In Clause 4 the organization is required to determine the risks which
can affect its ability to meet the system objectives. It recognizes that
the consequences of risk are not the same for all organizations. For
some, the consequences of delivering a non-conforming product
are minor; for others the consequence can be fatal. So risk-based
thinking means considering risk quantitatively as well as qualitatively,
depending on the business context.