Why This Matters: The Journey Is Not Over
Project-risk guidance closed his editorial foreword to the professional risk working group Views from the Chair with a characteristically forward-looking observation: "The journey is not over — enjoy the ride!" Each of the nine chairmen who contributed to the publication offered their perspective on where project risk management was headed. Their visions were diverse but converged on several themes that remain urgent for the next generation of practitioners.
Understanding these emerging challenges is not an academic exercise. The project managers entering the profession today will face a risk landscape that differs profoundly from the one their predecessors navigated. Longer supply chains spanning more countries. Faster technology cycles. Greater regulatory scrutiny. Increasing interconnection between project risk and enterprise-level exposures. And a persistent demand from stakeholders for certainty in an inherently uncertain world.
Challenge 1: From Risk Management to Uncertainty Management
The Definitional Frontier
A widely used uncertainty-management framework's argument that "uncertainty management" is a better label and approach than "risk management" represents the most fundamental intellectual challenge facing the discipline. Their 2011 book made the case that the mind-set changes flowing from this perspective shift are numerous and consequential.
The core proposition is that project success depends on managing all relevant uncertainty — not just the subset that can be expressed as discrete risk events. This includes inherent variability in costs and durations, systemic dependencies between project elements, ambiguity about objectives and stakeholder expectations, and knowledge gaps about what needs to be known at each project stage.
The practical implications include:
Interval estimates replacing point estimates. Every cost and duration estimate should include explicit ranges with defined confidence levels, not single values. The P10 serves as a stretch target; the P50 as the expected value; the P90 as the commitment figure. Different users should know which interpretation applies to the number they are using. Multiple analytical lenses. The performance lens (how will uncertainty affect outcomes?), the knowledge lens (what do we need to know to proceed?), the complexity lens (how do the interconnected elements relate?), and the residual lens (what else are we missing?) each provide different insights into the same underlying uncertainty. No single lens is sufficient. Integration of risk with planning. Uncertainty analysis should be a built-in feature of project planning, not an add-on performed by a separate team. This means three-point estimation as the default for all scheduling and costing, not as a special exercise conducted only for "risk analysis."
Challenge 2: Enterprise Risk Management Integration
Breaking Down the Silos
Historically, project risk management existed in isolation from other organisational risk functions. The project risk manager maintained the project risk register; the corporate risk function maintained the enterprise risk register; and the two rarely communicated. This siloed approach creates dangerous blind spots in both directions.
Projects can put the enterprise at risk. A major programme failure can drain organisational resources, damage reputation, trigger contractual penalties, and threaten the viability of the entire business. When project risk is managed in isolation, the enterprise has no visibility into these exposures until it is too late. The enterprise can put projects at risk. Corporate decisions about organisational restructuring, capital allocation, market strategy, or technology platforms can profoundly affect project outcomes. When enterprise risk is managed without reference to the project portfolio, these impacts are not anticipated or managed.
Practitioner guidance argued that "risk in projects must be brought into the fold and considered alongside other sources of risk within the enterprise." This requires common risk language and process across organisational levels, clear escalation paths from project to programme to portfolio to enterprise risk, consistent risk appetite and tolerance thresholds, and integrated risk reporting that provides the board with a unified view of risk exposure.
The Programme and Portfolio Dimension
Practitioner guidance identified an important nuance in extending risk management from projects to programmes and portfolios. At project and programme level, the risk management principles are consistent: identify threats and opportunities, assess probability and impact, plan responses, and monitor outcomes. The objective is to reduce threat exposure and increase opportunity capture over time.
However, at portfolio level, an alternative interpretation exists — particularly in financial contexts — where risk exposure can never be truly reduced, only controlled. The dam analogy illustrates this: removing the dam causes flooding, so risk management focuses on maintaining the control rather than eliminating the underlying hazard.
This philosophical difference between reducing exposure (project risk management) and maintaining controls (portfolio/financial risk management) has practical implications for how risk is reported, how contingency is managed, and how success is measured. Practitioners working across these boundaries must understand and navigate the differing frameworks.
Challenge 3: Emerging Risk Categories
Cyber Risk
Practitioner guidance identified cyber-attack as a "current hot topic" that would continue to demand more of the risk manager's time and effort. The UK government's allocation of an additional £650 million to cyber defences underscored the scale of the challenge.
For project risk managers, cyber risk manifests in multiple dimensions: the vulnerability of project information systems and data to attack during design and development, the cyber security requirements that must be designed into the delivered product or system, the supply chain cyber risks introduced by subcontractors and partners, and the dependence of project management tools and communication systems on secure digital infrastructure.
Political and Geopolitical Risk
The post-2008 era of economic instability, political volatility, and shifting international relationships has elevated geopolitical risk as a factor in project management. Defence programmes, with their long timescales and dependence on government policy, are particularly exposed. A programme spanning 15 years from concept to delivery will traverse multiple electoral cycles, policy reviews, and spending rounds — each of which can fundamentally alter the programme's scope, budget, or viability.
Supply Chain Complexity
Practitioner guidance predicted that prime contractors would need to fundamentally rethink their approach to supply chain risk. The common commercial practice of pushing risks to suppliers — forcing them to increase their contingency, thereby increasing the overall project cost — is "going to be less and less viable." Future prime contractors will need to shoulder whole-of-programme risk to maintain cost competitiveness, requiring greater openness, honesty, and collaboration with suppliers.
This shift demands that risk managers understand not just the technical risks within their programme but the commercial, financial, and operational risks across the entire supply chain.
Challenge 4: Technology and the Double-Edged Sword
The Tool Proliferation Problem
Practitioner guidance observed that despite 40 years of software development, there are still no truly standard tools for risk management. The lack of a dominant platform is evident in the continuing market room for new entrants. While this competition drives innovation, it also creates fragmentation — different organisations use different tools, producing outputs that are not directly comparable.
The Automation Danger
Practitioner guidance warned of the danger that project risk management would follow the financial sector's path of increasing automation and model complexity, ultimately producing "black boxes, accepting information and pumping out recommendations which people came to rely on more and more without really understanding the underlying logic."
The risk for project management is that quantitative tools become so sophisticated that only specialists can understand them, creating a divide between the risk analysts who run the models and the project managers who must act on the results. When this divide exists, decision-makers either follow the model's recommendations blindly or ignore them entirely — both of which are failure modes.
The Data Opportunity
On the positive side, the increasing availability of project performance data — from earned value systems, project management information systems, and enterprise resource planning platforms — creates opportunities for more sophisticated risk analysis. Historical data on activity duration variances, cost estimation accuracy, and risk materialisation rates can improve the quality of future risk assessments, moving from purely subjective estimation towards data-informed probabilistic modelling.
Challenge 5: The Professionalisation of Risk Practice
Beyond Process Knowledge
Practitioner guidance observed that the future risk practitioner will need far more than process knowledge. The traditional skill set — facilitating workshops, maintaining risk registers, running Monte Carlo simulations, and providing guidance on response strategies — will remain necessary but insufficient.
Future risk practitioners will need to understand the business context deeply enough to identify risks that project teams may not recognise, communicate risk information to diverse audiences (from shop-floor engineers to board-level executives) in ways that drive action, integrate risk management with other project disciplines including earned value, value management, and benefits management, navigate the commercial and contractual dimensions of risk allocation in complex supply chains, and address emerging risk categories (cyber, geopolitical, regulatory) that fall outside traditional project risk frameworks.
The Silo Myth
Practitioner guidance challenged the longstanding assumption that risk practitioners need industry-specific expertise to be effective: "If you understand the principles of managing risk you can then apply this knowledge across many areas of business." The transferability of risk management skills across sectors — from defence to construction to IT to financial services — is both an opportunity for practitioners and a validation of the discipline's intellectual foundations.
However, this transferability has limits. Effective risk management requires understanding the context deeply enough to ask the right questions and challenge the right assumptions. A risk manager who understands the process but not the engineering cannot identify the most consequential technical risks. The future practitioner needs both methodological expertise and sufficient domain knowledge to apply it effectively.
Challenge 6: Extending Risk Across the Project Lifecycle
The Front-End Gap
Project-risk guidance identified the need to extend risk management beyond uncertain events to encompass overall project risk — answering the question "How risky is this project?" This concept, introduced in the second edition of the PRAM Guide, remains underdeveloped in practice.
A widely used uncertainty-management framework's lens framework provides one approach: using the knowledge lens in early project phases to identify what needs to be known before proceeding, using the complexity lens to understand stakeholder dynamics and interconnected problems, and applying the performance lens for detailed risk analysis during execution.
The front-end of projects — concept, feasibility, and design phases — is where the greatest uncertainty exists and where risk management can have the greatest impact. Yet common practice concentrates risk management effort during execution, when options for fundamental change are most constrained and the cost of change is highest.
The Operations Interface
The RAMP guide's whole-lifecycle perspective highlights another frontier: the interface between project delivery and operational service. Projects deliver capability — but the risks to realising the benefits of that capability extend well beyond project completion. Operational risks, technology obsolescence, capability degradation, and changing operational requirements all affect whether the investment achieves its intended value.
A Synthesis: What the Next Generation Must Master
Drawing together the perspectives of nine a professional risk working group chairmen spanning a quarter-century of practice, the following capabilities define the future risk practitioner:
Conceptual breadth. The ability to think beyond events to encompass variability, systemic effects, ambiguity, and knowledge gaps. The ability to shift between performance, knowledge, and complexity lenses as the situation demands. Analytical rigour. The ability to use quantitative tools effectively while understanding their limitations. The ability to construct models that genuinely inform decisions rather than producing spuriously precise outputs. Communication skill. The ability to present risk information to diverse audiences — from engineering teams to board-level executives — in ways that drive action. The ability to translate between the languages of different organisational functions. Cultural leadership. The ability to influence risk culture through personal example, persistent advocacy, and practical demonstration of value. The ability to create environments where uncertainty is acknowledged rather than suppressed. Business acumen. The ability to understand the commercial, contractual, and strategic context within which projects operate. The ability to connect project risk to enterprise risk, portfolio risk, and business strategy. Ethical integrity. The willingness to present honest risk assessments even when the findings are unwelcome. As practitioner guidance stated: "Honesty is the best policy — first in recognising the risks, then qualifying or quantifying the likely occurrence and impact, and then providing sufficient funds to tackle the risk or to allow for it."
Key Takeaways
1. The shift from event-based risk management to comprehensive uncertainty management represents the discipline's most important intellectual frontier — requiring interval estimates as defaults, multiple analytical lenses, and integration of risk analysis with project planning as a built-in rather than an add-on. 2. Enterprise risk management integration — breaking down the silos between project, programme, portfolio, and corporate risk functions — is essential for preventing the blind spots that allow troubled projects to damage the wider organisation. 3. Emerging risk categories including cyber threats, geopolitical volatility, and supply chain complexity demand practitioners who can operate beyond traditional project risk frameworks while maintaining methodological rigour. 4. The professionalisation of risk practice requires future practitioners to combine methodological expertise with business acumen, communication skill, cultural leadership, and ethical integrity — far exceeding the traditional skill set of workshop facilitation and register maintenance. 5. The greatest unrealised potential for risk management lies in the front-end of projects — concept, feasibility, and design phases — where uncertainty is highest, options for change are most open, and the impact of risk-informed decisions on final outcomes is greatest.