Home › ISO Knowledge Hub › Risk & Opportunity Management
ISO Risk & Opportunity Management
Build a consistent, practical approach to identifying uncertainty, evaluating potential impacts, selecting risk treatments and pursuing opportunities across ISO management systems. Connect risk decisions to business objectives, operational controls, accountable owners and verifiable results.
From understanding to action: Context → Identify → Analyse → Evaluate → Treat → Monitor & Improve. The examples and optional assessment matrix are learning aids; risk criteria must reflect your organization and the applicable management system standard.
01. Understanding Risk & Opportunity in ISO Management Systems
Risk and opportunity management helps an organization make informed decisions when uncertainty can affect its objectives. The aim is not to eliminate every risk, but to establish a repeatable way to understand exposure, choose proportional responses, exploit beneficial possibilities and demonstrate how those decisions perform over time.
Make risk thinking part of normal management
- Start with objectives: quality, customer value, environmental performance, worker safety, information security and continuity.
- Understand context: consider external conditions, interested parties, internal capabilities and changes to operations.
- Set decision criteria: describe how consequence, likelihood, control strength and mandatory obligations inform escalation.
- Record and assign: link significant risks and opportunities to processes, named owners, actions and evidence.
- Learn and improve: reassess risk when changes, incidents, audit findings or performance trends alter exposure.
Executive oversight connects risk decisions with accountable process owners and measurable objectives.
GOVERN Risk governance
Confirm risk appetite, decision rights, resources, escalation routes and accountability.
ASSESS Risk assessment
Identify relevant uncertainty, analyse its potential consequences and compare results with approved criteria.
ACT Risk response
Implement treatments and opportunity actions, then review whether the intended outcome has been achieved.
ISO 31000 as a practical reference
ISO 31000:2018 provides principles, a framework and a process for managing risk. It is guidance and cannot itself be used for third-party management-system certification. Implement the additional, specific requirements of each relevant ISO management system standard.
02. Risk, Opportunity, Threat, Hazard, Impact & Control
A shared vocabulary prevents teams from misclassifying hazards as risks or treating a proposed improvement as if it were already an effective control. Meanings below are practical explanations; refer to the relevant licensed standard for formal terminology.
Swipe sideways to view all columns on smaller screens.
| TERM | PRACTICAL MEANING | WORKPLACE EXAMPLE |
|---|---|---|
| Risk | Effect of uncertainty on objectives; the effect can be adverse or beneficial. | A supplier disruption may affect on-time delivery. |
| Opportunity | A favourable possibility worth considering and acting on. | A redesigned inspection step reduces waste and improves reliability. |
| Threat | A source, event or condition that could lead to an adverse outcome. | A targeted phishing campaign threatens customer data. |
| Hazard | A source or situation with the potential to cause injury or ill health (OH&S context). | An unguarded moving conveyor is a physical hazard. |
| Impact / Consequence | An outcome of an event or condition, assessed relative to objectives or affected parties. | A chemical spill damages a receiving watercourse. |
| Control | An action or measure used to maintain or modify risk. | Segregation, access approval, preventive maintenance or monitoring. |
How the terms work together
A hazard or threat may create exposure; the risk describes uncertainty and its potential effect; the consequence describes an outcome; a control modifies exposure. An opportunity describes a possible beneficial outcome that can be assessed for value, feasibility and uncertainty.
03. ISO Risk Management Framework & Governance
Establish a framework that integrates risk decisions into business governance instead of producing an isolated annual spreadsheet. ISO 31000 organizes risk management around leadership and commitment, integration, design, implementation, evaluation and improvement.
01 Leadership & policy
Approve the purpose, risk principles, resources and direction; ensure major decisions are traceable.
02 Context & criteria
Determine boundaries, affected objectives, stakeholders, legal and contractual duties and decision criteria.
03 Roles & authority
Assign risk owners, independent challenge where appropriate, process leads, approval authority and reporting paths.
04 Assessment process
Define identification, analysis, evaluation, treatment, records and regular reassessment.
05 Communication
Consult affected workers and stakeholders; share material risks, assumptions and treatment decisions.
06 Evaluation & improvement
Measure control performance, review lessons learned, adapt the framework to organizational changes.
Risk Governance — Responsibility Matrix
Swipe sideways to view all columns on smaller screens.
| DECISION / ACTIVITY | TOP MANAGEMENT | RISK / IMS LEAD | PROCESS OWNER | SPECIALIST |
|---|---|---|---|---|
| Approve risk criteria | A | R | C | C |
| Identify and maintain risks | I | C | A/R | R |
| Approve major risk treatment | A | R | R | C |
| Implement operational controls | I | C | A/R | R |
| Evaluate control performance | I | A | R | R |
R = Responsible, A = Accountable, C = Consulted, I = Informed. Adapt decision rights to the organization; this example is not a prescribed ISO structure.
04. Risk Identification: Processes, Objectives & Context
Identification should start with activities, objectives and the conditions that could change outcomes. Combine workshops with process mapping, incident data, stakeholder requirements, supplier information, field observations and change reviews rather than relying on a generic risk list.
PROCESS Process & interfaces
Map inputs, outputs, outsourced services, handovers and points where controls can fail.
OBJECTIVE Objectives & targets
Consider quality, delivery, compliance, worker wellbeing, environmental and information-security objectives.
STAKEHOLDER Interested parties
Evaluate customer commitments, employee concerns, regulators, suppliers and community expectations.
CHANGE Change scenarios
Review new technology, people, sites, regulations, climate-related factors and supply chain shifts.
EVENT Events & evidence
Use complaints, near misses, incidents, defects, audit findings and performance deviations.
POSSIBILITY Opportunities
Look for automation, waste reduction, design improvements, resource efficiency and capability gains.
Five questions for a meaningful risk statement
- What objective or requirement could be affected? Describe the consequence for the business or interested parties.
- What could happen, and why? State an event or circumstance and the plausible cause.
- Where and when could it occur? Identify process, site, activity, asset or information flow.
- What controls already operate? Record their actual use and supporting evidence.
- Who owns the risk and what assumptions require review? Name an accountable role and the triggering conditions.
Use objective-linked statements
Weak: “Supplier risk – high.” Stronger: “Loss of a single-source component supplier could interrupt the assembly line for critical customer orders because no approved alternative supplier is available.”
05. Risk Analysis & Evaluation: Choose Proportionate Methods
Risk analysis considers plausible causes, outcomes, existing controls and uncertainty. Evaluation compares that understanding with approved criteria to decide whether the risk needs treatment, escalation, monitoring or justified acceptance.
Swipe sideways to view all columns on smaller screens.
| METHOD | WHEN IT HELPS | EXAMPLE OUTPUT | IMPORTANT LIMITATION |
|---|---|---|---|
| Qualitative | Workshops, early screening or limited reliable data | Narrative levels: High / Moderate / Lower with rationale | Consistent criteria and competent judgment are still essential. |
| Semi-quantitative | Comparing risk categories when ordinal scales are useful | Likelihood × consequence ranks or weighted categories | Ordinal products are prioritization aids, not precise loss probabilities. |
| Quantitative | Decisions supported by credible frequency, loss and exposure data | Expected loss, ranges, scenario models or probability distributions | Data uncertainty and model assumptions must be reviewed. |
Risk Evaluation Matrix — Three-Level Example
Define likelihood and consequence using your actual context. The matrix below is a simple communication aid; a legal duty or potential catastrophic outcome can require escalation regardless of its cell.
Swipe sideways to view all columns on smaller screens.
| LIKELIHOOD / CONSEQUENCE | LOWER CONSEQUENCE | MODERATE CONSEQUENCE | SEVERE CONSEQUENCE |
|---|---|---|---|
| More likely | Moderate | High | High |
| Possible | Lower | Moderate | High |
| Less likely | Lower | Lower | Moderate |
Before & After Controls — Residual Exposure
Before: A single-source component could stop an assembly line: High exposure. After: Approved alternative supply, safety stock and trigger monitoring are implemented: Moderate residual exposure. Validate these labels against the organization’s defined criteria and verify control performance with operational evidence.
06. Risk Treatment & Opportunity Actions
A response is justified only when its cost, feasibility, legal constraints and expected effect are considered. Responsibility must be explicit, with monitoring of residual exposure after implementation.
AVOID Avoid
Stop or redesign an activity when exposure is unacceptable or the objective can be met another way.
REDUCE Reduce / Mitigate
Add preventive, detective or recovery controls to change likelihood, consequence or both.
SHARE Share / Transfer
Use appropriate insurance, contracts, outsourcing or partnerships; retained accountability may remain.
ACCEPT Retain / Accept
Approve and document risk within authorized criteria, including reasons and review triggers.
EXPLOIT Pursue an opportunity
Invest in an attractive option, test assumptions and measure value delivered.
ENHANCE Improve / Partner
Increase the likelihood or value of beneficial outcomes through pilots, capability or collaboration.
Treatment plan decision points
- Choose a response in light of obligations, risk criteria and stakeholder impacts.
- Specify action, resources, control owner, accountable approver, target date and evidence.
- Define residual exposure, verification approach, monitoring frequency and escalation trigger.
- For opportunities, use a benefit hypothesis and measurable outcome rather than assuming a positive result.
Treatment is not the same as action closure
A policy written, supplier contract signed or safeguard purchased is only an output. Verify deployment, suitability and effectiveness; re-evaluate residual risk after a representative period of operation.
07. Risk Register, Risk Matrix & Action Plan
Maintain a controlled register that can be reviewed by process owners and management. The register below shows how to connect exposure, controls, treatment decisions and accountable ownership in a practical management record. Sample records are for demonstration.
Swipe sideways to view all columns on smaller screens.
| ID | PROCESS / CONTEXT | RISK OR OPPORTUNITY | INITIAL | TREATMENT / ACTION | RESIDUAL / STATUS | OWNER |
|---|---|---|---|---|---|---|
| RR-001 | Electronics manufacturing | Single-source part delays assembly orders | High | Secondary source qualification; safety stock | Moderate | Supply Chain Manager |
| RR-002 | Chemical packaging | Transfer spill may contaminate stormwater | High | Bunds, response drills, inspections | Moderate | HSE Manager |
| RR-003 | Distribution / OH&S | Forklift–pedestrian collision in dispatch | High | Traffic separation, access controls, observation | Moderate | Warehouse Manager |
| RR-004 | SaaS / information | Unauthorized access to customer production data | High | MFA, privileged access review, logging | Moderate | ISMS Owner |
| OP-005 | Precision machining | Automated inspection could reduce rework | Opportunity | Pilot cell and benefit verification | In progress | Operations Director |
Risk Treatment Action Plan
Swipe sideways to view all columns on smaller screens.
| ACTION ID | CONTROL & IMPLEMENTATION | VERIFICATION EVIDENCE | TARGET / REVIEW TRIGGER | ACCOUNTABILITY |
|---|---|---|---|---|
| A-001 | Approve alternative component supplier; establish min/max stock | Supplier approval, simulated shortage review, monthly availability | 2026-12-15; lead time exceeds agreed tolerance | Supply Chain Manager |
| A-002 | Install or verify spill containment and run response drill | Inspection records, spill drill report, corrective actions | 2026-12-20; material change or spill event | HSE Manager |
| A-003 | Implement physical traffic separation and monitoring | Updated route plan, observed separation, near-miss trend | 2026-12-12; layout change or near miss | Warehouse Manager |
| A-004 | Enforce privileged-access reviews and MFA | Access logs, reviewer sign-off, test of terminated user access | 2027-01-10; security event or access change | ISMS Owner |
| A-005 | Pilot automated inspection and measure value | Baseline scrap and rework trend, pilot results and approval | 2027-01-31; pilot misses approved benefit target | Operations Director |
Minimum controlled fields
Record a unique ID, applicable standard or business objective, activity, cause, consequences, existing controls, assessment method and date, risk criteria, owner, treatment decision, action, due date, verification result, residual risk, acceptance authority and next review trigger. Store supporting evidence in controlled locations.
08. Monitoring, Review, Escalation & Reporting
Monitoring is what keeps the register useful after the initial workshop. Use performance indicators and event-driven triggers to determine when controls are slipping, conditions have changed or management decisions must be reconsidered.
MONITOR Operational indicators
Track near misses, defects, supplier reliability, control test results, environmental events and security alerts.
REVIEW Periodic & triggered reassessment
Review on a planned basis and after incidents, process changes, new legal duties, supplier shifts and emerging threats.
ESCALATE Decision thresholds
Define who must be informed of severe exposure, failed treatment, missed due dates or potential legal non-compliance.
REPORT Leadership reporting
Present material exposures, treatment progress, late actions, emerging opportunities and residual risk decisions.
VERIFY Control effectiveness
Test whether actions operate as designed and outcomes are improving; document limitations and failures.
IMPROVE Lessons learned
Feed audit results, management review decisions, incident analysis and performance trends back into the framework.
Risk Monitoring Dashboard — Suggested Indicators
Swipe sideways to view all columns on smaller screens.
| INDICATOR | DEFINITION | SOURCE | MANAGEMENT QUESTION |
|---|---|---|---|
| High residual exposures | Count records still above approved escalation criteria | Controlled risk register | Do leaders know the owner, basis and immediate response? |
| Overdue treatment actions | Count actions past the agreed due date | Treatment action tracker | Which blocker needs resources or senior authority? |
| Control verification coverage | Share of selected critical controls tested in the period | Audit and inspection records | Is evidence sufficient and representative? |
| Opportunity benefit realized | Verified outcome against an approved baseline | Pilot / operational KPI records | Did the initiative deliver value without unacceptable new risks? |
Escalation protocol
Escalate confirmed material exposure promptly through approved channels. A risk owner cannot “accept” a non-negotiable statutory duty away. Separate risk acceptance from approval to operate and from regulatory or contractual compliance decisions.
09. Worked Examples: ISO 9001, 14001, 45001 & ISO/IEC 27001
A common risk governance framework can serve multiple management systems, while each assessment retains its own technical criteria. Compare four sector-specific applications and their controls, evidence and residual exposure.
Four management-system applications
- ISO 9001:2026: operational process risks and opportunities that could affect product or service conformity and customer satisfaction.
- ISO 14001:2026: environmental aspects, impacts, compliance obligations, context and related risks and opportunities.
- ISO 45001:2018: systematic identification of OH&S hazards, assessment of OH&S risks and opportunities, and worker participation.
- ISO/IEC 27001:2022: information-security risk assessment and treatment with specific documented methods, results and controls.
Cross-functional reviews make risk-based decisions specific to each process and management system.
01. ISO 9001:2026 · Electronics manufacturing
Scenario: Late critical components threaten product delivery and customer commitments.
Before control: Qualitative High due to single sourcing and recurring lead-time variation.
Treatment and after-control evaluation: Approve second supplier, add buffer policy and monitor deliveries; reassess as Moderate when validated.
Owner and evidence: Supply Chain Manager; approved suppliers, inventory and on-time delivery records.
02. ISO 14001:2026 · Chemical packaging
Scenario: Uncontained liquid transfer could create an environmental impact and compliance exposure.
Before control: Qualitative High given credible spill pathway and sensitive receiving environment.
Treatment and after-control evaluation: Secondary containment, maintenance inspection, drill and discharge controls; residual classification only after testing.
Owner and evidence: HSE Manager; aspect-impact review, inspection records and drills.
03. ISO 45001:2018 · Distribution center
Scenario: Mixed forklift and pedestrian movements create the hazard of a serious collision.
Before control: Severe potential consequence demands attention regardless of a low incident count.
Treatment and after-control evaluation: Eliminate unnecessary crossing, segregate routes, train staff and observe use; verify risk remains controlled.
Owner and evidence: Warehouse Manager and worker representatives; route layout, consultation and near-miss records.
04. ISO/IEC 27001:2022 · SaaS provider
Scenario: Excessive privileged access may result in unauthorized disclosure or service disruption.
Before control: High initial exposure based on asset criticality, privilege design and threat scenarios.
Treatment and after-control evaluation: Least privilege, MFA, periodic access review and detection; document residual risk acceptance where authorized.
Owner and evidence: ISMS Owner; risk assessment, treatment plan, access logs and control testing.
Do not erase discipline-specific methods
Use the organization’s approved methodology to document environmental aspects and impacts, OH&S hazards and opportunities, or information-security risk and treatment requirements. A common corporate risk register should link these records, not overwrite their purpose.
10. Common Risk Management Mistakes to Avoid
A reliable risk process remains useful between audits. These six checks help teams maintain decision quality, accountability and effective controls.
01 Generic lists without context
“Supplier risk” is not an actionable risk statement; connect it to objectives, causes and consequences.
02 False precision
A multiplication of arbitrary ordinal scores is not a measured probability or financial loss.
03 Assuming controls work
An approved procedure or purchased tool does not demonstrate operational effectiveness.
04 Only counting threats
Missed operational or innovation opportunities can be as consequential as adverse exposures.
05 No ownership or approval
Without assigned authority, treatment decisions and risk acceptance are difficult to defend.
06 Risk register never updated
A static annual register misses organizational changes, incidents and emerging conditions.
11. Frequently Asked Questions
Answers to recurring questions about methods, risk registers, treatments and management-system requirements.
Is ISO 31000 a certifiable standard?
No. ISO 31000:2018 provides guidelines for managing risk; it is not a certification standard. Organizations may use it to improve their internal risk management approach.
Does ISO require a 5×5 risk matrix or fixed numerical threshold?
No universal ISO requirement mandates a 5×5 matrix or a single numerical risk threshold. Select and justify a method that is appropriate to your risks, objectives and applicable standard.
What is the difference between inherent and residual risk?
Inherent risk describes exposure before considering a specified set of controls; residual risk is the exposure that remains after relevant controls are taken into account. Define these terms in your own method so assessments stay comparable.
Does every opportunity need a risk score?
No. Evaluate opportunities in a way that supports a useful management decision. Benefit, feasibility, resources, uncertainty and alignment to objectives may be more suitable than a threat-focused score.
Can a single risk register support several ISO management systems?
Yes, a shared register can improve governance, provided it preserves distinct topics such as environmental aspects, OH&S hazards and information-security criteria when each standard requires them.
When is a risk treatment action considered closed?
Close the action when implementation and the agreed evidence are verified. Continue monitoring residual risk and control effectiveness; an overdue action should be escalated according to defined criteria.
12. Official Sources, Related Guidance & Next Steps
For formal applicability and audit criteria, use the licensed editions of the relevant standards. This page provides independent practical implementation guidance; the companion Risk Assessment Tool is intended for entering, assessing and exporting risk records.
Official references
- ISO 31000:2018 — Risk management — Guidelines: risk principles, framework and management process.
- ISO 9001:2026: quality management system requirements.
- ISO 14001:2026: environmental management system requirements.
- ISO 45001:2018: OH&S management systems, including applicable amendment(s).
- ISO/IEC 27001:2022: information security management system requirements, including applicable amendment(s).
- ISO Standards Catalogue: verify current publications and edition status.
Related ISO Knowledge Hub pages
PLAN ISO Gap Analysis & Planning
Translate identified control weaknesses into assigned improvement actions and readiness plans.
TOOL ISO Risk Assessment Tool
Use the separate practical tool for risk scoring, registers, treatment tracking and export.
INTEGRATE Integrated Management Systems
Coordinate shared risk governance across multiple ISO standards while preserving specialist requirements.
TEMPLATE ISO Documentation Templates
Explore editable procedures, registers, checklists and controls for implementation.
SCOPE ISO Scope & Applicability
Define the operational boundaries and the management system requirements relevant to each assessment.
HUB Explore ISO Knowledge Hub
Continue to related implementation, auditing and professional resources.