In many organizations, risk and uncertainty are synonymous concepts.  This is not true.  They are, in fact, very different.

Risk is determined by how detrimental the impact of a failed project or initiative will be to the company.  Will the company go out of business if your program fails?  If so, then this is a high-risk project.  Will anyone notice at all?  If not, then this is a low-risk program.

Uncertainty is the extent to which you know the outcome of a project or initiative before you start it.  Do you know which product offerings will come out of an innovation initiative that will begin with broad understanding of consumer values?  Probably not.  This is highly uncertain.  Will a misstep in this project kill the company?  Maybe or maybe not.  The level of risk is independent from the level of uncertainty.

Most organizations consider uncertainty to be scary.  They then define it as risky.  This fear traps them into only taking on projects where the outcome is certain.  The results can be projected and quantified before the project is started, and everyone "buys in" to the projected result. This is not scary, and as such, it is not considered risky by the organization.

Let's just say that you are in a highly compeititive industry.  You operate in with a high degree of certainty because a misstep is considered risky.  And let's just say that this highly certain manner of selecting projects causes you not to invest in any project with uncertain outcomes.  And let's just say that your competitor just launched a new offering that will change the face of your industry.  You may go out of business if you cannot respond quickly.  Again this is highly certain.  But is it risky?

Think about how you determine risk and uncertainty at your company.