Risk Based Thinking is not required as a stand-alone procedure. You do however need to demonstrate that you're assessing risk at all levels of the organization. If you have a procedure on supplier assessment, you're already doing this in Purchasing. Preventive Actions, PFMEAs, Cross Training Matrix, Contingency Plans, AQL sampling plans, capability studies, and Gage R+R's are all examples of Risk Assessment.