ISO 9001:2026 · Clause 6.1.3
Build the opportunity register
Clause 6.1.3 is the biggest new build in the ISO 9001:2026 transition. The seven steps it requires, every column your register needs, a worked example from a packaging site, and the six things auditors reject.
The short answer
Clause 6.1.3 of ISO 9001:2026 is a new dedicated sub-clause that separates opportunities from risks. An opportunity must be taken through seven steps: determined, analysed, evaluated, planned, integrated into the QMS processes, implemented, and then evaluated for effectiveness. A single combined “risks and opportunities” register no longer satisfies the standard, because clause 6.1.2 is now written around undesired effects and is separated from 6.1.3 entirely.
For a site already certified to ISO 9001:2015, this is the single biggest new build in the transition. Budget two to three weeks of elapsed time: half a day of cross-functional workshop, then a second pass to take each opportunity through all seven steps with a named owner and a date.
What clause 6.1.3 actually says
In ISO 9001:2015, clause 6.1 asked you to determine “risks and opportunities” as a single phrase and to plan actions to address them. Most organisations read that as one register with one column, and most auditors accepted it.
The 2026 edition splits that in two. Clause 6.1.2 now deals with risks and is oriented towards undesired effects, with an added requirement to analyse and evaluate them rather than simply list them. Clause 6.1.3 is a new, dedicated sub-clause for opportunities, and it carries its own lifecycle.
The verbs matter, because an auditor will sample against them. An opportunity has to be:
- Determined. You found it, and you can say how.
- Analysed. You understand what it involves and what it would take.
- Evaluated. You decided whether to pursue it, against stated criteria.
- Planned. There is an action, an owner and a date.
- Integrated. The action is built into a QMS process, not run beside it.
- Implemented. It actually happened.
- Evaluated for effectiveness. You measured whether it worked.
Seven verbs, seven pieces of evidence. A register that stops at “determined” answers one seventh of the clause.
Confirm the lettering yourself. Clause numbering and sub-clause lettering in this article follow ISO 9001:2026 as published on 16 September 2026. Check them against your own controlled copy of the standard before you write them into a procedure. Clause 7.5.3 external document control means an auditor will expect you to hold the current edition.
Why your existing register fails
We have looked at a lot of ISO 9001:2015 risk registers. On a certified, well-run site, the “opportunities” side of the register almost always falls into one of three patterns, and none of them survives a 2026 audit.
| What the register does | Why it looked fine in 2015 | Why it fails against 6.1.3 |
|---|---|---|
| The column is blank. Risks are populated, opportunities are empty or say “none identified”. | The clause was one phrase and the auditor sampled the risk side. | 6.1.3 is a standalone requirement. “None identified” against a dedicated sub-clause is a finding on its own. |
| Opportunities are risks written as positives. “Risk: supplier fails audit” becomes “Opportunity: supplier passes audit”. | It filled the column. | That is the same undesired effect with the sign flipped. There is no separate analysis, no integration, and nothing to measure. |
| Opportunities are the improvement plan. The register lists capital projects already approved by the board. | They are real and they are dated. | They were not determined, analysed or evaluated through the QMS. They arrive already decided, so five of the seven steps have no evidence. |
There is a fourth pattern that does pass, and it is the one to aim for: a register that a cross-functional group filled in, where entries were rejected as well as accepted, and where at least some entries have a dated effectiveness review showing the action did not work as expected. Auditors trust registers that record failures.
You do not have to design the register from a blank sheet. The ISO 9001:2026 Document Templates Toolkit includes a dedicated 6.1.3 opportunity procedure and a live Excel register with all seven steps as columns, 5×5 scoring, inherent and residual scores, and an action tracker that carries the effectiveness review.
The seven steps, one at a time
- Determine
Where opportunities come from, written down as sources you actually use: customer complaints and compliments, internal audit findings, the 4.1 context register, the 4.2 interested parties register, process performance data, near misses, supplier suggestions, and staff. Name the sources in your procedure, because “we discuss it at management review” is not a determination method. It is a meeting.
- Analyse
What the opportunity involves: which process it touches, what resources it needs, what could go wrong if you pursue it, and what the realistic size of the benefit is. This is where most registers are thinnest. One or two sentences per entry is enough, but it has to be specific to the entry.
- Evaluate
Decide, against criteria you set in advance. Benefit against effort is the usual pair, scored 1 to 5 each. The critical part is that the criteria exist before the scoring, and that some entries score badly and are recorded as not pursued. A register where every entry was pursued has not been evaluated.
- Plan
An action, a named owner (a person, not a department), a target date, and the resources agreed. Clause 6.2.2 has the same shape for objectives, and there is no reason to use a different format here.
- Integrate
This is the step sites skip, and it is the one the word “integrated” exists to catch. Integration means a QMS process changes: a procedure is revised, a control form gains a field, a work instruction changes, a KPI is added to the 9.1.3 analysis. If nothing in your documented system is different, the opportunity was not integrated. It was just done.
- Implement
Evidence it happened, with a date. A revised document at a new revision number, a training record, a signed-off change record under 6.3.
- Evaluate effectiveness
A measure, a target, an actual, and a date, taken far enough after implementation to mean something. This closes the loop and feeds clause 9.1.3 f), which now requires you to analyse the effectiveness of actions taken to address opportunities separately from actions taken to address risks.
The register: every column you need
You can build this in Excel. You do not need software. What you need is a column for each of the seven steps plus the housekeeping that makes it auditable.
| Column | What goes in it | Clause served |
|---|---|---|
| ID | OPP-001, sequential, never reused | 7.5 traceability |
| Date raised / Raised by | Date and the person’s name | 6.1.3 determine |
| Source | Drop-down: complaint, audit, context, interested party, process data, staff, supplier | 6.1.3 determine |
| Opportunity | One sentence, phrased as something you could do, not something you hope happens | 6.1.3 determine |
| Process affected | From your 4.4 process map | 4.4, 6.1.3 integrate |
| Analysis | What it involves, resources, what could go wrong | 6.1.3 analyse |
| Benefit (1-5) / Effort (1-5) / Score | Scored against stated criteria; score calculated | 6.1.3 evaluate |
| Decision | Pursue / Defer / Not pursued, plus the reason | 6.1.3 evaluate |
| Action / Owner / Target date | Named person and a real date | 6.1.3 plan |
| Integrated into | The document number and revision that changed | 6.1.3 integrate |
| Implemented date / Evidence | Date plus the record reference | 6.1.3 implement |
| Effectiveness measure / Target / Actual / Review date | The number, the goal, what happened, when you checked | 6.1.3 evaluate effectiveness, 9.1.3 f) |
| Status | Open / Implemented / Closed effective / Closed not effective | 9.3 h) |
The two columns in bold are the ones that decide whether you pass. “Integrated into” forces the link to a controlled document. “Closed not effective” as an available status is what tells an auditor the register is honest.
A worked register for a packaging site
Three real-shaped entries from a flexible packaging converter, to show the level of detail that satisfies the clause. Line A runs flexible laminate, Line B runs folding carton.
| OPP-004 | OPP-011 | OPP-015 | |
|---|---|---|---|
| Source | Customer complaint trend | Internal audit finding | Operator suggestion |
| Opportunity | Move colour approval on Line A from a visual match at the press to spectrophotometer measurement against a numeric tolerance | Use the existing ERP batch data to produce the 9.1.3 analysis automatically instead of rebuilding it by hand each quarter | Pre-stage the correct artwork proof at the press during changeover instead of fetching it after set-up |
| Analysis | Needs a spectrophotometer, a numeric tolerance agreed per customer, operator training. Risk: tolerance tighter than the press can hold, increasing rejects | Needs a report spec and two days of ERP support. Risk: report hides the judgement that a human applied | Needs a changeover checklist change and a proofing rack at the press. Low cost |
| Benefit / Effort / Score | 5 / 4 / 1.25 | 3 / 2 / 1.50 | 4 / 1 / 4.00 |
| Decision | Pursue | Deferred to next year: ERP upgrade due, would be rework | Pursue |
| Integrated into | WI 8.5.1 rev 3, CF 8.1.3 master specification rev 4 (tolerance added) | n/a | WI 8.5.1 rev 3 changeover section |
| Effectiveness measure | Colour complaints per million units: target below 12, was 31 | n/a | Minutes lost to changeover artwork retrieval: target below 4, was 11 |
| Actual / Review date | 9 · 14 Aug 2026 · Closed effective | n/a | 7 · 2 Sep 2026 · Closed not effective, reopened as OPP-019 with a second action |
Notice three things. OPP-011 was deferred with a stated reason, which is evidence of evaluation. OPP-004 and OPP-015 both name a document and revision in “Integrated into”. And OPP-015 was closed as not effective and reopened, which is the single most persuasive row in the whole register.
Running the workshop that fills it
The register does not fill itself from a desk. The fastest route we know is one facilitated session, then a second pass.
- Get the right room. Operations, sales, maintenance, planning, quality. Sales matters more than people expect, because they hear the opportunity before anybody else does. Getting that diary aligned is harder than running the session.
- Start from evidence, not from imagination. Put the last twelve months of complaints, internal audit findings and process data on the wall. Opportunities determined from evidence survive the “how did you determine this” question; brainstormed ones often do not.
- Capture, do not evaluate, in the room. Aim for thirty to forty raw entries. Evaluation happens afterwards against your criteria, otherwise the loudest person in the room becomes the criteria.
- Second pass with owners. Take each surviving entry through analyse, evaluate, plan and integrate with the person who will own it. Expect a third to be dropped at this stage, and record why.
- Set the review rhythm. Quarterly is normal. Clause 9.3 g) and h) require risks and opportunities as separate management review inputs, so the register has to be current before the review, not written for it.
What auditors reject
These are the findings we expect to see most often in the first two years of the transition.
| What the auditor sees | The finding | The fix |
|---|---|---|
| Register exists, every entry status is “Open” | No evidence of implementation or effectiveness evaluation | Close at least one full cycle before the audit. Run the register for a quarter before you book the visit |
| “Integrated into” column empty or says “n/a” | Integration into QMS processes not demonstrated | Link every pursued entry to a document number and revision |
| Every entry was pursued | Evaluation step not evidenced | Record the ones you rejected and why. A register with no rejections has no evaluation |
| Effectiveness column says “effective” | Effectiveness asserted, not measured | A number, a target, an actual and a date. “Effective” is a conclusion, not evidence |
| Opportunities are the capital plan | Determination and analysis not evidenced | Keep the capital plan. Add the entries that came from complaints, audits and staff, which is where determination is demonstrable |
| One person raised and owns every entry | Weak; often paired with a 5.1.1 k) finding | Clause 5.1.1 k) requires top management to promote opportunity-based thinking. Spread the raising across functions and show it |
The three knock-on clauses
Building the register is not the end of it. The 2026 edition carries the risk-opportunity split through three other clauses, and a site that builds the register but misses these will still pick up findings.
Responsibilities split in two
Clause 5.3 now lists six items a) to f). Items b) and e) separate reporting on QMS performance from reporting on opportunities. Your responsibilities matrix needs two rows where it had one, with a named holder for each.
Two analysis lines
Analysis and evaluation is now eight items a) to h). Items e) and f) split the effectiveness of actions taken on risks from actions taken on opportunities. Your quarterly analysis needs both lines, fed from the two registers.
Two review inputs
Management review inputs go from six to eight. Items g) and h) separate risks from opportunities. The agenda needs both headings, and the minutes have to follow the agenda rather than summarise the discussion.
The register is the build. The rest is knowing where it lands. If you would rather have someone facilitate the workshop and mark up your existing register, that is stage one and two of our ISO 9001 consulting. If you want your own team to run it, the Transition course includes an interactive Transition Planner.
Questions people ask
Is clause 6.1.3 really new, or was it in ISO 9001:2015?
The word “opportunities” was in the 2015 edition, inside clause 6.1 alongside risks. What is new in ISO 9001:2026 is that 6.1.3 is a dedicated sub-clause with its own seven-step lifecycle: determine, analyse, evaluate, plan, integrate, implement and evaluate effectiveness. The 2015 text did not require analysis, evaluation, integration or an effectiveness review for opportunities specifically. That is why a 2015-era combined register does not satisfy the 2026 clause.
How many opportunities should be in the register?
There is no required number and any consultant who gives you one is guessing. What matters is that the entries are traceable to a determination source, that some were evaluated and not pursued, and that the pursued ones have run far enough to have an effectiveness review. For a single manufacturing site, a register with fifteen to thirty live entries after the first year is typical. Ten well-evidenced entries beat sixty thin ones.
Can we keep one register with a risk/opportunity column?
You can keep one workbook, but the two need different columns, because the required steps differ. Risks under 6.1.2 need analysis and evaluation and proportionate action. Opportunities under 6.1.3 need the seven steps including integration and effectiveness. In practice, two sheets in one file works well and keeps the 9.1.3 and 9.3 splits easy to report. One sheet with a type column tends to collapse into the lowest common set of fields, which is how sites fail the integration step.
What counts as “integrated into the QMS processes”?
A documented part of your management system is different as a result. A revised procedure or work instruction at a new revision number, a new or changed field on a control form, a new KPI in the 9.1.3 analysis, a changed acceptance criterion in the master specification, or a change record raised under 6.3. If you cannot name a document and a revision, the auditor will read it as an action taken beside the system rather than integrated into it.
How long does it take to build?
Allow two to three weeks of elapsed time for a first register you would be happy to show: half a day for the cross-functional workshop, a second pass with owners over the following fortnight, and the procedure written around it. Then allow a further quarter of the register actually running before your transition audit, because the auditor needs implemented entries and at least one effectiveness review to sample. Sites that build the register the month before the audit get findings on the last two steps every time.
Does a small site need all of this?
The clause applies whatever your size, but the scale of the evidence is yours to set. A twenty-person converter can satisfy 6.1.3 with a single spreadsheet, eight to twelve live entries, and a quarterly review minuted alongside the risk review. What it cannot do is skip a step. Seven verbs apply to a small site exactly as they apply to a large one; the difference is how many rows sit under them.
ISO 9001:2026 is published by the International Organization for Standardization. Clause references follow the sixth edition published on 16 September 2026; confirm the lettering against your own controlled copy. Transition dates are set by Global Accreditation Cooperation, known as Global ACI, in document Global ACI-TECH-3-TR. ASC Food Safety Consultants is an independent consultancy, training provider and auditing firm. Our toolkits and courses are our own products and are not approved, endorsed or accredited by ISO or by any certification body.