Risk is a conversation, not a register
A risk register nobody reads is theatre. I keep risks few, named and owned, and I talk about the top three every week. The value is in the conversation that changes a decision, not the spreadsheet.
Likelihood times impact, then act
For each real risk I ask two questions: how likely, and how bad. That ranks them fast and tells me which ones deserve a mitigation now versus a watch and see. Treating every risk as urgent is the same as treating none of them seriously.
Mitigate, accept, or transfer
Every risk gets an explicit decision: reduce it, live with it, or push it to someone better placed to carry it, such as a vendor, an insurer or a contract clause. Writing down we accept this is a legitimate, powerful choice, and it stops a known risk from becoming a surprise.
In Web3, security risk is existential
On blockchain products a single smart contract flaw can end the company, so risk work moves to the front. On the Datachain bridge I treated audit readiness, testnet stability and key management as first class program risks with named owners and hard gates, not afterthoughts.
Real example
Leading the IBC bridge program I ran a pre mainnet risk review across protocol, security and partner readiness. The two risks that could delay launch, an incomplete audit and an unstable chain pair, got dedicated owners and weekly gates. The rest we consciously accepted and documented.