The importance of risk management in projects is much talked about. It is also true that effective risk management can avoid many pitfalls or at least minimise their consequences.

But how well do projects actually manage risk? What are the biggest pain points in risk management today?

To find out, we conducted a self-assessment survey in autumn 2025 for project professionals in different sectors. In the survey, respondents assessed how well risks are identified, assessed and monitored in their projects, and how well different measures are defined and implemented. They also assessed how well the policies and tools in place supported risk management.

The results of the self-assessment show that risk management is still not sufficiently used to ensure the success of projects. In particular, there appear to be gaps in the identification of risks and the use of appropriate tools and approaches.

About the material

A total of 50 project professionals responded to the self-assessment. The majority of the evaluations were carried out on ICT projects and delivery and customer projects, but evaluations were also carried out on investment, development and other projects. The typical duration of the projects evaluated ranged from short projects of less than six months to projects lasting several years. Similarly, typical project budgets ranged from less than €0.5 million to several million euros.

A key stumbling block is risk identification

The evaluation results showed that project professionals perceive risk identification as a key bottleneck in the project risk management process. It was particularly noteworthy that this is not a problem for a single type of project. Instead, it recurs in delivery and customer projects, ICT projects, investment projects, internal development projects and other projects.

Risk identification seems to be best in investment projects, although even there it scored the second lowest of the areas examined. The weakest risk identification was found in internal development projects, where risk management may not be taken as seriously as in large and expensive investment projects.

Overall, the finding of perceived shortcomings in risk identification is significant. If risks are not even identified, it is impossible to try to prepare for or manage them. This inevitably leads to slipping schedules and exceeding budgets if and when unexpected problems arise.

The evaluation results also suggest that risk identification does not draw nearly enough on the findings and lessons learned from previous projects. In our view, this is a significant problem and directly affects the overall effectiveness of risk management in projects.

The toolbox is wrong (or empty!)

The evaluation also found that many projects lack a systematic risk management process and appropriate tools. This makes risk management haphazard and, at worst, inefficient.

Again, this weakness is repeated across all project types assessed, and investment projects also performed best of all project types. It is noteworthy that, even for investment projects, operational models and tools scored the lowest.

The results also showed that the use of AI tools in risk management is very mixed. There are efforts to use AI, but the use of AI may not yet be very systematic.

So what?

Although our results are not statistically valid per se, our findings give a clear indication of the pain points experienced by project professionals in different sectors in managing risk.

They suggest that there are still many gaps and areas for improvement in project risk management.