"Yes, We Manage Risk": But Do Delivery Targets Say Otherwise

How can senior leaders stay on top of risks and issues that keep delaying delivery and inflating cost? That is the core problem this article tackles: a persistent gap between what governance thinks it controls and what is actually happening on the ground.

The problem: invisible risk, visible delay

In many organisations, delays and cost overruns are not caused by a single catastrophic failure but by a steady accumulation of unmanaged risks and unresolved issues. Risks are logged but not really owned. Issues are discussed but not truly decided. Steering committees see “RAG” statuses, yet are still surprised when milestones slip and budgets blow.

The result is a frustrating pattern: projects cycle through the same dependencies, resourcing conflicts, and scope debates, while senior stakeholders ask the same question: “Why do we keep finding out too late?” At the heart of this problem is not a lack of data but a lack of clarity: clarity on who is accountable, how risks and issues are monitored, how information flows upward, and how decisions are taken at the right time.

The missing foundations of risk culture

When risks and issues repeatedly impact delivery time and cost, it usually signals weaknesses in the surrounding corporate culture and governance, such as:

• Ambiguous ownership: No single, named owner for critical risks, or “everyone owns it”, which often means no one does.

• Process box‑ticking: Risk logs, RAID registers and dashboards exist, but they are updated for meetings rather than used to drive action.

• Reporting without decisions: Slides proliferate while actual choices (de-scope, re-plan, invest more, stop) are avoided or delayed.

• Normalised slippage: Small overruns become acceptable, so early warning signs are ignored until the impact is severe.

Underpinning all of this is inconsistency. When different teams use different methods, templates, and scoring scales to assess risks and issues, it becomes much harder to compare impact, prioritise what truly matters, or orchestrate coordinated mitigation across an entire portfolio. A red risk in one area might be equivalent to an amber in another; escalation thresholds vary; and senior leaders cannot see a coherent picture of exposure.

Standardise the system, not the thinking

To break this pattern, organisations should treat risk and issue management as a core operating system: risks, issues, process, decisions and governance should be implemented in almost the same way across the organisation, with only minor adjustments for context. This does not mean imposing identical content or stripping out professional judgement; it means creating a common language and structure so that:

• The same scales are used to score likelihood and impact.

• The same categories are used to classify risk type and source.

• The same thresholds determine what gets escalated and to whom.

When teams assess risks and issues on a shared scale, the organisation can genuinely compare like with like, see where the biggest threats to delivery time and cost sit, and redirect attention and resources accordingly. Without that consistency, “mitigating risk” becomes more difficult because you are not actually measuring impact in the same way.

Four questions that reset risk governance

A practical way to improve this “risk period” (the time between a risk being identified and it either materialising, being mitigated, or being accepted) is to start by asking, and honestly answering, four simple questions.

1. Who is responsible?

Every material risk and issue must have a single, named owner with clear accountability. This owner is the person empowered to coordinate actions, chase decisions, and confirm closure. When ownership is diffused across a team, delays increase because everyone assumes someone else will act. Naming one individual per risk and per issue forces focus and creates a direct line of sight for senior management. In some organisations there may also be someone who manages the risks and issues and is responsible for the overall coordination. While they are not the owner of the risk or issue, they are responsible for ensuring everyone is informed and updated.

2. What is the process for monitoring risks and issues?

Senior leaders need confidence that there is a consistent, repeatable process for how risks and issues are:

• Identified and assessed (using the same likelihood and impact scales).

• Prioritised (which ones genuinely threaten delivery or cost, and which are absorbable).

• Reviewed (how often, in what forum, with which data).

Defining a clear risk and issue lifecycle (from identification through to closure) turns the risk period into something measurable and manageable. Once that lifecycle is standardised across teams, you can track how long high-impact risks remain unmitigated, how many issues sit open beyond an agreed threshold, and where bottlenecks in decision-making occur.

3. How do you report risks and issues?

Reporting should be designed for decisions, not decoration. That means simplifying and standardising:

• What gets escalated: only risks and issues above specific impact or likelihood thresholds, or that affect critical-path milestones.

• How they are presented: concise description, quantified impact on time and cost, options with recommendations, and a clear ask (approve, defer, reject, escalate).

• How often: a cadence that matches the speed of change. If it is too infrequent, you miss windows to intervene; if it is too frequent, you drown in detail.

When every team uses the same core format and thresholds, senior stakeholders can scan a consolidated view and immediately understand where attention is needed and what decisions are required. Consistent reporting turns fragmented updates into a single, coherent story of delivery risk.

4. Who makes decisions and what is the governing body?

A risk culture cannot work without a decision culture. For each class of risk and issue, you should be explicit about:

• Which body decides (project board, steering committee, executive forum, sponsor alone).

• What authority they have (approve additional budget, move milestones, change scope, accept risk).

• What triggers escalation (for example, impact beyond an agreed time or cost threshold, or cross‑programme dependencies).

When decision rights and governance bodies are unclear, issues linger in “discussion mode”. People bring the same slide back to multiple meetings, waiting for someone senior enough to “take a view”, and this is where the risk period silently extends and delivery quietly slips.

How senior management can stay ahead

For senior management and stakeholders, staying on top of the risks and issues that delay delivery is less about asking for more information and more about tightening and standardising the system around those four questions.

Practical moves include:

• Mandate single-point accountability for all critical risks and issues, visible on one consolidated view.

• Define and agree a standard risk and issue lifecycle, including timelines for assessment, mitigation, and escalation, and apply it consistently across teams.

• Redesign reporting to be decision-oriented: one page per risk or issue, clear impact on delivery time and cost, and a specific decision requested.

• Clarify governance once, upfront: who can decide what, at which forum, and against which thresholds, so that escalation and decision-making work in the same way across the organisation.

When these elements are in place and implemented consistently, the risk period shortens, the quality of decisions improves, and risk stops being a retrospective explanation for failure and becomes a proactive tool for protecting delivery timelines and cost.