Risk is defined in ISO Guide 73:2009, Risk management – Vocabulary, with several accompanying notes as:

the effect of uncertainty on objectives

NOTE 1 An effect is a deviation from the expected – positive and/or negative.
NOTE 2 Objectives can have different aspects (such as financial, health and safety, and environmental goals) and can apply at different levels (such as strategic, organization-wide, project, product and process).
NOTE 3 Risk is often characterized by reference to potential events (3.5.1.3) and consequences (3.6.1.3), or a combination of these.
NOTE 4 Risk is often expressed in terms of a combination of the consequences of an event (including changes in circumstances) and the associated likelihood (3.6.1.1) of occurrence.
NOTE 5 Uncertainty is the state, even partial, of deficiency of information related to, understanding or knowledge of an event, its consequence, or likelihood.

An approach to risk management should be selected which is relevant to the object of conformity and the sector involved. ISO has published ISO 31000:2009, Risk management — Principles and guidelines, provides a general model for risk assessment as follows:

In specific sectors, for example in the food safety, other guidelines for risk assessment exist (e.g. Working Principles for Risk Analysis for Food Safety for Application by Governments (2007) and Definitions of Risk Analysis Terms Related to Food Safety, Procedural Manual (2001), published by the Codex Alimentarius Commission (CAC) within the framework of the Joint FAO/WHO Food Standards Programme established by the Food and Agriculture Organization of the United Nations (FAO) and the World Health Organization (WHO)).

With the information from the risk assessment some early consideration can be given to the likely conformity assessment options that may be used in the regulation to manage the risks that have been identified. The UNECE has produced a guide entitled Risk Management in Regulatory Frameworks: Towards a Better Management of Risks.

A key decision when setting up an conformity assessment approach scheme is who should be involved in carrying out the conformity assessment.

The decision should be based on an assessment of the risks which could arise from non-conformity, looked at from the point of view of both the likelihood and the consequences of the product, service, etc. failing to conform to the specified requirements.

Sometimes the consequences could be of a commercial nature such as loss of market reputation and sales volume if a series of product failures occurred or interruptions to production if a supplier delivered faulty goods. In other situations it could be hazards to the health and safety of people which could be of concern.

Conformity assessment costs money and takes time. The amount of money and time to spend on it needs to be balanced against the risks of non-conformity. While conformity assessment carried out in-house by the supplier could be limited to inspection, the inspector has to be paid and there can be delays to production or dispatch while the inspection is carried out.

As the nature of the product becomes more complex and the risks of non-conformity become higher, conformity assessment activities will become more extensive, possibly involving expensive test equipment and extended testing programmes. Sometimes it can be more cost effective to contract out the conformity assessment work to a third party but this is more of a commercial decision by the supplier.

Where the risks of non-conformity are high, it is usual to require an independent body to carry out some defined conformity assessment activities and at least to review the evidence of conformity and issue an attestation document such as a certificate. The body will charge for its services and will need to take time to complete its work.

.