Okay – so we have worked with our team and have documented a list of risks, and have performed a qualitative or quantitative assessment – perhaps even both of these. Now what?  One such risk management failure then happens when we place the risk register on a shelf somewhere and the subsequent planned actions are never invoked and nobody knows who should be monitoring.

This failure is one of the most egregious. We have invested time and our human capital to understand the risks to which we may be subject and then not follow up.  Without the follow up, the previous actions were a waste of time and rendered moot.  Moreover, we will probably pooh-pooh the value of risk management in general; after all, we performed the activities and we still find our project adversely affected by risk.

To be successful, all of the previous risk activities must culminate in an action that either reduces the risk impact or eliminates the risk altogether.   It is myopic to discredit the process when the most important part – the action to reduce or eliminate the risk is itself not performed.