Risk & Opportunity Management

Short and straight answer: No!

Let us support our answer. First go to clause 6.1.1 and note that the standard focuses attention only on the risks and opportunities that deserve to be addressed. So, your classification of risk severity low means that they don’t need to be addressed. ISO 9001:2015 does not mandates a register with all the risks and opportunities determined. Nevertheless, that is a good practice. Recording all risks and opportunities and acting only on those that you consider significant.

The following material will provide you information about the risk-based approach:

- ISO 9001 – How to address risks and opportunities in ISO 9001 - https://advisera.com/9001academy/blog/2016/06/21/how-to-address-risks-and-opportunities-in-iso-9001/
- Risk-based thinking replacing preventive action in ISO 9001:2015 – The benefits - https://advisera.com/9001academy/knowledgebase/risk-based-thinking-replacing-preventive-action-in-iso-90012015-the-benefits/
- ISO 9001:2015 Risk Management Toolkit - https://advisera.com/9001academy/iso-90012015-risk-management-toolkit/  
- free online training ISO 9001:2015 Foundations Course – https://advisera.com/training/iso-9001-foundations-course/
- Book - Discover ISO 9001:2015 Through Practical Examples - https://advisera.com/books/discover-iso-9001-2015-through-practical-examples/