As with other project management activities, you need to get into a rhythm of periodic monitoring. You may wish to appoint a risk manager or "risk czar" for the project. The risk manager is responsible for staying on top of the things that could go wrong, just as the project manager is staying on top of the activities leading to project completion. One project team dubbed their risk manager "Eeyore" after the Winnie-the-Pooh character who always bemoaned how bad things could become. It’s a good idea to have someone other than the project manager serve as the risk manager. The project manager is focused on what he has to do to make a project succeed. The risk manager, in contrast, is identifying factors that might prevent the project from succeeding. In other words, the risk manager is looking for the black cloud around the silver lining that the project manager sees. Asking the same person to take these two opposing views of the project can lead to cognitive dissonance; in an extreme case, his brain can explode!
Keep the top 10 risks highly visible (McConnell 1996) and track the effectiveness of your mitigation approaches regularly. As the initial list of top priority items gradually gets beaten into submission, new risks might float up into the top 10. You can drop a risk off your radar when you conclude that your mitigation approaches have reduced the risk exposure from that item to an acceptable level.
Note
Assuming that a risk is controlled simply because the selected mitigation action has been completed. Controlling a risk might require you to change the risk control strategy if you conclude it is ineffective.
A student in a seminar once asked me, "What should you do if you have the same top five risks week after week?" A static risk list suggests that your risk mitigation actions aren’t working. Effective mitigation actions should lower the risk exposure as the probability, the loss, or both decrease over time. If your risk list isn’t changing, check to see whether the planned mitigation actions have been carried out and whether they had the desired effect.
