Boehm, Barry W., ed. Software Risk Management. Washington, DC: IEEE Computer Society Press, 1989. This collection of papers is based on the premise that successful project managers are good risk managers. Boehm has collected a nicely balanced set of papers from both technical and business sources. One of the best features of the book is that Boehm contributed about 70 pages of original writing himself. That 70 pages is a good introduction to software risk management. You might think that a tutorial published in 1989 would seem dated by now, but it actually presents a more forward-looking view of software project management than you'll find most other places.

Boehm, Barry W. "Software Risk Management: Principles and Practices." IEEE Software, January 1991, pp. 32–41. This article hits the high points of the comments Boehm wrote for Software Risk Management and contains many practical suggestions.

Jones, Capers. Assessment and Control of Software Risks. Englewood Cliffs, N.J.: Yourdon Press, 1994. Jones's book is an excellent complement to Boehm's risk-management tutorial. It says almost nothing about how to manage software risks in general; instead, it describes 60 of the most common and most serious software risks in detail. Jones uses a standard format for each risk that describes the severity of the risk, frequency of occurrence, root causes, associated problems, methods of prevention and control, and support available through education, books, periodicals, consulting, and professional associations. Much of the risk analysis in the book is supported by information from Jones's database of more than 4000 software projects.

Gilb, Tom. Principles of Software Engineering Management. Wokingham, England: Addison-Wesley, 1988. This book has one chapter that is specifically devoted to the topic of risk estimation. The software development method that Gilb describes in the rest of the book puts a strong emphasis on risk management.

Thomsett, Rob. Third Wave Project Management. Englewood Cliffs, N.J.: Yourdon Press, 1993. The book contains a 43-question risk-assessment questionnaire that you can use to obtain a rough idea of whether your project's risk level is low, medium, or high.