How can one distinguish between an organizational weakness and a threat to the organization?