How to Audit Clause 6.1.4: From Risk to Planned Action

Why Clause 6.1.4 Matters More Than Most Auditors Realise

Clause 6.1.4 sits at the end of the planning section in ISO 9001, ISO 45001, and several other standards. On the surface it looks simple: the organisation must plan actions to address its risks and opportunities, integrate those actions into its management system processes, and evaluate their effectiveness. Easy enough to read. Much harder to audit well.

The problem is that most organisations have done the risk identification work reasonably well. They have a risk register, they have identified hazards, they have listed their interested parties. Where things fall apart is the connection between that identification work and what actually happens on the ground. Clause 6.1.4 is the bridge between thinking about risk and doing something about it. When that bridge is shaky, the whole planning section loses its value.

This article walks you through how to audit Clause 6.1.4 in practice. It covers what the clause actually requires, where organisations commonly fail, and the specific questions and evidence you need to gather. Whether you are conducting an internal audit or a third party certification audit, this guidance will help you move beyond surface compliance and assess whether planned actions are genuinely embedded in the system.

What Clause 6.1.4 Actually Requires

Before you can audit a clause effectively, you need to be clear on what it demands. Clause 6.1.4 requires the organisation to plan actions to address the risks and opportunities identified in Clause 6.1.1 (and in standards like ISO 45001, the more detailed hazard and risk assessment in Clauses 6.1.2 and 6.1.3). It then requires three things of those planned actions.

• The actions must be integrated into and implemented within the management system processes.
• The effectiveness of the actions must be evaluated.
• Actions must be proportionate to the potential impact on conformity of products and services, or in safety standards, to the potential impact on worker health and safety.

That last point is one auditors often overlook. The standard does not ask for the same level of response to every risk. A minor administrative risk does not warrant the same investment of resources as a risk that could result in a serious safety incident or a major product failure. Proportionality is a legitimate and important concept here.

It is also worth noting what Clause 6.1.4 does not require. It does not mandate a formal risk treatment plan document, though many organisations have one. It does not specify a particular methodology for selecting or prioritising actions. The standard gives organisations genuine flexibility in how they respond to risks, which means your job as an auditor is to assess whether the approach is systematic, documented where necessary, and actually working.

The Common Failure Modes You Will Encounter

After conducting hundreds of audits across different industries and standards, the same weaknesses appear repeatedly in how organisations handle Clause 6.1.4. Knowing these in advance helps you focus your audit time where it matters.

Actions That Exist Only on Paper

The most frequent finding is a risk register full of identified risks, each with a corresponding action listed, but no evidence that those actions have been implemented. The risk register says implement supplier evaluation procedure against a particular risk. You ask to see the procedure. It does not exist. Or it exists but nobody uses it. The action was planned. It was never done.

Actions That Are Not Integrated Into Processes

Clause 6.1.4 specifically requires integration into management system processes. This is a deliberate requirement. An action that lives only in the risk register is not integrated. An action that has been built into a procedure, a work instruction, a training programme, or a monitoring activity is integrated. You need to verify that the actions have found their way into the actual way work is done, not just into a planning document.

No Evaluation of Effectiveness

Organisations frequently plan actions and implement them but never go back to ask whether they worked. Effectiveness evaluation does not need to be elaborate. It might be a review at management review, a KPI that tracks the relevant outcome, or a follow up audit. But something needs to demonstrate that the organisation has checked whether the action achieved what it was supposed to achieve. When this is absent, you have a nonconformity against Clause 6.1.4 even if the actions themselves were implemented.

Disproportionate or Absent Responses

Some organisations apply the same generic action to every risk regardless of its significance. Others identify high priority risks and then assign token actions that could not plausibly address the risk. Both represent a failure of proportionality. A risk assessed as high likelihood and high consequence should attract a substantive, resourced response. If it does not, you need to probe why.

Building Your Audit Approach for Clause 6.1.4

Clause 6.1.4 cannot be audited in isolation. It connects backward to Clause 6.1.1 (and the hazard and risk assessment clauses in ISO 45001), and it connects forward to the operational clauses in Section 8 and the performance evaluation clauses in Section 9. Your audit trail needs to follow that chain.

Start With the Risk Register and Planning Documents

Before you start interviewing people, review the risk register or risk and opportunity log. Look for the following:

• Are risks and opportunities identified, consistent with what was identified under Clause 6.1.1?
• Does each significant risk or opportunity have a corresponding planned action?
• Are actions assigned to a responsible person with a target date?
• Are actions described specifically enough that you could verify whether they have been done?

Vague actions are a red flag. An action described as monitor supplier performance tells you almost nothing. An action described as conduct quarterly supplier performance reviews using the approved evaluation form, with results reported to management review is specific enough to verify. When actions are vague, it is usually because nobody has thought carefully about what they actually need to do.

Trace Actions Into Operations

Pick three to five significant risks from the register and trace each one through to the operational controls designed to address it. This is where the integration requirement becomes auditable. For each selected risk, ask:

• What specific action was planned to address this risk?
• Where in the management system has that action been implemented? Is it in a procedure, a training record, a monitoring programme, a work instruction?
• Can you show me evidence that the action is being carried out?

For example, if the risk is key person dependency in the production planning function, the planned action might be cross training of a second person. Your audit trail then follows: Is there a training plan? Are there competence records for the second person? Has the cross training actually occurred?

For ISO 45001 audits, this tracing exercise is particularly important. A hazard identified in the hazard register should connect to a control in the hierarchy of controls, which should connect to a procedure or safe work method statement, which should connect to evidence of worker awareness and competence. If any link in that chain is broken, you have a finding. For more detail on how this works under ISO 45001, the article on Planning Action in ISO 45001: Making Sense of Clause 6.1.4 covers the standard specific requirements in depth.

Check Effectiveness Evaluation

This is the step most auditors skip or address only superficially. Ask the auditee directly: how do you know the actions are working? Look for:

• KPIs or metrics that track the outcome the action was designed to achieve
• Management review records that include a discussion of whether planned actions achieved their intended results
• Internal audit findings that have assessed the effectiveness of specific controls
• Any formal review of the risk register that includes an assessment of whether risks have reduced as a result of actions taken

If the organisation cannot demonstrate any mechanism for evaluating effectiveness, that is a gap. The standard is explicit that effectiveness must be evaluated, not just assumed.

Interview Questions That Get to the Truth

Document review alone will not give you a complete picture. The interviews are where you discover whether the system is real or just well documented. Here are the kinds of questions that work well when auditing Clause 6.1.4.

Questions for the Quality Manager or Management System Owner

• Walk me through how you decide what actions to take in response to a significant risk.
• How do you make sure those actions actually get implemented, rather than just sitting in the risk register?
• How do you know when an action has been effective?
• When did you last review the risk register and update the status of planned actions?
• Can you give me an example of a risk where the action you took turned out not to work as expected? What did you do next?

Questions for Process Owners and Operational Staff

• Are you aware of any risks that have been identified for your area? What are they?
• What controls or procedures have been put in place to manage those risks?
• Have those controls changed in the past year? Why?
• How do you know the controls are working?

The gap between what the quality manager says and what operational staff experience is often where the most significant findings live. If the quality manager describes a robust risk response programme but the team leader on the floor has no idea what risks have been identified for their area, the integration requirement has not been met.

Proportionality: A Concept Worth Testing

The proportionality requirement in Clause 6.1.4 is underutilised as an audit focus. Most auditors check whether actions exist. Fewer check whether the actions are scaled appropriately to the risk.

Consider a manufacturing organisation that has identified a risk of contamination in its production process with a potential consequence of product recall and serious customer harm. The planned action is a reminder in the weekly team briefing to follow hygiene procedures. That is almost certainly disproportionate. The risk is significant. The response is minimal.

Conversely, an organisation that has identified a minor administrative risk around document version control and has implemented a multi stage approval system, a dedicated document control officer, and quarterly audits of document status might be over engineering its response. Proportionality works in both directions.

When assessing proportionality, you are exercising professional judgement. You are not applying a formula. Ask yourself: given what this organisation has told me about the significance of this risk, does the planned action represent a reasonable response? If the answer is clearly no in either direction, that is worth noting as at minimum an observation, and potentially a nonconformity if the gap is significant enough.

Common Audit Scenarios and How to Handle Them

Scenario One: The Risk Register Has Not Been Updated

You review the risk register and find that the last update was eighteen months ago. Several actions are marked as in progress with due dates that have long passed. The organisation has not revisited the register since the last certification audit.

This is a clear nonconformity against Clause 6.1.4 in combination with Clause 6.1.1. The organisation has not maintained its planning process. The planned actions have not been managed, and there is no evidence of effectiveness evaluation. Document the finding with the specific evidence: the date of the last update, the number of overdue actions, and the absence of any review record.

Scenario Two: Actions Are Implemented but Not Documented

You trace a risk through to operations and find that the control is genuinely in place. The team leader describes it clearly. Observation confirms it is being followed. But there is no documented procedure, no training record, and no reference to this control in the risk register or any management system document.

This is a more nuanced situation. The action has been implemented but it is not integrated into the management system in a way that is visible, controlled, or sustainable. If the team leader leaves, the control may disappear. This is typically an observation or a minor nonconformity depending on the significance of the risk being controlled. The key question is whether the lack of documentation creates a real vulnerability in the system.

Scenario Three: Effectiveness Has Never Been Evaluated

The organisation implemented several significant actions two years ago in response to risks identified during their initial certification process. When you ask how they know those actions worked, the quality manager says the risks have not caused any problems. That is not effectiveness evaluation. That is absence of evidence of failure, which is a different thing entirely.

A risk that has not materialised might mean the controls are working. Or it might mean the risk was overestimated. Or it might mean the controls are not working but the organisation has been fortunate. Without a deliberate evaluation process, you cannot tell the difference. Raise this as a nonconformity against the effectiveness evaluation requirement.

Linking Clause 6.1.4 to the Rest of the Audit

Clause 6.1.4 does not exist in a vacuum. The actions planned under this clause should show up throughout the management system. When you are auditing other clauses, keep an eye out for evidence that connects back to the planning section.

• In Clause 7.2, competence requirements should reflect the skills needed to implement risk controls.
• In Clause 8.1, operational planning and control should include the specific controls identified in response to risks.
• In Clause 9.1, monitoring and measurement activities should include metrics that track the effectiveness of risk controls.
• In Clause 9.3, management review inputs should include a discussion of whether planned actions have achieved their intended results.

If you are auditing ISO 9001 and you want to understand how risk based thinking connects across the standard, the article on Risk Based Thinking With Practical Examples provides useful context on how the standard treats risk as a thread running through the entire system rather than a standalone activity.

Similarly, if you are auditing a quality management system and want to understand how the planning section connects to objectives, the guidance on Auditing Quality Objectives: Evidence to Look for Under Clause 6.2 will help you follow the planning thread from risk identification through to measurable targets.

Documenting Your Findings

When you raise findings against Clause 6.1.4, be specific about which element of the clause has not been met. The clause has three distinct requirements: planning actions, integrating them into processes, and evaluating effectiveness. A finding that simply says risk controls not implemented is less useful than one that says actions recorded in the risk register for risks identified in Clause 6.1.1 have not been integrated into operational processes, with no evidence of implementation for three of five sampled risks.

Specificity in your nonconformity reports matters for two reasons. It helps the auditee understand exactly what needs to be corrected. And it demonstrates that your finding is grounded in evidence, not opinion. For practical guidance on writing findings that hold up, the article on How to Write Nonconformities That Hold Up covers the structure and language that makes a finding defensible.

Building Your Competence to Audit Planning Clauses

Clause 6.1.4 is one of those clauses that separates experienced auditors from newer ones. The requirements are clear enough to understand in a few minutes. Auditing them well requires the ability to trace evidence across the system, ask questions that reveal the gap between documentation and reality, and make proportionality judgements that hold up to scrutiny.

If you are building your auditing skills and want to develop genuine competence in auditing planning requirements across ISO 9001, ISO 14001, ISO 45001, and other standards, Audit Workshop offers practical internal auditor and lead auditor training courses built around real audit scenarios. The training is designed by practising auditors who have conducted hundreds of certification audits, and it focuses on the kind of applied judgement that makes the difference in the field. You can explore the available courses at auditworkshop.com.