy and Quality Magazine on ISO 9001:2015 and ISO 31000 (secondary). Could not open: ISO 9001 or ISO 31000 text, so clause wording is not quoted, and we could not verify whether ISO 9001:2026 changes the risk requirements.
Statutory facts on this page are checked against their sources, and the page says where it relied on secondary reporting. How we verify · Report an error