It is Not Risk, it is Part of Doing Business
The sources are many fold. I have heard every reason for not putting risk in the register. "It is not a risk. That is the cost of doing business." That was a favorite one. It was in response to the risk that a majority of the key people might leave. The rumor was they were frustrated with the mismanagement and looking for new jobs. Instead of trying to improve working conditions or cross training people, both required admitting a problem existed, it was better to ignore the issue and try to convince people it was a normal part of business. It is hard to explain the rationale. Even trying to write it down in a coherent sentence is difficult.
Your Own Plans
I am a firm believer that good project managers assume authority—enough, at times, to hang themselves. Maybe this requires a second, private risk register where project managers maintain a private stash of mitigation and contingency plans. Somehow, they need to develop a set of plans to thwart the possibilities, even if through covert means. This will run opposed to management's desires, but it is the job of the project manager to plan for problems.
In the above case, I rebuilt the schedule and staffing plans to include two extra people and cross training everyone on the project. After the project successfully completed, I had an interesting conversation over beer. The cross training had an unintended effect—no one felt they could hurt the company by leaving, so they stayed waiting for a better opportunity. I took a beating for labor costs, but we delivered the project.
If the project delivers on time and within budget, people forget that you were, depending on your gender, a female dog or rectal sphincter. The trick is to employ tools that remove the emotion. Address indecision by using action item logs or, better yet, corporate issue tracking systems. Use them from the first day on the job. This creates an expectation of accountability. Befriend sponsors, managers, and steering committee members to work as your allies—someone you can trust. Use them to apply peer pressure on managers that have trouble addressing open action items.
If the probability of a risk is too high, make it a task. It is a good practice that when a risk has more than 60 percent chance of occurrence it should be a task. Drop the threshold to 45 or 50 percent. This is better than padding the timeline, since padding cannot be removed. Tasks that are shown to be irrelevant can be, moving the entire schedule to the left.
Hiring third-party consultants to identify risks is mitigation in its own right. Leave the risk of identifying risk to someone that is expendable. This is a primary benefit of the outside consultants recovering projects. They are justified by their expertise, revered by management, and have free license to talk about the elephant in the room. The challenge is convincing management that there is a problem large enough to require outside help. Without management realizing that there is an irresolvable issue, little can be done to address it.
The Project Manager's Bottom Line
Risk is neither bad nor good—it is a fact of doing business. However, it requires management to admit there is a problem, understand how to address it, and, if it becomes an issue, how to lessen its impact. It takes forethought and planning. Too many managers operate with their heads in the sand and it becomes incumbent upon the project manager to lead and educate. It is true here, as in many areas of project management, the project manager is a leader managing up and down the chain of command.