Methods to start scanning risks and opportunities?

Hi everybody

I have been asking some help regarding the risk managements, but Im not sure what could be more effective.

I can try several ways, but I wanted to know if someone have done this practice in the past and how has been the results.


I have 2008 certified, I have planned the 2008 in the past, now I have created new procedures for risk, context, new formats, and also have modified procedures/formats due to new version.

For example, in 9.3 Management review, I have modified formats to address the effectiveness of risk and opportunities, or in 10.2 Nonconformity and corrective actions, in e) update risks and opportunities determined during planning, if necessary;I have modified my procedure to take care of the risks and so on, that is what I mention "I have modified".


Now, to comply for risk and opportunities...

By mean of having meetings with top management and responsibles of the processes

I was thinking to do it in this order:

- External and Internal
- Interested parties
- Top management
- All the Processes one by one.

After done all of this, well we already have risk and opportunities
identified, given priority and treatment.
Would it be this enough and good practice?

Please input your comments.

Thanks