— Plan: establish the objectives of the system and its processes, and the resources needed to deliver
results in accordance with customers’ requirements and the organization’s policies, and identify
and address risks and opportunities;
— Do: implement what was planned;
— Check: monitor and (where applicable) measure processes and the resulting products and services
against policies, objectives, requirements and planned activities, and report the results;
— Act: take actions to improve performance, as necessary.
0.3.3 Risk-based thinking
Risk-based thinking (see Clause A.4) is essential for achieving an effective quality management system.
The concept of risk-based thinking has been implicit in previous editions of this International Standard
including, for example, carrying out preventive action to eliminate potential nonconformities, analysing
any nonconformities that do occur, and taking action to prevent recurrence that is appropriate for the
effects of the nonconformity.
To conform to the requirements of this International Standard, an organization needs to plan and
implement actions to address risks and opportunities. Addressing both risks and opportunities
establishes a basis for increasing the effectiveness of the quality management system, achieving
improved results and preventing negative effects.
Opportunities can arise as a result of a situation favourable to achieving an intended result, for
example, a set of circumstances that allow the organization to attract customers, develop new products
and services, reduce waste or improve productivity. Actions to address opportunities can also include
consideration of associated risks. Risk is the effect of uncertainty and any such uncertainty can have
positive or negative effects. A positive deviation arising from a risk can provide an opportunity, but not
all positive effects of risk result in opportunities.