Risks and opportunities, separately
Clause 6.1 is reorganised into three: determining risks and opportunities (6.1.1), actions to address risks (6.1.2) and actions to address opportunities (6.1.3). The split makes visible something many systems neglected: an opportunity is not a risk with the sign reversed, and it deserves its own action.
The transition document describes the reorganisation but does not say that any particular methodology is required. A matrix is still good practice rather than a requirement, unless the standard says otherwise.
Changes that are planned and checked
Clause 6.3 stresses that changes must be implemented effectively to achieve their intended results, and adds three elements to planning: how the effectiveness of the change will be monitored and evaluated, how it will be communicated, and how its results will be reviewed.
Switching a critical supplier, opening a new line or reorganising a process is no longer just a decision in the minutes: it needs an indicator, communication and a follow-up review with a date.
What an auditor usually asks for
- Risks and opportunities recorded separately, each with its own action
- Most recent significant change to the system with a plan for monitoring its effectiveness
- Change communicated to the people affected, with evidence
- Follow-up review of the results of the change, with a date and conclusion
How to cover this block in Kimobox
- 1Record risks and opportunities in each process's matrix, with an owner, a rating and an action for each.
- 2When you plan a change, document the reason, the impact, the resources and the indicator you will use to judge whether it worked.
- 3Communicate the change to each user according to their role and schedule the results review with an automatic reminder.
A change with its indicator and review date already planned is the evidence clause 6.3 asks for.