PodBOK brings industry guidance together with real-world experience from major projects. Use it to inform your approach, and check the facts and requirements that apply to your project.
1.Recording topics instead of risks
A register full of procurement, weather and design does not explain what might happen. Ask the team to describe a cause, an uncertain event and a consequence for an objective. Warning sign: different people interpret the same row differently. Corrective action: rewrite the row together and link it to the exposed package or milestone before discussing its score.
2.Starting after the decision is committed
Risk analysis loses influence when scope, suppliers and dates have already been fixed. Work backward from the commitment date and identify when evidence must arrive to affect it. Warning sign: every proposed response requires undoing an award. Corrective action: bring uncertainty into option selection and gate preparation, with explicit decisions about what remains unknown.
3.Assigning ownership without authority
Naming a risk coordinator does not give them control of design, money or a contractor. Distinguish the person accountable for the exposure from those delivering individual actions. Warning sign: the same action returns overdue without an escalation. Corrective action: confirm acceptance with the owner, identify the authority needed and agree the route for decisions beyond that person's control.
4.Treating the workshop as the finish line
A well-attended workshop can still leave the project with no funded action. The output needs owners, dates, resource requirements and a next review. Warning sign: the register grows while the delivery plan stays unchanged. Corrective action: reserve closing time to agree actions, then verify that accepted work appears in the schedule and the responsible team's commitments.
5.Mistaking a heat map for a decision
A color helps sort a conversation; it does not explain the evidence or select a response. Two similarly colored risks may need very different decisions. Warning sign: the review debates red versus amber without changing an action. Corrective action: state the consequence, decision deadline, available alternatives and information gaps alongside the rating, using the project's agreed criteria.
6.Calling contingency the response
An allowance may help absorb uncertainty, but it does not obtain a permit, qualify a supplier or recover lost access. Warning sign: the mitigation column says contingency included. Corrective action: separate the allowance from the operational response, explain the basis of each, and identify who can authorize its use. Show the exposure left after the response.
7.Letting interfaces fall between owners
A risk can sit outside every package's boundary while still threatening the project. Consider design inputs, utilities, access, testing and handover obligations. Warning sign: both parties say the dependency belongs to the other. Corrective action: map the exchange, its required date and acceptance criteria, then assign an integrating owner who can bring both parties into the decision.
8.Presenting model precision as confidence
Detailed curves can distract from uncertain inputs or flawed schedule logic. Warning sign: nobody can explain why a range or dependency was chosen. Corrective action: review the model basis, double counting and sensitivity before presenting results. Show the assumptions that could change the conclusion and the evidence needed to reduce uncertainty. Keep the decision question visible.
9.Waiting for a risk to become an issue
Reviewing a risk only after a missed milestone removes options. A trigger should be observable early enough to act. Warning sign: the team can describe the failure but not its leading signal. Corrective action: identify an evidence source, monitoring owner, review cadence and escalation threshold. When the trigger fires, record the decision and start the agreed response.
10.Closing the row without learning
Closed does not explain whether a response worked, an assumption changed or exposure simply expired. Warning sign: the next project repeats the same untested assumption. Corrective action: preserve the original assessment, action evidence and outcome. Write a transferable lesson with its limits, and give someone responsibility for applying it to the next package or project.
This top 10's Bookshelf
Explore the sources behind this article and related reading from our Bookshelf.
ISO 31000:2018: Risk management, Guidelines
ISO · Referenced by PodBOK
Why it's on the shelfISO describes risk management as part of governance, strategy, planning and reporting. Its overview covers identifying, analysing, evaluating, treating, monitoring and communicating risks, including opportunities as well as threats. This supports treating risk as continuing work connected to project decisions.
Further reading
Risk Management in Portfolios, Programs, and Projects: A Practice Guide
PMI · Referenced by PodBOK
Why it's on the shelfPMI's practice guide addresses risk principles, the risk management lifecycle, and tools and techniques across projects, programs and portfolios. Its overview connects those levels to enterprise risk management and describes examples of practical application. The 2024 guide incorporates relevant material from the earlier standard.
Further reading
Related reading from the conversations
Book · Risk
Against the Gods: The Remarkable Story of Risk
Peter L. Bernstein · recommended by Matt Mitchell
“It talks about some of the early philosophers and how they loved to gamble because they understood what the odds were… It’s a fascinating book. It’s a great read, and it’s pretty cheap on Amazon.”Matt Mitchell, on the show
Why it’s on the shelfPeter L. Bernstein’s history of risk: the book behind Matt’s point that humans have managed risk for tens of thousands of years, animal sacrifice included.
Hear it in“Risk Management on Megaprojects” with Matt Mitchell · listen · watch · episode brief
- Further reading for Field Guide: Risk Management on Major Projects
- Further reading for Top 10: 10 Risk Management Mistakes That Derail Megaprojects
- Further reading for Toolkit: How to Run a Risk Workshop on a Megaproject
Keep exploring
Bibliography
Explore the conversations, publications and reading behind this top 10.
Podcast conversations
-
Conversation with Ahmed Abdelfattah
Passages and links
-
Bring risk into planning from the beginning
Ahmed Abdelfattah
Abdelfattah argues for risk analysis at the start of planning and uses scenarios to support project decisions.
-
-
Conversation with Matt Mitchell
Passages and links
-
Prepare before the workshop
Matt Mitchell
Mitchell recommends reviewing lessons from similar projects and interviewing people before the group workshop, so participants have something concrete to examine.
-
-
Conversation with Tarun Gohel
Passages and links
-
Give each response a trigger and an owner
Tarun Gohel
Gohel distinguishes a risk occurring from the point when mitigation should start, and calls for a named owner for each mitigation trigger.
-
Publications and further reading
-
ISO 31000:2018: Risk management, Guidelines
ISO · Further reading
Publication details
Edition 2, February 2018; confirmed in 2023
What is ISO 31000?; Why is ISO 31000 important?; certification FAQ
This source is ISO's public overview of the standard, which introduces its principles and risk-management process.
-
Risk Management in Portfolios, Programs, and Projects: A Practice Guide
PMI · Further reading
Publication details
September 2024 practice guide
Overview; Product Specifications; legacy risk-standard page's update notice
The source is PMI's public overview and update notice; the complete practice guide contains the detailed procedures and roles.
PodBOK · The Major Project Podcast
https://www.themajorprojectpodcast.com/podbok/risk-management-mistakes · Updated 2026-11-01