In 2002, Cutter Consortium conducted its first comprehensive survey of the state of risk management practice in the IT community [1]. The survey found that some 86% of organizations responding claimed they were practicing risk management, and 51% of those were practicing it in a disciplined, formal manner. From reports in general software literature, surveys on risk management and its relationship to capturing lessons learned, anecdotal experience, and so on, the practice of risk management seems to have grown both generally and in formality over the past four years.