Risk Register Template for ISO 9001

STANDARD OPERATING PROCEDURE: ISO 9001 Quality Risk Register Management

Document ID: SOP-TR-ISO9001-042
Effective Date: October 24, 2023
Version: 3.2
Review Cadence: Annual
Owner: Julian Vance, Chief Architect, Template Registry

---

1. Executive Summary & Purpose

This Standard Operating Procedure (SOP) defines the institutional requirements for establishing, maintaining, and reviewing the Risk Register in strict alignment with ISO 9001:2015 Clause 6.1 (Actions to address risks and opportunities). The purpose of this procedure is to systematically identify, evaluate, mitigate, and monitor operational and strategic quality risks to ensure the Quality Management System (QMS) achieves its intended results, prevents undesired effects, and drives continuous improvement.

---

2. Scope & Prerequisites

2.1 Scope

This procedure applies to all operational units, product lines, software engineering pipelines, and administrative functions within Template Registry. It governs all identified internal and external issues (per Clause 4.1) and interested party requirements (per Clause 4.2).

2.2 Prerequisites & Tools

• Software Environment: Template Registry Enterprise Risk Management (ERM) module or baseline ISO 9001 Risk Register Template (v3.2+).
• Access Control: Risk Owner and Quality Manager clearance levels within the documentation control system.
• Reference Standards: ISO 9001:2015 Quality Management Systems — Requirements; ISO 31000:2018 Risk Management — Guidelines.

---

3. Roles & Responsibilities (RACI Matrix)

(R = Responsible, A = Accountable, C = Consulted, I = Informed)

---

4. Step-by-Step Procedure

Phase 1: Risk Identification

• 1.1 Convene quarterly risk identification workshops with relevant Process Owners and departmental stakeholders.
• 1.2 Review inputs from internal audits, customer feedback, non-conformance reports (NCRs), and SWOT analyses.
• 1.3 Record each identified risk in the Risk Register template with a unique identifier format: RISK-[DEPT]-[YYYY]-[000].
• 1.4 Document the risk description, linking it explicitly to a specific ISO 9001 clause or QMS process objective.

Phase 2: Risk Evaluation & Scoring

• 2.1 Assess the Likelihood (L) of the risk occurring on a standardized 1 to 5 scale (1 = Rare, 5 = Almost Certain).
• 2.2 Assess the Severity/Impact (S) of the risk on product quality, customer satisfaction, or compliance on a 1 to 5 scale (1 = Negligible, 5 = Catastrophic).
• 2.3 Calculate the Risk Priority Number (RPN) or Risk Score using the formula: $\text{Score} = \text{Likelihood (L)} \times \text{Severity (S)}$.
• 2.4 Apply risk disposition thresholds:
  • Low (1–6): Accept / Monitor.
  • Medium (8–12): Mitigate via standard operational controls.
  • High (15–25): Mandatory immediate mitigation plan required; escalate to Quality Manager.

Phase 3: Mitigation & Action Planning

• 3.1 Formulate a risk treatment strategy for all Medium and High risks (Avoid, Mitigate, Transfer, or Accept).
• 3.2 Define specific, measurable mitigation actions and assign a single accountable Risk Owner.
• 3.3 Set target completion dates for all mitigation tasks within the Risk Register tracking module.
• 3.4 Re-evaluate and record the Residual Risk Score ($\text{New Likelihood} \times \text{New Severity}$) assuming successful implementation of mitigation controls.

Phase 4: Monitoring, Review & Closure

• 4.1 Conduct monthly reviews of open High-risk items during operational management reviews.
• 4.2 Update the Risk Register status column (Open, In Treatment, Verified, Closed) as mitigation milestones are achieved.
• 4.3 Validate the effectiveness of implemented controls through internal quality audits before closing any high-severity risk item.

---

5. Quality Assurance & Pro-Tips

5.1 Pro-Tips for Implementation

• Dynamic Linkage: Never treat the risk register as a static document. Cross-reference risks directly with the Corrective and Preventive Action (CAPA) log to demonstrate closed-loop traceability during ISO 9001 audits.
• Focus on Opportunities: Per ISO 9001:2015 Clause 6.1, use the same scoring matrix to evaluate positive risks (opportunities). Document efficiency gains alongside threat mitigations.

5.2 Common Pitfalls to Avoid

• Vague Descriptions: Avoid statements like "System might fail." Use precise syntax: "Production database cluster may fail due to unpatched regional failover dependencies, leading to SLA breach."
• Orphaned Risks: Every registered risk must have an assigned human owner. Generic ownership (e.g., "Engineering Team") is non-compliant with accountability standards.

5.3 Metric Thresholds

• Review Compliance: 100% of open High-priority risks must be reviewed every 30 days.
• Overdue Actions: Zero mitigation actions permitted to exceed target closure dates by >14 days without an approved Change Request.

---

6. Frequently Asked Questions (FAQ)

Q1: How do we handle risks that cannot be mitigated below an RPN of 15 due to technical constraints?
A: If a high residual risk must be accepted, the acceptance must be formally documented, justified, and approved by Executive Leadership and the Quality Manager, accompanied by an explicit contingency/fallback plan.

Q2: Are opportunities required to be tracked in the exact same register as threats?
A: Yes. Maintaining a unified register with a "Type" column (Threat vs. Opportunity) simplifies administrative overhead and satisfies ISO 9001 Clause 6.1 unified framework expectations.