Risk management is handled very differently by different orgs in my experience. There's a few different approaches:If it makes any of you feel better, I was told to take a risk off of a risks and issues register as it ‘sounded too negative’. Erm…
- Don't track and manage risks in a formal way at all
- Lip service, maintain a risk/RAID log for the sake of it but don't do any active management. Very few risks are ever closed.
- Head in the sand, mark everything as green or amber (sounds a bit like your situation). Channel the raising of risks through a small group of people. Probably more common in a supplier-client relationship.
- What I call the "mirror" approach to risk management, whereby if you raise a risk, the senior leaders immediately reflect it back at you and demand to see your plan for mitigating the risk (often the whole point of flagging up a risk at a SteerCo is because it needs additional intervention/support, if it was easily mitigated it would've been done already and not be in the list of top risks). Creates a culture where people are scared to raise risks because it just creates more work/admin.
- Generally effective risk management with regular discussion and status updates, collaboration around mitigations rather than just keeping your head down and praying the actions lie with others.