ISO 9001Ş2015 - 10.2.1e
...maybe a better approach is "every ncf. leads to a risk"....
In a cause and effect relationship, I am more inclined to see that risks can cause NCs - and not the other way around. Clause 10.2.1e is intended for determining the risk/s that may have been overlooked previously (i.e. during the planning of the QMS and/or its processes) that led to the occurrence of the NC.
As per ISO/TS 9002 Clause 6.1.1, the purpose of determining risks is to prevent NCs including nonconforming outputs. Thus, risks are causes and NCs are effects.