Its the most important but often most neglected. If we can answer these, then i think we are good to go in any project
1. Informal Risk Management
--I care more about its being ineffective than its informality
2. Risk Management
--More people need to know how to do risk assessment; not clear we hit high risks; bad at risk assessment; We don't have a good idea of what risks are - can we get to all parts of our product? How to design to reach code paths (automated)? Don't know how to measure. Don't have high level of push to make this happen. Don't know what it means.