Risk Management: What Could Go Wrong (And How We Figure It Out)

Hey Friend 👋

Early in my career, I thought I had risk management nailed. Ran the workshops, filled the risk register, colour-coded everything red-amber-green, listed every mitigation. It looked complete.

Then during a rail project testing a new machine, we missed something simple but critical. We'd followed the process, but we hadn't looked beyond the project. We didn't stop to ask how our work might affect the operations team or what the wider impacts could be.

Some of those risks materialised. Operational disruption. Nearly became reputational too. We weren't far from making the news.

You can follow the process and still get caught out.

Because risk management isn't about ticking boxes. It's about thinking wider across different risk areas:

• Delivery risks: delays, budget, scope creep
• People risks: availability, skills, team changes
• Operational risks: impact on day-to-day services (this is what we missed)
• External risks: supply chain, regulations, outside factors
• Reputational risks: what happens if this goes wrong publicly

On that rail project, we focused on delivery risks and assumed operational risk was someone else's problem. It wasn't. Thinking holistically across these categories helps you spot what you might miss.

Beyond the routine risk reviews, sometimes the best risk conversations happen over coffee. "What could go wrong here?" "What are we assuming that might not be true?" "What's keeping you awake at night about this project?"

Here's another truth: our brains are wired to focus on immediate problems over future ones. It's called temporal discounting. We naturally prioritise what feels close and tangible over what's further away. That deadline next week? Crystal clear. That maintenance problem in 18 months? Invisible. This is why we sometimes focus on fighting today's fires rather than preventing tomorrow's bigger ones.

In your next team meeting: Ask "What's the one thing that could catch us off guard?" Then ask "Who else should we be talking to about this?" You'll be surprised what these two simple questions surface.

What risk blindsided your project? Hit reply. I read them all and often feature reader insights in future newsletters.

Want to go deeper? You can read more in the full deep-dive where I break down the risk management process with examples, or try the Mindcast for hands-on practice making these calls in realistic PM scenarios.

Making things happen,
Bilal Jamil