Risk management is often treated as a register that gets updated before a steering committee meeting. That approach misses the point. For complex projects, risk needs to influence the work while there is still time to change the outcome.
Bent Flyvbjerg, a leading researcher on major projects at Oxford, describes the recurring pattern as “over budget, over time, over and over again.” His research points to a deeper problem: project leaders often underestimate or ignore risks during planning and decision-making.
The numbers reinforce the concern. McKinsey research on large IT projects found that, on average, projects exceeding $15 million ran 45% over budget, 7% over time, and delivered 56% less value than predicted.
Risk Should Change the Work
A PPMO should not measure risk management by the number of risks recorded. It should measure whether identified risks produce action.
ROPE takes this approach directly. Its risk model uses program-level visibility alongside risk identification at the individual work-item level. Risks are surfaced during build-sheet development, sprint planning, and cut-sheet reviews. Known risks then become control tasks, rather than observations sitting in a register.
That distinction matters. If a risk says a critical dependency has no tested fallback, the response should not simply be “monitor.” The execution plan should contain a task to establish and test the fallback, with an owner and a decision point.
Give Risk a Cadence and an Owner
Effective risk management has three characteristics: visibility, ownership, and timing.
At the project level, the PM owns day-to-day risk coordination, while project owners and governance leaders have responsibility for decisions and organizational obstacles. At the portfolio level, the PPMO governance process reviews projects that are “At Risk” or in “Concern,” identifies root causes, and establishes get-well plans.
The cadence should match the risk. Daily huddles can surface immediate execution threats. Weekly project reviews can address emerging risks and mitigation progress. Governance meetings should focus on risks requiring leadership action, such as funding, capacity, scope, or organizational barriers.
This creates a useful leadership signal: we know what could hurt the outcome, who owns the response, and what decision is needed next.
Make Risk Visible Across the Portfolio
A PPMO also needs to see risk beyond individual projects. The ROPE portfolio model emphasizes transparency, resilience, dependency awareness, and “what-if” scenarios as core sources of portfolio value.
That matters because one project’s risk can become another project’s dependency. A staffing shortage, vendor delay, security requirement, or business-priority change may affect several initiatives simultaneously.
A useful executive dashboard therefore should answer three questions quickly:
- What are the most significant unresolved risks?
- What mitigation actions are overdue or ineffective?
- Where does leadership intervention reduce exposure?
Conclusion
Risk should not be something a project team reports after the fact. It should be part of how work is planned, executed, reviewed, and changed.
For PPMOs, the practical shift is straightforward: turn risks into owned actions, review them at the cadence appropriate to their exposure, and escalate only what requires higher-level decisions. That turns risk from a reporting artifact into an execution control—and gives leadership a much clearer view of where the portfolio needs attention.
reference
Results Oriented Project Execution (ROPE) Framework: A Practical Approach to Successfully Completing Complex Projects and Programs | Paul Thompson | 2025
Fully Managed PMO Service Plan Runbook: Portfolio and Project Management Office Following the ROPE Framework | Paul Thompson | 2026
Over Budget, Over Time, Over and Over Again: Managing Major Projects | Bent Flyvbjerg | 2011
Delivering large-scale IT projects on time, on budget, and on value | McKinsey & Company | 2012
The Future of Project Work: Pulse of the Profession 2024 | Project Management Institute | 2024
