It is a question of evaluating the gain / risk ratio of a project; if this ratio is not high enough, it may not be convenient to implement the project.
The expected risk and revenue must be estimated; when the Profit / Risk ratio >> 1 then you can proceed with the project. The most important tool for this is the budget.
Example:
Corrective Action and Preventive Action -CAPA- for consistent improvement