How to Audit Risk Based Thinking in an ISO Management System

Why Risk Based Thinking Is One of the Hardest Things to Audit

Risk based thinking sits at the heart of every modern ISO management system. It is embedded in ISO 9001, ISO 14001, ISO 45001, and every other standard built on the harmonised structure. Yet for many auditors, especially those newer to the role, it is one of the most difficult areas to audit with confidence.

The difficulty is not conceptual. Most auditors understand what risk based thinking means. The difficulty is evidential. Unlike documented information, which you can read, or a calibration record, which you can verify, risk based thinking is a way of operating. You cannot point to a single document and say the organisation has it. You have to build a picture from multiple sources across the whole system.

This article walks through exactly how to do that. It covers what you are actually looking for, where to find the evidence, the questions that open things up, and the most common failures that lead to nonconformities in this area.

What Risk Based Thinking Actually Means in an ISO Context

Before you can audit risk based thinking, you need to be clear on what it requires. The standard does not ask organisations to have a risk management system in the formal sense. It asks them to identify risks and opportunities that could affect the management system's ability to achieve its intended outcomes, and then take proportionate action to address them.

That is a meaningful distinction. A small business does not need a risk register formatted like a multinational's enterprise risk framework. What it does need is evidence that people have thought about what could go wrong, what opportunities exist, and what they have done about it.

For ISO 9001, this sits primarily in Clause 6.1. For ISO 14001, it spans Clause 6.1.1 through to 6.1.4, with significant depth around aspects and impacts, compliance obligations, and risks and opportunities. For ISO 45001, the planning requirements in Clause 6.1 are even more specific, with dedicated subclauses for hazard identification, risk assessment, and opportunity assessment.

Across all three standards, the common thread is this: risk based thinking must be visible in the way the organisation plans, operates, and improves. It is not a standalone activity. It runs through everything.

For a practical grounding in what risk based thinking looks like in practice, the post on risk based thinking with practical examples is worth reviewing before you start planning your audit.

Where to Look for Evidence of Risk Based Thinking

Start With the Context and Interested Parties

Risk based thinking does not begin at Clause 6. It begins at Clause 4. The organisation's understanding of its context and its interested parties is the foundation on which risk identification is built. If an organisation has done a superficial job of Clause 4, its risk assessment will almost certainly be superficial too.

When you review the context analysis, ask whether it reflects the actual operating environment. A construction company that lists its interested parties as customers and regulators but omits subcontractors, local communities, and workers has probably not thought deeply about its risks either. The gaps in Clause 4 tend to predict the gaps in Clause 6.

The Risk Register or Equivalent

Most organisations maintain some form of documented risk register, risk matrix, or risk assessment record. This is usually your first port of call. When you review it, do not just check that it exists. Look at whether it is credible.

Ask yourself these questions as you review the document:

• Does the register reflect the organisation's actual activities, not just generic risks copied from a template?
• Are the risks specific enough to be actionable? A risk listed as quality failure tells you nothing useful.
• Are the ratings consistent? If a risk is rated high but the control action is vague or absent, something does not add up.
• Has the register been reviewed recently? A risk register that was created at certification and never touched again is a red flag.
• Are risks linked to specific processes, objectives, or interested parties?

You are not auditing whether the register follows a particular methodology. You are auditing whether it reflects genuine thinking about the organisation's risks and whether it has driven any real action.

Quality and Management Objectives

Objectives are one of the clearest indicators of risk based thinking in practice. The standard requires objectives to be consistent with the quality policy, measurable, monitored, communicated, and updated. But the deeper question is whether the objectives actually address the risks and opportunities the organisation has identified.

If an organisation identifies customer complaint handling as a significant risk but sets no objective related to complaint resolution time or customer satisfaction, there is a disconnect. That disconnect is worth probing. It may indicate that the risk assessment and the planning processes are operating independently of each other, which defeats the purpose.

The post on how to audit risk based thinking under ISO 9001 Clause 6.1 goes into useful detail on the link between risk identification and objective setting.

Operational Controls

Risk based thinking should be visible in how the organisation controls its operations. When you walk the floor or review operational processes, look for evidence that controls exist because someone identified a risk, not just because someone always did it that way.

This is where process auditing becomes important. Ask operators and supervisors why a particular control is in place. If they can explain the risk it addresses, that is a good sign. If they have no idea and just follow the procedure, you may have a system that has documented its controls without connecting them to any risk thinking.

That is not necessarily a nonconformity on its own, but it often points to one. If the documented risk assessment does not reflect the real controls being applied on the floor, or if operational risks have emerged that are not captured in the risk register, you have found a gap.

Management Review

Management review is where risk based thinking should surface at the leadership level. The standard requires management review to consider changes in external and internal issues, the performance of the management system, and the adequacy of resources. All of these have a risk dimension.

When you review management review records, look for evidence that risks and opportunities were actually discussed and that decisions were made in response. A management review that produces no actions related to risk, even in a period of significant business change, is suspicious. It suggests the review is a compliance exercise rather than a genuine leadership activity.

Audit Questions That Open Up the Conversation

Getting people to talk about risk based thinking requires a different approach from asking about documented information. You cannot simply ask to see the risk register and tick a box. You need to understand how risk thinking actually works in the organisation.

Here are questions that tend to generate useful responses:

• Can you walk me through how you identified the risks relevant to this process? This tests whether the risk assessment was a genuine exercise or a paper exercise.
• What has changed in your operating environment recently, and how did that affect your risk assessment? This tests whether risk thinking is ongoing or static.
• When you set this objective, what risk or opportunity were you responding to? This tests the link between planning and risk identification.
• Has anything happened in the last 12 months that you did not anticipate in your risk register? How did you respond? This tests whether the system is adaptive.
• Who is involved in reviewing and updating the risk register? This tests ownership and whether risk thinking is embedded across the organisation or confined to one person.
• Can you give me an example of a risk that you identified and then addressed through a change to a process or control? This tests whether risk thinking drives action.

Listen carefully to the answers. Vague responses, long pauses, or answers that describe what the standard requires rather than what the organisation actually does are all signals worth following up.

Common Nonconformities in Risk Based Thinking

The Risk Register That Was Never Updated

This is probably the most common finding. An organisation creates a risk register during the implementation phase, uses it to get certified, and then leaves it untouched for two or three years. The business has changed. New processes have been added. Key staff have left. A major customer has changed their requirements. None of this is reflected in the risk register.

The nonconformity here is not that the register is old. It is that the organisation has not demonstrated that it is determining and addressing risks on an ongoing basis, as required by the standard. Risk based thinking is not a one-time exercise.

Risks That Are Generic and Disconnected

Another common finding is a risk register full of generic entries that could apply to any organisation in any industry. Risks like loss of key personnel or regulatory change are listed without any specificity about which personnel, which regulations, or what the actual impact on the management system would be.

When risks are this generic, they rarely drive meaningful action. The controls listed against them tend to be equally vague, and there is no real connection between the risk assessment and what the organisation actually does. This is a system that has satisfied the letter of the requirement without satisfying its intent.

No Link Between Risks and Actions

The standard requires organisations to take action to address risks and opportunities. This means the risk assessment must lead somewhere. If an organisation has identified a high-rated risk but the only action recorded is monitor, you need to probe further. Monitoring is not the same as addressing. What is being monitored? By whom? At what frequency? What would trigger a different response?

Often you will find that the action column in the risk register was filled in to satisfy the format requirement, not because anyone actually planned what to do about the risk.

Risk Thinking Confined to One Person

In many smaller organisations, risk based thinking is the responsibility of the quality manager or the management representative. Everyone else in the organisation has no awareness of the risk register, no involvement in its development, and no understanding of how their work connects to the organisation's risks and opportunities.

This is a structural problem. Risk based thinking is supposed to be embedded in how the organisation operates, not locked in a document that only one person maintains. When you find this pattern, the nonconformity is usually framed around the lack of integration of risk thinking into operational processes and management decisions.

How to Audit Risk Based Thinking Across Different Standards

ISO 9001

In ISO 9001, risk based thinking is primarily addressed in Clause 6.1. The standard is deliberately flexible here. It does not require a formal risk management process or a documented risk register. What it requires is evidence that the organisation has considered risks and opportunities and taken action proportionate to their potential impact.

For a quality management system, risk based thinking should be visible in process controls, supplier management, design controls, and customer-related processes. When you audit these areas, ask how risk thinking influenced the controls that are in place.

ISO 14001

ISO 14001 is more prescriptive. It requires the organisation to identify environmental aspects and determine which are significant, evaluate compliance obligations, and identify risks and opportunities related to the environmental management system. These are separate but related activities.

When auditing risk based thinking in an EMS, trace the connection between the aspects and impacts register, the compliance obligations register, the risks and opportunities assessment, and the environmental objectives. If these documents are consistent and connected, the organisation has probably done the work. If they appear to have been developed independently and do not reference each other, the integration is missing.

ISO 45001

ISO 45001 has the most detailed planning requirements of the three. Clause 6.1 includes specific requirements for hazard identification, OH&S risk assessment, assessment of OH&S opportunities, and evaluation of other risks and opportunities. Each of these is a distinct activity.

When auditing an OH&S management system, check that hazard identification is ongoing and covers routine, non-routine, and emergency situations. Check that the risk assessment methodology is documented and applied consistently. Check that opportunities for improvement, not just risks, have been considered. This last point is often missed. Organisations focus heavily on risk reduction but give little attention to OH&S opportunities such as better work organisation, improved worker participation, or adoption of safer technologies.

For more detail on what auditors look for in the hazard identification and risk assessment process, the post on auditing hazard identification: is the process ongoing and proactive? covers this area well.

Documenting Your Findings

When you identify a nonconformity related to risk based thinking, be precise in how you write it up. Vague findings like risk register not adequate are difficult to close because the auditee does not know exactly what needs to change.

A well-written nonconformity in this area will state the specific requirement, describe exactly what was found or not found, and reference the evidence. For example: the organisation's risk register, last reviewed in March 2022, does not reflect significant changes to the operating environment including the addition of a new production line and the loss of the primary supplier, contrary to the requirement in Clause 6.1.1 to determine risks and opportunities on an ongoing basis.

That gives the auditee something concrete to work with. They know what the gap is, they know what the requirement is, and they can develop a corrective action that actually addresses the root cause.

For guidance on writing findings that hold up, the post on how to write audit findings that stand up to challenge is worth reading alongside this one.

Building Your Competence in This Area

Auditing risk based thinking well takes practice. It requires you to think beyond the document in front of you and assess whether a system is genuinely operating in a risk-aware way. That kind of judgement develops over time, through conducting audits, reviewing findings, and reflecting on what you found and why.

If you are working towards your internal auditor or lead auditor credentials and want to build confidence in auditing planning requirements, the courses at Audit Workshop cover risk based thinking in depth. The training is designed around real audit scenarios, not just clause explanations, so you leave with practical skills you can apply immediately. Whether you are auditing ISO 9001, ISO 14001, or ISO 45001, the internal auditor and lead auditor programmes will equip you to assess this area with the rigour it deserves.