This is a question I ask people when I’m doing financial training.
The answer is “The one you do not know about“.
In finance we prepare a P&L Explanation. The P&L explanation attributes all P&L to an identified risk or change to a trade. Any unexplained P&L could indicate a risk that is not known. Unexplained risk is then investigated by the Risk Management team.
The same is true of IT projects. The worst risk is the one you do not know about. It is the risk you are not hedging or even managing.
If there is an aspect of your project that you do not understand, and that no one is monitoring from a risk perspective, you may have the worst kind of risk on your project.
The first step in IT Risk Management is identifying a risk.
The IT Risk Manager 
Leave a Reply