Question 1

Is a risk procedure actually required?

Accepted Answer

Not by Clause 6.1 of ISO 9001, which requires no method, no register and no retained evidence. The obligation arrives at Clause 4.4.1, which requires determined criteria and methods for every process, and control of it. Risk identification is a process. If it is performed three different ways by three different people, the finding is written against 4.4.1. ISO 14001, ISO 45001 and ISO 7101 are more direct, each requiring documented criteria of some kind.

Question 2

My register looks complete. Why did I score low?

Accepted Answer

Completeness and control are different things. This check asks how the register was produced, not how full it is. A long register with no stated criteria, produced by one person, is the pattern that scores low, and it is the pattern that produces findings, because nothing in it can be reproduced.

Question 3

We use a five-by-five matrix. Is that wrong?

Accepted Answer

No. What matters is whether the anchors are written as described outcomes rather than adjectives, whether the period over which likelihood is judged is stated, and whether two people applying it reach the same answer. Also worth checking: if you multiply three factors, make sure two of them are not asking the same question.

Question 4

Is it bad to score in the middle?

Accepted Answer

No. The Controlled band is a well-implemented certifiable system and a legitimate place to stop. Going further buys earlier detection and better decisions, which is a business case rather than a compliance obligation.

Question 5

What happens to my answers?

Accepted Answer

Scoring runs entirely in your browser. Nothing is sent anywhere unless you choose to submit the form for the detailed breakdown.

Related checks and next steps

Explore

Training

Solutions

Follow us

Related checks and next steps

Don't miss our latest news!