Like loyalty, bravery, thrift, and other Boy Scout virtues, risk management is one of those software engineering principles that everyone knows about -- but very few practice at the individual, project, or enterprise level. It's a required "key process" in the SEI CMM, and it's dutifully incorporated into corporate methodologies, but organizations continue to ignore blatant risks as they undertake large, complex projects. Worse still, they continue to practice the age-old game of "shoot the messenger" if anyone does bother to convey bad news to the project manager.