Chapter 6: Planning for the QMS — Risk-Based Thinking in Practice (Clause 6)

Actions to Address Risks and Opportunities (Clause 6.1)

Risk-based thinking is the defining characteristic of ISO 9001:2015 compared to its predecessor. Clause 6.1 requires the organization to determine risks and opportunities that need to be addressed to give assurance the QMS can achieve intended results, enhance desirable effects, prevent or reduce undesired effects, and achieve improvement.

The standard does not prescribe a specific risk management methodology. It does not require a formal risk register, FMEA, or risk matrix. It requires that the organization thinks about risk systematically and takes action to address it.

For Maple Ridge Fabricating, risk-based thinking was initially treated as another documentation exercise. The quality manager created a risk register listing generic risks like "supplier failure" and "equipment breakdown" with generic mitigation actions like "maintain approved supplier list" and "conduct preventive maintenance." The register was reviewed once per year during management review and otherwise ignored.

Effective risk management at a manufacturing operation connects risk identification to operational decision-making. Maple Ridge's revised approach embeds risk thinking into specific processes. When evaluating a new supplier, the procurement manager assesses not only cost and capability but also financial stability, geographic concentration risk, and quality system maturity. When planning production for a new product, the production team conducts a process FMEA to identify potential failure modes before the first part is produced. When a customer changes specifications, engineering evaluates the risk of the change on existing tooling, material, and process parameters before accepting the change order.

Risk-based thinking is not a document. It is a decision-making discipline that the QMS embeds into daily operations.

Quality Objectives and Planning (Clause 6.2)

Quality objectives must be consistent with the quality policy, measurable, consider applicable requirements, be relevant to conformity of products and services, be monitored, communicated, and updated as appropriate.

Maple Ridge initially set quality objectives that were unmeasurable: "improve customer satisfaction," "enhance product quality," "increase employee engagement." These objectives provided no basis for action or evaluation.

Effective quality objectives for a Canadian manufacturer are specific and time-bound. Maple Ridge's revised objectives for 2026 include: achieve 95% on-time delivery by Q3 (measured monthly by shipping records), reduce internal scrap rate from 4.3% to below 2.5% by year-end (measured weekly by production reports), achieve zero repeat customer complaints on the same failure mode (measured quarterly by complaint database), complete competency assessments for 100% of production operators by Q2 (measured by training records), and close all corrective actions within 30 days of issuance (measured monthly by CAPA log).

Each objective has a metric, a target, a timeline, a data source, and an owner. This transforms quality objectives from aspirational statements into operational commitments that drive behavior.

Planning of Changes (Clause 6.3)

When changes to the QMS are needed, they must be carried out in a planned manner considering the purpose of the change, potential consequences, QMS integrity, availability of resources, and allocation of responsibilities.

This clause is frequently overlooked because it addresses how the QMS itself changes — not product or process changes. When Maple Ridge decided to implement a new document control software system, the change affected every procedure, form, and record in the QMS. Without planned change management, the transition created three months of confusion where some documents existed in the old system and some in the new system, version control was temporarily lost, and auditors could not trace document approval histories.

Planning changes to the QMS requires the same discipline as planning changes to a product or process. Define what is changing, why, who is affected, what the timeline is, and how the transition will be managed without losing system integrity.