Begin with the objective, the uncertainty around it and what management can prepare.
Mention risk in a management meeting and the room often becomes gloomy.
People think about accidents, lost customers, late projects, cyberattacks and new regulations. Any one of them can do real damage.
But that is only one direction in which uncertainty can move the result.
A customer may ask for a service nobody offers. A worker may find a safer way to do a task. A new supplier may have material that cuts defects.
Something better than expected may happen too.
Uncertainty comes first
Uncertainty is the condition. We do not know exactly what will happen or what the effect will be.
It is not automatically good or bad. It is a gap in what we know.
It reminds me of Schrödinger’s cat. The cat may be dead or alive. Management should plan what to do in either case before somebody opens the box.
ISO defines risk as the effect of uncertainty on objectives. That distinction matters. Uncertainty has no direction. Its effect on the objective does.
If the effect may pull the result below what we need, we face a threat. If it may improve the result, we see an opportunity.
The objective matters. Without it, “risk” becomes a loose collection of things that make people nervous.
Suppose the objective is to deliver 95% of customer orders on time this quarter.
Your main supplier may miss a shipment. That threatens the 95% target. A useful response is to qualify a backup source and set a clear trigger for using it.
A local supplier may offer material that arrives faster and produces less scrap. That opportunity may help the same delivery target and improve quality. A useful response is a controlled trial, with an owner, measures and a decision date.
Writing “supplier risk and opportunity” in a box does neither job.
Prepare before the conditions decide
The O and T in SWOT are useful shorthand for what could work against an objective and what could work in its favour. But they are only headings. Risk-Based Thinking begins when management prepares for the uncertainty behind them.
Think of a boat before departure. The destination is clear. The conditions are not.
The crew checks the weather, secures the cargo, prepares the sail, carries safety equipment and keeps an auxiliary motor ready. None of this predicts exactly what will happen. It creates options. Favourable wind can be used. Rough conditions do not have to arrive as a complete surprise.
An opportunity is not yet a benefit. The organisation must be ready to recognise and use it.
A threat prevented in time may never appear as a loss. An opportunity missed may never appear in the accounts either. One absence is success. The other is failure. The accounts may not tell you which.
The same event may help and hurt
Even good-looking events deserve both questions.
A large new order may increase revenue. It may also overload a machine, delay existing orders and absorb cash for months if the payment terms are weak.
The order is not simply good or bad. It has possible effects on revenue, delivery and cash.
Sales should examine the opportunity. Operations should test capacity. Finance should test the cash effect. Then management decides what promise the company can safely make.
What I would ask tomorrow
Take one objective that matters and state it in plain words, with a number where a number helps.
Then ask:
- What do we not know that could change this result?
- How could it work against us?
- How could it work in our favour?
- What can we prepare now?
- What would tell us early, and who acts when that signal appears?
“Monitor closely” is not an action. “Planning tells Sales by 10:00 when available capacity falls below 85%” is an action people can follow and check.
Ask the people close to the work. The quiet new employee may see a safer route because nobody has yet taught her that the old route is normal. A company that silences awkward facts usually silences useful ideas too.
This is management before it is ISO
ISO 9001 did not invent the need to think this way. It expects organisations to address risks and opportunities because a quality management system should help achieve intended results, not maintain a handsome collection of dead documents.
The sixth edition of ISO 9001 is under publication and expected in September 2026. For certified companies, the transition is a good reason to test whether this thinking appears in actual decisions.
I would not start by rewriting the risk procedure. I would start with a real objective, follow how managers and workers handle uncertainty, and see where information or action gets stuck. The system may need fewer new words than people fear. It may need more honest use.
Profit leaks often show the same failure after the event: a threat arrived with an invoice attached, or an opportunity walked out without saying goodbye.
Risk-Based Thinking means getting ready while the future is still uncertain.