ITM : How can one distinguish between an organizational weakness and a threat to the organization?

 How can one distinguish between an organizational weakness and a threat to the organization? 

Need at least 500 words