NATO AQAP 2110 - Quality Assurance Requirements for Design, Development, and Production 5.2.1: 5.2.1 Manage risk from contract review onward to ISO 31000 and share the risk plan

The Supplier and its External Providers show objective evidence that risks, External Provider risks included, are considered in planning through identification, analysis, control and mitigation at least; risk identification starts at contract review and is updated in good time afterwards. Unless the contract says otherwise, risk management is conducted in line with ISO 31000:2009, and the Risk Management Plan is available to the GQAR or Acquirer, who may reject risk plans and their revisions. SRD.1: the risk data may sit in another document if it is contract-specific, actively reviewed and used by senior managers. SRD.2: overlaps AS9100D 6.1 and 8.1.1; the plan to ISO 31000, supplier risks and the rejection right remain NATO additions. Base clause: ISO 9001:2015 clause 6.1 (risks and opportunities).