Describing risk as “uncertainty that matters” allows for different types of consequences, and leading standards and guidelines define the concept of risk to include both upside as well as downside impacts. This means that the word “risk” can be used to describe uncertainties which if they occurred would have a negative or harmful effect, and the same word can also describe uncertainties which if they occurred would be helpful. In short, there are two types of risk: threats and opportunities.

Accepting this in principle is one thing; using it in practice is another. The traditional risk process (initiate, identify, assess/analyse, plan responses, implement, review) can clearly be used to handle both threats and opportunities. But people who have only used this process to identify and manage threats sometimes have problems extending it to deal effectively with opportunities. And the difficulties start right at the beginning: how can we identify opportunities?

The first step is to be clear about what we are looking for: uncertainties which might or might not occur, but which if they did happen would help us to achieve our objectives, for example allowing us to work smarter, faster or cheaper.

將風險描述為「相關之不確定性」可考慮以不同型態的結果、及主要的標準與指導方針來定義風險的概念，以同時包含正面與負面的衝擊，換句話說，「風險」這兩個字可以用來描述一旦發生便會造成負面或傷害的不確定事件，同樣兩個字也可用來描述一旦發生會有所助益的不確定事件。簡而言之，風險有兩種類型：威脅與機會。

接受上述原則是一回事，在實務上應用又是另一回事。傳統的風險程序（啟動、辨識、評估/分析、回應規劃、實施、檢討）明確地可以同時用來處理威脅與機會，然而僅使用此一程序來辨識與管理威脅的人，在沿用此程序處理機會時會遇到一些問題，而其困難處便在於一開始處：我們要如何辨識機會？

第一步要先釐清我們要尋找的對象：可能或可能不發生的不確定事件，且一旦發生將有助於達成我們的目標，例如可以使我們工作得更聰明、更快速、更便宜。