Risk management is getting to be too complex to use on anything less than a major, multimillion-dollar project. The use of risk management on IT programs is overly complicated. This two-part Bulletin shows one way of cutting through the clutter of risk management tools, status reports, and metrics by adopting a simple, stratified approach.