The question in which form or to what extent documented information is required as proof can be answered as follows: There is no concrete, precise requirement for this in the relevant chapters of the standard!
Instead, Annex A4 of the ISO 9001 QM standard, which is also worth reading, states that "... the organization is responsible for applying risk-based thinking and for initiating actions to address a risk, including answering the question of whether or not documented information is to be retained by it as evidence of the determination of risks."
In simpler terms, this is something an organization determines individually for itself - not the standard! And: this is also not determined by the certification body or its auditors.
Interested parties and their relevant requirements
One aspect that should not be overlooked is the consideration of the essential requirements of the interested parties relevant to the quality management system (QMS) (chapter 4.2).
In this context, "relevance" is to be interpreted as follows:
impact on the organization's ability to continuously provide compliant products and services, i.e., products and services that meet customer expectations and legal, regulatory requirements. Thus, in the context of the risk-based approach, these must also be taken into account (section 6.1.1 Planning).
Distinction between opportunities and risks in the sense of ISO 9001
In addition to considering risks, the standard's requirement also addresses those of opportunities that can arise from risks. However, many companies are faced with the question of what concrete opportunities can be. What is not meant by an opportunity is the achievement of intended results. This is a fundamental requirement of the management system and its processes.
In this international standard, the opportunity is understood as a "possibility or opportunity" that can arise when a company takes a controllable risk. Good references are given in chapter 0.3.3 of ISO 9001, where the following possibilities for opportunities are listed:
- Customer acquisition
- Development of new products and services
- Reduction of scrap or waste
- Improvement of productivity
Further guidance on what can be understood by an opportunity can be found in the notes to chapter 6.1.2:
- Adoption of new practices and use of new techniques
- Market introduction of new products
- Development of new markets
- Acquiring new customers and building partnerships
- Use of new techniques, etc.
