Most common definitions suggest that risk is always something bad. It is true that for any decision there is the chance of failure, and a potential penalty of some loss or other. This is risk as a threat. But there is another risk: that of failing to pursue an opportunity, and thereby failing to maximize true potential. These two perspectives have been refined into a definition of risk by CUC as being, "the threat or possibility that an action or event will adversely or beneficially affect an organisation's ability to achieve its objectives".
Risk management can be done (just as in our personal lives) in an unconscious and unconsidered way, but what a formalised system of risk management seeks to achieve is more systematic management behaviour.
Elsewhere, HM Treasury notes that "good risk management also allows stakeholders to have increased confidence in the organisation's corporate governance and ability to deliver", and positive risk management thereby helps an organisation to:
More information [PDF, 65KB]