What can we understand?
How to apply the risk approach to systems, processes and operations

ISO 9001:2015 incorporates a risk-based approach (see definition of risk in the glossary at the end of this sheet). However, this does not mean that ISO 9001 becomes a risk management system. In fact, the risk-based approach must be considered in relation to the objectives of a quality management system.

First and foremost, you need to consider risk, not as a separate risk management process, but as a common thread running through your quality management. The risk-based approach should enable you to determine the "just necessary" elements of your management system. The degree of formalism of your management system should be proportionate to the risks to be controlled: not everything needs to be described, not everything needs to...