How does ISO 31000 define risk?
Although risk often is defined in terms of negative impact or hazard, ISO 31000 views risk as exposure to the consequences of uncertainty — positive or negative. Risk management is about identifying the variations from what is planned or desired, and managing those risks to maximize opportunities, minimize losses, and improve decisions and outcomes.